Modern software is assembled from hundreds of components that organizations often did not write and do not fully control. Identifying those components reliably is becoming a legal requirement. This article introduces SWHID, an open standard for identifying software artifacts.