Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

Head-to-head · SBOM Generation Tools

Syft vs cdxgen

  • Updated Nov 2026
  • Both researched from official sources
  • 7 checks side by side
Syft #5 in SBOM Generation Tools 7.9/10 Free plan Free plan✓ 5 of 6 features Visit Syft
cdxgen #6 in SBOM Generation Tools 7.9/10 Free plan Free plan✓ 6 of 6 features Visit cdxgen

Syft leads on 0 checks, cdxgen on 0, and 7 are even. Who comes out ahead on the 7 yes/no, price and count checks where we have data for both products. The editor score weighs everything else too.

Our verdict

  • Free planboth
  • Most featurescdxgen · 6 of 6

Syft and cdxgen score identically on our rubric (7.9 out of 10) for sbom generation tools; Syft sits at #5 and cdxgen at #6 in our editorial ranking, so the choice comes down to fit.

Syft is the better fit for broad SBOM generation across images and filesystems. cdxgen is the better fit for multi-ecosystem source, container, and binary SBOMs.

  • Syft fits best

    Broad SBOM generation across images and filesystems

  • cdxgen fits best

    Multi-ecosystem source, container, and binary SBOMs

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Side by side

Feature Syft 7.9/10 Visit ↗ cdxgen 7.9/10 Visit ↗
At a glance
Editor score 7.9 7.9
Ranking #5 in SBOM Generation Tools #6 in SBOM Generation Tools
Best for Broad SBOM generation across images and filesystems Multi-ecosystem source, container, and binary SBOMs
Pricing model Free Free
Starting price Free plan Free plan
Free plan ✓ ✓
Free trial — —
Deployment Self-hosted Self-hosted, Cloud
Platforms Linux, macOS, Windows Linux, macOS, Windows
Support Community, Docs Community, Docs
Integrations 4 integrations 1 integrations
Built for Solo, Small business, Mid-market, Enterprise Solo, Small business, Mid-market, Enterprise
Features Syft 5/6 · cdxgen 6/6
SPDX output ✓ ✓
CycloneDX output ✓ ✓
Source code input ✓ ✓
Container image input ✓ ✓
Binary input ✓ ✓
Build-pipeline support Not checked yet ✓ (best)
Our review
Pros
  • Creates CycloneDX and SPDX output and converts between supported formats
  • Scans images from Docker, Podman, Containerd, OCI archives, and registries
  • Generates signed SBOM attestations using the in-toto specification
  • Generates CycloneDX BOMs from source, repositories, containers, and binaries
  • Exports SPDX 3.0.1 JSON-LD and supports CI/CD pipelines
  • Companion commands audit, validate, sign, and convert BOMs
Cons
  • Command-line and Go library workflows may not suit teams seeking a graphical interface
  • Self-hosted deployment places operation with the adopting team
  • Support is through community channels and documentation
  • Command-line workflow may not suit teams seeking a graphical interface
  • Support channels are community and documentation
  • Its primary native output is CycloneDX, with SPDX available as an export
Our verdict

Syft is an open-source command-line tool and Go library from Anchore for generating software bills of materials. It suits teams that need to inventory software across container images, filesystems, directories, individual files, and…

Read the review →

cdxgen is an open-source command-line tool for generating software bills of materials from source code, repositories, package URLs, container images, and binary artifacts. It is aimed at developers, build engineers, and AppSec or…

Read the review →
  1. SyftSBOM Generation Tools 7.9Free plan
  2. cdxgenSBOM Generation Tools 7.9Free plan

Strengths and trade-offs

  • Syft — where it wins

    • Creates CycloneDX and SPDX output and converts between supported formats
    • Scans images from Docker, Podman, Containerd, OCI archives, and registries
    • Generates signed SBOM attestations using the in-toto specification

    Where it doesn't

    • Command-line and Go library workflows may not suit teams seeking a graphical interface
    • Self-hosted deployment places operation with the adopting team
    • Support is through community channels and documentation

  • cdxgen — where it wins

    • Generates CycloneDX BOMs from source, repositories, containers, and binaries
    • Exports SPDX 3.0.1 JSON-LD and supports CI/CD pipelines
    • Companion commands audit, validate, sign, and convert BOMs

    Where it doesn't

    • Command-line workflow may not suit teams seeking a graphical interface
    • Support channels are community and documentation
    • Its primary native output is CycloneDX, with SPDX available as an export
  • Syft7.9/10 · Free plan

    A free, open-source CLI and Go library for creating and converting CycloneDX and SPDX SBOMs.

    Visit SyftFull verdict →
  • cdxgen7.9/10 · Free plan

    A flexible SBOM command-line tool spanning source, containers, and binaries.

    Visit cdxgenFull verdict →

Syft vs cdxgen: questions

Which is better for SBOM generation tools, Syft or cdxgen?

Syft and cdxgen score identically on our rubric (7.9 out of 10) for sbom generation tools; Syft sits at #5 and cdxgen at #6 in our editorial ranking, so the choice comes down to fit.

How do Syft and cdxgen compare?

All 7 checks we put side by side come out level: neither leads on any.

Do Syft and cdxgen have a free plan?

Syft: Yes. cdxgen: Yes.

More comparisons

All SBOM generation tools comparisons → · Full ranking →

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Last updated · How we research and update