Universal workbench

CycloneDX XML to SPDX YAML

Create SPDX YAML from CycloneDX XML locally, with no upload or account.

Device-onlyNo uploads. Ever.

Pipelines, branches, presets, naming, and detailed controls

Display

Text sizeDensity High contrast Monospace editor

Quick start

JSON → YAML WebP → PNG SVG → React JSX Plain text → Base64

From

Help me choose the best output Suggested: Canonical SBOM JSON

What matters most?

Recommendations use the registered target format and tested fidelity classification. They never inspect or upload your content.

01Input

Drop files or a folder hereChoose CycloneDX XML files or a folder — batch input is welcome

Choose files Choose folder

or paste content

02Configure & run

CycloneDX XMLSPDX YAML

structural conversion · single or batch

Conversion preflightSize, memory, engine, execution, and fidelity before you start

Input: 370 B
Estimated peak memory: 16 MiB
On-demand download: No large engine download
Execution: Responsive local worker
Fidelity: No lossy step declared

What to providePaste valid CycloneDX XML syntax or drop one or more .cdx.xml files.What you’ll getProduces previewable SPDX YAML text and a correctly named download.

Output naming & batch behavior

Filename templateBuild the name with the variables below. Duplicate names receive a safe numeric suffix.

Exampleoutput.spdx.yaml

Pipeline 1 linear · 0 branches

Why use A → B → C?

A pipeline feeds each result directly into the next compatible converter. Use one when the destination needs an intermediate representation or when you want to inspect and normalize that middle format.

JSON → CSV → XLSX turns records into rows before building a workbook.
Markdown → HTML → DOCX resolves markup before creating a document.
SVG → PNG → PDF intentionally flattens vector artwork before placing it on a page.

Only type-compatible next steps are offered. Lossy steps are marked before you run them.

1CycloneDX XML to SPDX YAMLstructural

Add compatible step

Parallel output branchesEach branch receives the final linear result. Branches do not feed or depend on one another.

Add a parallel destination

03Tool output

Produces previewable SPDX YAML text and a correctly named download.Lightweight text routes update after 360 ms. Downloads remain explicit.

Processing happens locally. Your file bytes are never sent anywhere.

About this conversion

How to convert CycloneDX XML to SPDX YAML

Before you start

Paste valid CycloneDX XML syntax or drop one or more .cdx.xml files.

Accepted: .cdx.xml · application/vnd.cyclonedx+xml

Paste valid CycloneDX XML content, choose files, or drag them onto the drop zone.
Confirm the detected format. Mixed-format batches are flagged before conversion.
Select “Convert on this device.” Produces previewable SPDX YAML text and a correctly named download.

How this converter behaves

API collections and software bills of materials are normalized into typed local models; requests are never sent and converted metadata is never uploaded.

What happens to your data?

The conversion engine runs in this browser tab. OmniCastConverter has no upload API and never sends your content, file name, or converted result to a server.

Fidelity and limitations

This route is classified as structural. The converter preserves meaning and structure supported by both formats.

SBOM conversion preserves common component identity and dependency data. Revalidate the result against the destination specification before compliance use.
Core components, versions, package URLs, licenses, hashes, suppliers, and dependency relationships are normalized. Format-specific evidence, annotations, signatures, and advanced relationship semantics require review.

Try a valid example

The “Use example” action in the workbench loads this exact input. Produces previewable SPDX YAML text and a correctly named download.

<?xml version="1.0"?><bom xmlns="http://cyclonedx.org/schema/bom/1.6" version="1"><metadata><component type="application"><name>Local app</name><version>1.0.0</version></component></metadata><components><component type="library" bom-ref="pkg:npm/example@1.0.0"><name>example</name><version>1.0.0</version><purl>pkg:npm/example@1.0.0</purl></component></components></bom>