Generate a Software Bill of Materials
Paste a dependency manifest and instantly generate a CycloneDX or SPDX SBOM — the format EU Cyber Resilience Act and supply-chain compliance requests ask for.
Paste your manifest
Supports package.json, requirements.txt, composer.json, go.mod, Cargo.toml, Gemfile.lock, and more. Free plan generates SBOMs for up to 500 packages per manifest.
Press Cmd+Enter (Mac) or Ctrl+Enter (Windows/Linux) to generate
What goes in an SBOM
A Software Bill of Materials is a machine-readable inventory of every component in your software — the same idea as an ingredients label, applied to code. Paste a manifest or lockfile above and GeekWala builds one component entry per dependency: its name, its exact version, and a Package URL (purl) that uniquely identifies it across ecosystems (e.g. pkg:npm/lodash@4.17.21).
An SBOM needs an exact, published version for every component: a version range like ^1.2.0 isn't a real, resolvable artifact, so packages that only have a range are skipped and called out in a warning rather than embedded with a made-up version. For the most complete SBOM, paste a lockfile (which pins exact versions) rather than a top-level manifest.
Nothing is uploaded as a file and nothing is saved server-side. The SBOM is generated for this one request and downloaded directly to your browser.
CycloneDX vs SPDX
Both are OWASP/Linux-Foundation-governed, machine-readable SBOM standards; the choice usually comes down to what your compliance requirement or downstream tooling asks for.
CycloneDX 1.6 is OWASP's format, built with security use cases in mind: it's the more common choice when the SBOM feeds a vulnerability-management pipeline. GeekWala's CycloneDX output includes a bom-ref and purl per component plus generation metadata (timestamp, tool name).
SPDX 2.3 is the older format in this pair (an earlier SPDX release, 2.2.1, was standardized as ISO/IEC 5962:2021), originally built around license and provenance declarations rather than security data. GeekWala's SPDX output marks fields it can't independently verify (declared license, copyright, download location) as NOASSERTION per the SPDX convention, rather than guessing.
If a customer, regulator, or the EU Cyber Resilience Act asks for "an SBOM" without naming a format, CycloneDX is the more common default today; ask if you're unsure, since the two aren't interchangeable for every downstream tool.
Frequently asked questions
Is this free?
Yes: no signup, up to 500 packages per manifest.
Does GeekWala store what I paste or the SBOM itself?
No. The manifest is parsed and the SBOM built for this one request; nothing is written to a database and no account is required. The download happens entirely in your browser.
Why are some of my packages missing from the SBOM?
An SBOM component needs one exact, published version. If your manifest lists a range (common in a top-level package.json rather than a lockfile), that package can't be embedded and is listed in a warning instead of silently dropped.
Can I generate an SBOM for an existing project instead?
Yes: authenticated projects can export a CycloneDX or SPDX SBOM directly from a scan or project's tracked dependency list, and re-export anytime as that list changes.
Want ongoing vulnerability monitoring, not just a one-off SBOM?
GeekWala scans your dependencies for known vulnerabilities with EPSS and CISA KEV prioritization — save projects, track history, and get alerted on new issues.
Get Started Free