Syft

Free#5 of 33 in SBOM Generation Tools

Syft: A free, open-source CLI and Go library for creating and converting CycloneDX and SPDX SBOMs. Ranked #5 of 33 in SBOM Generation Tools by our editors (7.9/10); pricing: Free plan; best for broad SBOM generation across images and filesystems.

7.9/10Editor score

Visit Syft

Syft7.9 Visit Syft

At a glance

Editor score
7.9 / 10
Pricing
Free plan
Best for
Broad SBOM generation across images and filesystems
Free plan
Yes
Paid from
Free
Source code input
Yes
Facts checked
14 Nov 2026

Where it wins
- Creates CycloneDX and SPDX output and converts between supported formats
- Scans images from Docker, Podman, Containerd, OCI archives, and registries
- Generates signed SBOM attestations using the in-toto specification
Where it doesn't
- Command-line and Go library workflows may not suit teams seeking a graphical interface
- Self-hosted deployment places operation with the adopting team
- Support is through community channels and documentation

Our verdict on Syft

Syft is an open-source command-line tool and Go library from Anchore for generating software bills of materials. It suits teams that need to inventory software across container images, filesystems, directories, individual files, and archives, whether working on Linux, macOS, or Windows. Its package catalog spans ecosystems including Alpine, Debian, RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, and .NET, making it relevant to varied software stacks rather than one language or package manager.

Format flexibility is a core strength: Syft produces CycloneDX XML and JSON, as well as SPDX tag-value and JSON, and can convert between supported SBOM formats. It can scan container images through Docker, Podman, Containerd, OCI archives, and registries. Syft also integrates with Grype, and can create signed SBOM attestations using the in-toto specification. These capabilities make it a fit for teams that want SBOM generation to connect with container workflows and related analysis, while still choosing among established output formats.

Syft is free and self-hosted, so it is a practical choice for teams comfortable operating a CLI or incorporating a Go library into their workflows. Community support and documentation are the listed support channels. Anchore separately offers commercial support and enterprise products; those are distinct from Syft itself. The tradeoff is that Syft centers on command-line and library use rather than a graphical workflow, and self-hosting means teams manage its operation. Choose Syft for broad, format-flexible generation across images and filesystems; consider another option if a managed interface or a different support model is essential.

Your product? Our editors can test Syft in depth and publish a review, labelled as paid · from $149/mo →

Syft pricing

Plans Free planFree Free to use — no paid tier required for the core job.

See plans on github.com

Syft fact sheet

Free plan	Yes
Paid from	Free
SPDX output	Yes
CycloneDX output	Yes
Source code input	Yes
Container image input	Yes
Binary input	Yes
Build-pipeline support	Not verified
Deployment	Self-hosted
Platforms	Linux, macOS, Windows
Support	Community, Docs
Built for	Solo, Small business, Mid-market, Enterprise (editorial estimate)
Integrations	4 integrations: Grype, Docker, Podman, Containerd
Pricing	Free plan
Website	github.com
Facts checked	14 Nov 2026

Syft integrations

Syft lists 4 integrations on its own site.

Grype
Docker
Podman
Containerd

Alternatives to Syft

See all Syft alternatives →

Syft vs the competition

Compare Syft with any tool side by side →

Used Syft? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Syft for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?

I've used Syft myself and this is my honest opinion — nobody paid or asked me to write it.

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Syft is listed in our SBOM Generation Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/syft/"><img src="https://www.itechguides.com/best/badge/syft.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update