Syft is a powerful and easy-to-use open-source tool for generating Software Bill of Materials (SBOMs) for container images and filesystems. It provides detailed visibility into the packages and dependencies in your software, helping you manage vulnerabilities, license compliance, and software supply chain security.
Publisher’s description
What is Syft?
Syft by Anchore Inc is open-source Windows software in the containers & devops category. It ranks 16th by popularity among containers & devops in this catalogue. It is written in Go.
Installation and requirements
The publisher provides Portable installers for 64-bit and ARM64 Windows. It runs without installation (portable).
Updates and version history
The current version is 1.54.1, released on October 6, 2026. The version history goes back to November 4, 2024: 52 releases, all linked to the official files. That is about 27 releases a year. The last update is less than a month old.
Popularity and file types
The Chocolatey package has been downloaded 180,775 times. The source code on GitHub (anchore/syft) has 9,715 stars. Similar programs include Docker Compose, Pulumi and Kubernetes - Minikube - A Local Kubernetes Development Environment.
Project description on GitHub: “CLI tool and library for generating a Software Bill of Materials from container images and filesystems”
Pros / Cons
Pros
- Open source: the code can be inspected and built by anyone
- Native ARM64 build for Windows on Arm
- Portable: runs without installation
- Frequent updates (about 27 a year)
- Large user base
In short: Syft is an open-source containers & devop tool for 64-bit and ARM64 PCs. It is actively maintained.
Is Syft safe to download?
- The file is served by github.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
8B56E8285E295E0BBED26EEEA9B16ED51C493BE97CCDF42DAE6326C84FE8E19F· Open the VirusTotal report for this hash - The link has not been checked yet
- The source code is public
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Security practices (OpenSSF Scorecard)
Automated checks of the anchore/syft repository on GitHub by the Open Source Security Foundation, last run on October 19, 2026.
- Code review10
- No dangerous workflows10
- Security policy10
- Actively maintained10
- Restricted token permissions10
- No binaries in the repository10
- Fuzzing10
- Licence declared10
- Static code analysis10
- Signed releases8
- Pinned dependencies6
- Branch protection4
- OpenSSF Best Practices badge0
The score rates how the project is developed and released, not whether the program is safe to install. scorecard.dev
Recent versions
All 52 versions ›52 versions over 2 years · about 27 a year
| Version | Date | Size | Files |
|---|---|---|---|
| 1.54.1Latest | October 6, 2026 | — | 64-bit ZIPARM64 ZIP |
| 1.54.0 | October 1, 2026 | — | 64-bit ZIPARM64 ZIP |
| 1.52.0 | September 17, 2026 | — | 64-bit ZIPARM64 ZIP |
| 1.51.1 | August 27, 2026 | — | 64-bit ZIPARM64 ZIP |
| 1.51.0 | August 10, 2026 | — | 64-bit ZIPARM64 ZIP |
| 1.50.0 | July 28, 2026 | — | ARM64 ZIP64-bit ZIP |
| 1.49.0 | July 21, 2026 | — | 64-bit ZIPARM64 ZIP |
| 1.48.0 | July 16, 2026 | — | 64-bit ZIPARM64 ZIP |
Install from the command line
Silent install ›winget install --id Anchore.Syft -echoco install syft -yscoop install main/syftRelated guide: How to use winget: install and update apps
Also for other systems
brew install syftInformation
- Publisher
- Anchore Inc
- Category
- Containers & DevOps
- Licence
- Apache-2.0
- Price
- Free
- Source code
- github.com/anchore/syft
- Written in
- Go
- Requires
- Windows 11 / 10
- Architecture
- 64-bit, ARM64
- Installer
- Portable
- Version
- 1.54.1
- Released
- October 6, 2026
- Added to the catalogue
- November 26, 2024
- Versions listed
- 52
- Updates / year
- 27.1
- Chocolatey downloads
- 180,775
- GitHub stars
- 9,715
- GitHub forks
- 1,016
- Website
- github.com
- winget ID
- Anchore.Syft
- Chocolatey package
- syft
- Scoop package
- main/syft
Ratings and reviews
No reviews yet. Be the first to rate it.
Alternatives to Syft
See all ›-
Open source559.4K ↓ -
Open source395.6K ↓ -
Kubernetes - Minikube - A Local Kubernetes Development Environment1.39.0minikube quickly sets up a local Kubernetes cluster on macOS, Linux, and Windows. We proudly focus on helping application developers and new Kubernetes users.Open source747.8K ↓ -
Open source1.6M ↓ -
Open source82.7K ↓ -
Open source299.3K ↓ -
Serverless Framework3.39.0Build applications on AWS Lambda and other next-gen cloud services, that auto-scale and only charge you when they run.Open source84.9K ↓ -
Open source2.3M ↓
Frequently asked questions
Is Syft free?
Yes. Syft is open-source software under the Apache-2.0 licence.
Is Syft safe to download?
The download comes from github.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
How do I install Syft with winget?
Open PowerShell or Windows Terminal and run the winget command shown on this page. winget downloads the official installer and checks its SHA256 hash before running it.
Does Syft run on ARM (Windows on Arm)?
Yes, there is a native ARM64 installer.
Where can I download an older version of Syft?
The versions page lists all 52 versions with links to their official installer files, back to November 4, 2024.
Can I use Syft without administrator rights?
Yes, it is portable: unpack and run it.
What are alternatives to Syft?
Docker Compose, Pulumi, Kubernetes - Minikube - A Local Kubernetes Development Environment, Helm and Trivy. The alternatives page compares them.
