SBOM Generator

Paste a resolved dependency lockfile and generate a deterministic CycloneDX or SPDX software bill of materials with package URLs. Supports npm package-lock.json, Cargo.lock, and requirements.txt.

About this tool

SBOM Generator turns a resolved dependency lockfile into a Software Bill of Materials (SBOM). Paste an npm package-lock.json, a Rust Cargo.lock, or a Python requirements.txt, choose CycloneDX JSON, SPDX JSON, or SPDX tag-value, and the tool emits a deterministic dependency inventory with package URLs (purls).

It does not run a package manager or contact registries. A lockfile already records the dependency set, so this tool parses the file locally in WebAssembly and serializes the result. That makes it useful before sharing a project snapshot, attaching an SBOM to a release, or comparing inventories in CI.

Worked example

Given this small package-lock.json:

{"name":"my-app","version":"1.0.0","lockfileVersion":3,"packages":{"":{"name":"my-app","version":"1.0.0"},"node_modules/lodash":{"version":"4.17.21"}}}

with input format npm and output cyclonedx-json, the result includes a CycloneDX 1.6 document whose metadata component is [email protected] and whose components list contains a package URL like:

pkg:npm/[email protected]

Switch output to spdx-tag to emit SPDX 2.3 tag-value text instead, including SPDXVersion, package entries, purl external references, and root DEPENDS_ON relationships.

Limits & notes

Supported inputs: npm package-lock.json v1/v2/v3, Rust Cargo.lock, and pinned or unpinned pip requirements.txt lines.
The tool parses lockfiles as text in memory and caps component inventories at 50,000 packages.
It emits a flat component inventory plus root package metadata. It does not resolve missing transitive dependencies, query vulnerability databases, enrich license metadata from registries, or convert existing SBOMs.
JSON output is deterministic by default. Leave timestamp blank to avoid embedding the current clock; set it only when your workflow requires a real creation time.

FAQ

What is an SBOM?

An SBOM, or Software Bill of Materials, is an inventory of the packages that make up a project. Security, compliance, and release workflows use it to answer questions like "what dependencies are in this build?" and "which package URL identifies each component?"

Why does this tool read lockfiles instead of package manifests?

A manifest such as package.json or Cargo.toml often describes ranges like ^1.2 or workspace rules that require a package manager to resolve. A lockfile records the resolved packages and versions, so it can be converted locally without network access or registry credentials.

Which output format should I choose?

Choose cyclonedx-json for the common CycloneDX JSON workflow, spdx-json when your tooling expects SPDX as JSON, and spdx-tag when a scanner or compliance system wants SPDX tag-value text. All three include package URLs for the dependencies the parser found.

Are dev dependencies included?

For npm package-lock files, Include npm dev / optional dependencies controls whether packages marked dev or optional are kept. Cargo.lock and requirements.txt do not carry the same dev/runtime distinction in this parser, so that option only affects npm input.

Is my lockfile uploaded?

No. The parser and serializer run in your browser through WebAssembly. The lockfile text stays on your device unless you copy the generated SBOM somewhere else.

Developer & Automation Access

Run it from the terminal

Same engine as this page, headless — via the gizza CLI:

gizza tool sbom-generator '{
  "name": "my-app",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "packages": { ... }
}'

New to the CLI? Get gizza →

Open it by URL

Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:

https://gizza.ai/tools/sbom-generator/?lockfile=%7B%0A%20%20%22name%22%3A%20%22my-app%22%2C%0A%20%20%22version%22%3A%20%221.0.0%22%2C%0A%20%20%22lockfileVersion%22%3A%203%2C%0A%20%20%22packages%22%3A%20%7B%20...%20%7D%0A%7D&input_format=auto&output=cyclonedx-json&component_name=my-service&component_version=1.0.0&include_dev=true&timestamp=2026-07-24T12%3A00%3A00Z&pretty=true

Machine-readable descriptor: tool.json — title + parameters JSON Schema for agents.