Free SBOM, firmware and CRA tools
Four checks for IoT and embedded teams: validate a CycloneDX or SPDX SBOM, compare two firmware releases, check EU CRA scope, and decode an X.509 certificate. Everything runs in your browser, and every tool states its limits before you start.
SBOM Validator
Checks the document against the official schema, the quality of component identities, dependency references, and how many components are actually usable for vulnerability matching.
SBOM Diff
Matches components by package identifier, then reports added, removed and updated versions between a baseline and a new release. Unmatched components are reported as unmatched, never silently ignored.
CRA Scope Checker
A source-linked questionnaire that walks product type, market, connectivity, commercial activity, exclusions, role and timing, then reports an indicative scope result, role obligations and transition dates.
X.509 Decoder
Parses a single PEM X.509 certificate in your browser and prints the decoded fields, the date check, key identifiers and the SHA-256 fingerprint.
Start from the question you actually have
Each tool is a different question. If you are not sure where to start, the first two cover most supplier-inventory work.
“A supplier sent me an SBOM and I do not know whether it is usable.”
Validate the file, then look at the query-readiness list rather than the pass/fail line.
“What changed between the last firmware build and this one?”
Compare the two inventories by component identity and exact version.
“Does the EU Cyber Resilience Act apply to this product?”
Work through scope, role and timing, with the provision behind each question.
“What does this certificate in the release bundle actually claim?”
Decode the fields and dates locally. Remember that decoding is not verification.
What each tool accepts
Limits are enforced by the implementation and derived from the same constants the engine uses, so this table cannot drift from the accepted input.
| Tool | Accepted input | Enforced limits | Processing |
|---|---|---|---|
| SBOM Validator | CycloneDX JSON 1.4, 1.5, 1.6 · SPDX 2.3 JSON | Up to 20 MB per file · Up to 20,000 components · JSON only — XML and tag-value SBOMs are not parsed · One file per run | In this browser tab |
| SBOM Diff | CycloneDX JSON 1.4–1.6 · SPDX 2.3 JSON | Up to 20 MB per file · Up to 20,000 components per file · Two files per comparison · Component identity comparison only — no dependency graph inference | In this browser tab |
| CRA Scope Checker | Questionnaire answers | Indicative only — not a legal opinion and not a conformity assessment · Answers stay in your browser and in the exported JSON you choose to save · No account, no upload, no submission to a regulator | In this browser tab |
| X.509 Decoder | One PEM X.509 certificate (`-----BEGIN CERTIFICATE-----`) | 32 KiB maximum input · One certificate per run · Private keys are rejected · PEM only — DER must be converted first | In this browser tab |
Your SBOM is not marketing data
A component list describes exactly what an attacker would look for. Uploading it to a website to get a free check is a supply-chain decision, not a convenience.
No upload, no storage
Parsing and analysis run in this tab. There is no server endpoint that accepts an SBOM.
No account to see a result
Results are shown immediately and exported locally. An email is never required.
No scores for drama
Findings carry a rule, a path and a fix. Nothing is converted into an alarming number.
Read how data is handled for the exact behaviour, and the example reports for real engine output.
Guides that pair with the tools
Each guide starts from a real symptom, gives a procedure, and states what the result does not prove.
How to validate CycloneDX and SPDX SBOMs
A practical order of checks, from schema to query readiness.
Common SBOM validation errors
The defects that appear most often, and the fix for each one.
EU CRA requirements for IoT manufacturers
Scope, roles, reporting and technical documentation, with sources.