# SBOM Generator
Generate CycloneDX or SPDX SBOMs from package-lock.json, Cargo.lock, or requirements.txt. Runs locally in your browser.
## Run it
- **CLI:** `gizza tool sbom-generator '{
"name": "my-app",
"version": "1.0.0",
"lockfileVersion": 3,
"packages": { ... }
}'`
- **Web:** https://gizza.ai/tools/sbom-generator/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/sbom-generator/tool.json
## Inputs
- `lockfile` — Lockfile contents _(field)_
- `input_format` — Input format _(field)_
- `output` — SBOM output format _(field)_
- `component_name` — Root component name _(field)_
- `component_version` — Root component version _(field)_
- `include_dev` — Include npm dev / optional dependencies _(field)_
- `timestamp` — Creation timestamp (optional) _(field)_
- `pretty` — Pretty-print JSON _(field)_
## Output
- SBOM (text)
## Query parameters
Open the tool pre-filled and auto-run via URL:
- `lockfile` — Lockfile contents
- `input_format` — Input format
- `output` — SBOM output format
- `component_name` — Root component name
- `component_version` — Root component version
- `include_dev` — Include npm dev / optional dependencies
- `timestamp` — Creation timestamp (optional)
- `pretty` — Pretty-print JSON
Example: `https://gizza.ai/tools/sbom-generator/?lockfile=%7B%0A%20%20%22name%22%3A%20%22my-app%22%2C%0A%20%20%22version%22%3A%20%221.0.0%22%2C%0A%20%20%22lockfileVersion%22%3A%203%2C%0A%20%20%22packages%22%3A%20%7B%20...%20%7D%0A%7D&input_format=auto&output=cyclonedx-json&component_name=my-service&component_version=1.0.0&include_dev=true×tamp=2026-07-24T12%3A00%3A00Z&pretty=true`
---
## About this tool
SBOM Generator turns a resolved dependency lockfile into a Software Bill of Materials (SBOM). Paste an npm `package-lock.json`, a Rust `Cargo.lock`, or a Python `requirements.txt`, choose CycloneDX JSON, SPDX JSON, or SPDX tag-value, and the tool emits a deterministic dependency inventory with package URLs (`purl`s).
It does not run a package manager or contact registries. A lockfile already records the dependency set, so this tool parses the file locally in WebAssembly and serializes the result. That makes it useful before sharing a project snapshot, attaching an SBOM to a release, or comparing inventories in CI.
### Worked example
Given this small `package-lock.json`:
```json
{"name":"my-app","version":"1.0.0","lockfileVersion":3,"packages":{"":{"name":"my-app","version":"1.0.0"},"node_modules/lodash":{"version":"4.17.21"}}}
```
with **input format** `npm` and **output** `cyclonedx-json`, the result includes a CycloneDX 1.6 document whose metadata component is `my-app@1.0.0` and whose components list contains a package URL like:
```text
pkg:npm/lodash@4.17.21
```
Switch **output** to `spdx-tag` to emit SPDX 2.3 tag-value text instead, including `SPDXVersion`, package entries, purl external references, and root `DEPENDS_ON` relationships.
### Limits & notes
- Supported inputs: npm `package-lock.json` v1/v2/v3, Rust `Cargo.lock`, and pinned or unpinned pip `requirements.txt` lines.
- The tool parses lockfiles as text in memory and caps component inventories at 50,000 packages.
- It emits a flat component inventory plus root package metadata. It does not resolve missing transitive dependencies, query vulnerability databases, enrich license metadata from registries, or convert existing SBOMs.
- JSON output is deterministic by default. Leave **timestamp** blank to avoid embedding the current clock; set it only when your workflow requires a real creation time.
## FAQ
What is an SBOM?
An SBOM, or Software Bill of Materials, is an inventory of the packages that make up a project. Security, compliance, and release workflows use it to answer questions like "what dependencies are in this build?" and "which package URL identifies each component?"
Why does this tool read lockfiles instead of package manifests?
A manifest such as `package.json` or `Cargo.toml` often describes ranges like `^1.2` or workspace rules that require a package manager to resolve. A lockfile records the resolved packages and versions, so it can be converted locally without network access or registry credentials.
Which output format should I choose?
Choose `cyclonedx-json` for the common CycloneDX JSON workflow, `spdx-json` when your tooling expects SPDX as JSON, and `spdx-tag` when a scanner or compliance system wants SPDX tag-value text. All three include package URLs for the dependencies the parser found.
Are dev dependencies included?
For npm package-lock files, **Include npm dev / optional dependencies** controls whether packages marked dev or optional are kept. Cargo.lock and requirements.txt do not carry the same dev/runtime distinction in this parser, so that option only affects npm input.
Is my lockfile uploaded?
No. The parser and serializer run in your browser through WebAssembly. The lockfile text stays on your device unless you copy the generated SBOM somewhere else.
## Related tools
- [SBOM Diff](https://gizza.ai/tools/sbom-diff/): Diff two package-lock.json, Cargo.lock, requirements.txt, or CycloneDX/SPDX SBOMs and see added, removed, and version-bumped dependencies. Runs locally in your browser.
- [Extract Action Items from Meeting Notes](https://gizza.ai/tools/action-item-extractor/): Extract action items, owners, and decisions from meeting notes or daily notes with deterministic rules. Markdown checklist or JSON, private in-browser.
- [Amazon Order Analyzer](https://gizza.ai/tools/amazon-order-analyzer/): Paste an Amazon order-history CSV export to summarize total spend by month, top items, and category breakdowns. Browser-only, private, with Markdown or JSON output.
- [Base Decoder](https://gizza.ai/tools/base-decoder/): Auto-detect and decode Base16, Base32, Base45, Base58, Base64, and Base85 text, including nested layers, locally in your browser.
- [Before / after image slider generator](https://gizza.ai/tools/before-after-slider/): Turn two images into an interactive before/after comparison slider: one self-contained HTML file with inline CSS + JS, no libraries.