What this tool does
Two things developers and SMB software vendors need for the EU Cyber Resilience Act, in one place. The SBOM generator turns a dependency manifest (package.json, a lockfile, requirements.txt, go.mod or composer.json) into a standard CycloneDX 1.6 Software Bill of Materials. The CRA readiness tab shows the obligations and deadlines that apply to products with digital elements on the EU market. Everything runs in your browser, your dependency list is never uploaded.
Why an SBOM matters now
An SBOM is a machine-readable inventory of what's inside your software. It's how you find out fast whether a newly-disclosed vulnerability affects you, and it's increasingly required, the CRA expects manufacturers to maintain one and provide it to authorities on request. Generating one from your manifest takes seconds here.
How to generate an SBOM
- Paste or upload a package.json, package-lock.json, requirements.txt, go.mod or composer.json.
- Click Generate. You get CycloneDX 1.6 JSON with a component per dependency (name, version, purl).
- Download
sbom.cdx.jsonand import it into Dependency-Track, GitHub or your scanner.
Use a lockfile for the fullest result, it captures exact versions of transitive dependencies, not just your direct ones.
EU Cyber Resilience Act, key dates
- 11 September 2026: vulnerability and incident reporting duties to ENISA begin (early warning 24h, notification 72h).
- 11 December 2027: full obligations apply, including secure-by-design, security updates, SBOM and CE marking.
Good to know
- Output is standard CycloneDX 1.6, compatible with the wider SBOM and vulnerability tooling ecosystem.
- The CRA tab is general information, not legal advice; confirm your product class and obligations with an advisor.
- Nothing is uploaded, parsing and generation are entirely client-side.