CBOR Decoder

Decode RFC 8949 CBOR payloads to JSON. hex, base64, or file

Paste a CBOR payload as hex or base64, or drop a .cbor file, and see the decoded JSON instantly. Handles tags, bignums, byte strings, indefinite-length items, and COSE / CWT / CTAP2 structures. 100% client-side. nothing is uploaded.

Hex tolerates 0x, spaces, commas, and newlines. Decoding runs as you type.

CBOR Major Types (RFC 8949)

0 Unsigned int 0 to 264-1
1 Negative int -1 to -264
2 Byte string raw bytes (hex)
3 Text string UTF-8 text
4 Array sequence of items
5 Map key / value pairs
6 Tag semantic wrapper
7 Float / simple f16, f32, f64, bool, null

Recognized Tags

TagMeaningSpec
0Standard date/time string (RFC 3339)RFC 8949 §3.4.1
1Epoch-based date/timeRFC 8949 §3.4.2
2 / 3Positive / negative bignumRFC 8949 §3.4.3
21–23Expected base64url / base64 / base16 conversionRFC 8949 §3.4.5
32URIRFC 8949 §3.4.5.3
35Regular expression (PCRE)RFC 8949 §3.4.5.6
55799Self-described CBOR magicRFC 8949 §3.4.6
16 / 17 / 18COSE_Encrypt0 / COSE_Mac0 / COSE_Sign1RFC 9052
96 / 97 / 98COSE_Encrypt / COSE_Mac / COSE_SignRFC 9052

Understanding CBOR

What is CBOR?

CBOR (Concise Binary Object Representation, RFC 8949) is a binary serialization format inspired by JSON but more compact and faster to parse. Every value starts with a single initial byte: the top three bits encode the major type (0–7) and the bottom five bits carry the additional information (a small value, or a length indicator).

This compact framing means most small values fit in a single byte. 0x00 is the integer 0, 0x18 18 is the integer 24, and 0xa0 is an empty map. The format is self-delimiting, so no terminators or schemas are required to parse it.

How to read a CBOR payload by hand

  • Read the first byte: the top 3 bits give the major type (0-7), the bottom 5 bits give the value or length
  • Additional info 0-23: the value is taken directly from the low 5 bits
  • Additional info 24-27: the next 1, 2, 4, or 8 bytes hold the value
  • Additional info 31: indefinite length. read items until the break stop code 0xff
  • Tags (major 6): consume one more CBOR value as the tagged content

Where is CBOR used?

  • COSE (RFC 9052): the JOSE equivalent for CBOR. used to sign/encrypt/mac CBOR payloads
  • CWT (RFC 8392): CBOR Web Tokens. the binary cousin of JWT
  • FIDO2 / WebAuthn CTAP2: authenticator-to-client messages are CBOR
  • EDHOC, OSCORE: IETF lightweight security protocols for constrained devices
  • RFC 8428 SenML: sensor measurement lists for IoT telemetry
  • OCI image manifests, ATProto (Bluesky), and many embedded RPC systems

CBOR vs JSON

  • Smaller: ints, floats, and byte strings are stored as raw bytes, not text
  • Faster: no escaping, quoting, or whitespace to skip
  • Richer types: first-class byte strings, BigInts, tags, and undefined
  • Streaming-friendly: indefinite-length arrays/maps/strings for incremental encoding
  • Deterministic encoding profile (RFC 8949 §4.2) for canonical serialization

The tradeoff is that CBOR is not human-readable, so a decoder like this one is part of the workflow when debugging.

CBOR Decoder FAQ

What is CBOR?

CBOR (RFC 8949) is a binary data format inspired by JSON. It supports integers, byte strings, text strings, arrays, maps, tags, and floats, and is used by COSE, CWT, FIDO/WebAuthn CTAP2, and many IoT protocols.

How do I decode a CBOR payload?

Paste your payload as hex, base64, or base64url, or drop a .cbor file. The decoder runs as you type and shows the decoded value as Pretty JSON or an Annotated Tree with CBOR types and byte lengths.

Does this tool support COSE or CWT?

Yes. COSE tags 16, 17, 18, 96, 97, and 98 are recognized and labeled. The tool decodes the CBOR structure including nested byte strings, but it does not verify cryptographic signatures.

How are large integers handled?

Values beyond Number.MAX_SAFE_INTEGER are decoded as JavaScript BigInt and rendered as quoted decimal strings in the JSON output so precision is preserved.

What if the payload has trailing bytes?

The decoder reads one complete value and then warns about any unconsumed bytes. The decoded prefix is still shown. useful when inspecting CBOR streams or framed messages.

Is my data uploaded anywhere?

No. Decoding runs entirely in your browser. No payload, file, or decoded result is sent to any server.

Why is a byte string rendered as 0x...?

JSON has no native byte string type. To keep the output valid JSON while preserving the raw bytes, byte strings are rendered as hex with a 0x prefix. The Annotated Tree view labels them as bytes with their byte length.

Does it work with .cbor files?

Yes. Switch to the File input and drop your .cbor, .dat, or .bin file. The file is read as a Uint8Array and decoded locally.