Universal workbench

SPDX YAML to CycloneDX XML

Create CycloneDX XML from SPDX YAML locally, with no upload or account.

Device-onlyNo uploads. Ever.

Pipelines, branches, presets, naming, and detailed controls

Display

Text sizeDensity High contrast Monospace editor

Quick start

JSON → YAML WebP → PNG SVG → React JSX Plain text → Base64

From

Help me choose the best output Suggested: Canonical SBOM JSON

What matters most?

Recommendations use the registered target format and tested fidelity classification. They never inspect or upload your content.

01Input

Drop files or a folder hereChoose SPDX YAML files or a folder — batch input is welcome

Choose files Choose folder

or paste content

02Configure & run

SPDX YAMLCycloneDX XML

structural conversion · single or batch

Conversion preflightSize, memory, engine, execution, and fidelity before you start

Input: 374 B
Estimated peak memory: 16 MiB
On-demand download: No large engine download
Execution: Responsive local worker
Fidelity: No lossy step declared

What to providePaste valid SPDX YAML syntax or drop one or more .spdx.yaml files.What you’ll getProduces previewable CycloneDX XML text and a correctly named download.

Output naming & batch behavior

Filename templateBuild the name with the variables below. Duplicate names receive a safe numeric suffix.

Exampleoutput.cdx.xml

Pipeline 1 linear · 0 branches

Why use A → B → C?

A pipeline feeds each result directly into the next compatible converter. Use one when the destination needs an intermediate representation or when you want to inspect and normalize that middle format.

JSON → CSV → XLSX turns records into rows before building a workbook.
Markdown → HTML → DOCX resolves markup before creating a document.
SVG → PNG → PDF intentionally flattens vector artwork before placing it on a page.

Only type-compatible next steps are offered. Lossy steps are marked before you run them.

1SPDX YAML to CycloneDX XMLstructural

Add compatible step

Parallel output branchesEach branch receives the final linear result. Branches do not feed or depend on one another.

Add a parallel destination

03Tool output

Produces previewable CycloneDX XML text and a correctly named download.Lightweight text routes update after 360 ms. Downloads remain explicit.

Processing happens locally. Your file bytes are never sent anywhere.

About this conversion

How to convert SPDX YAML to CycloneDX XML

Before you start

Paste valid SPDX YAML syntax or drop one or more .spdx.yaml files.

Accepted: .spdx.yaml · application/spdx+yaml

Paste valid SPDX YAML content, choose files, or drag them onto the drop zone.
Confirm the detected format. Mixed-format batches are flagged before conversion.
Select “Convert on this device.” Produces previewable CycloneDX XML text and a correctly named download.

How this converter behaves

API collections and software bills of materials are normalized into typed local models; requests are never sent and converted metadata is never uploaded.

What happens to your data?

The conversion engine runs in this browser tab. OmniCastConverter has no upload API and never sends your content, file name, or converted result to a server.

Fidelity and limitations

This route is classified as structural. The converter preserves meaning and structure supported by both formats.

SBOM conversion preserves common component identity and dependency data. Revalidate the result against the destination specification before compliance use.
Core components, versions, package URLs, licenses, hashes, suppliers, and dependency relationships are normalized. Format-specific evidence, annotations, signatures, and advanced relationship semantics require review.

Try a valid example

The “Use example” action in the workbench loads this exact input. Produces previewable CycloneDX XML text and a correctly named download.

spdxVersion: SPDX-2.3
dataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
name: Local app
documentNamespace: https://example.test/spdx/local
creationInfo:
  created: 2026-01-01T00:00:00Z
  creators: ["Tool: fixture"]
packages:
  - SPDXID: SPDXRef-example
    name: example
    versionInfo: 1.0.0
    downloadLocation: NOASSERTION
    filesAnalyzed: false
    licenseConcluded: MIT