Introduction
CBOR (Concise Binary Object Representation) is a binary data format standardized in RFC 8949. It is the data format for CoAP (Constrained Application Protocol, RFC 7252), which is the IoT equivalent of HTTP. CBOR is used in smart home devices, industrial sensors, and FIDO2/WebAuthn authentication. If you work with IoT protocols, debug CoAP payloads, or inspect WebAuthn assertion data, this tool encodes and decodes CBOR in your browser using the cbor-x library.
What this tool does
- Encodes JSON objects into CBOR binary format (RFC 8949)
- Decodes CBOR bytes back to JSON
- Outputs encoded data in both hex and base64 formats
- Accepts hex or base64 input when decoding (auto-detected)
- Supports all CBOR major types: integers, strings, byte strings, arrays, maps, tags, simple values
How this tool works
In encode mode, the tool parses input as JSON and passes it to cbor-x's encode() function. The resulting Uint8Array is displayed as hex and base64. In decode mode, it auto-detects hex vs base64 input, converts to a Uint8Array, and passes it to cbor-x's decode() function. The decoded JavaScript object is stringified with JSON.stringify() for display. The cbor-x library is a high-performance CBOR implementation for JavaScript that supports the full CBOR type system including tagged values and byte strings. The tool updates output on every keystroke.
How CBOR encoding works
CBOR uses a compact type-length-value encoding where the first byte (the "initial byte") encodes both the major type (3 bits) and additional information (5 bits). The 7 major types are: unsigned integer, negative integer, byte string, text string, array, map, and tag/simple values. For small values, the length is encoded directly in the additional information bits. For larger values, the length is stored in 1, 2, 4, or 8 following bytes. This design makes CBOR extremely compact for small values: the integer 0 is a single byte (0x00), a 5-byte string is 6 bytes total, and a 2-element array of small integers is 3 bytes. CBOR was designed by Carsten Bormann, who also co-designed CoAP. RFC 8949 (December 2020) is the second edition, replacing RFC 7049.
How to use this tool
- Select mode: Encode or Decode.
- For encoding: enter valid JSON in the input box. Output shows hex and base64.
- For decoding: paste hex or base64 CBOR data. The tool auto-detects the format.
- Use the Swap button to switch between modes.
- Copy the output using the Copy result button.
Real-world examples
Inspecting a WebAuthn assertion
WebAuthn (FIDO2) uses CBOR to encode authenticator data. When a user authenticates with a security key, the authenticatorData field is CBOR-encoded. Paste the hex of the authenticatorData into decode mode to inspect the structure: rpIdHash, flags, signCount, and attested credential data.
Encoding CoAP message payloads
CoAP messages carry CBOR payloads for IoT sensors. A temperature reading like {"t":23.5,"h":45,"ts":1700000000} encodes to 16 bytes in CBOR vs 42 bytes in JSON. For battery-powered sensors transmitting every few seconds, this 60% reduction extends battery life significantly.
Debugging a CBOR-based smart home protocol
Thread and Matter (the smart home standard) use CBOR for message encoding. If a device sends a malformed payload, capture the hex from the network trace, decode it here, and inspect the structure to identify which field is incorrect.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| CBOR (RFC 8949) | Type-length-value binary | IoT, CoAP, WebAuthn |
| MessagePack | Type-length-value binary | Redis, gRPC-Web, APIs |
| JSON | Text with delimiters | REST APIs, web standard |
| Protocol Buffers | Schema-based binary | gRPC, Google APIs |
Limitations or considerations
CBOR supports types that JSON does not have: byte strings, tagged values, simple values, and maps with non-string keys. When encoding JSON, these types are not available since JSON only has strings, numbers, booleans, null, arrays, and objects. When decoding, byte strings are rendered as their hex representation and tagged values may appear as plain values without the tag. The tool uses JSON as its input/output format, so CBOR-specific features like deterministic encoding (RFC 8949 Section 4.2) are not configurable.
Frequently asked questions
What is CBOR used for?
CBOR is the data format for CoAP (RFC 7252), the IoT equivalent of HTTP. It is also used in WebAuthn/FIDO2 for authenticator data, in Matter (smart home standard), and in Thread networking. Any application needing compact binary serialization in constrained environments may use CBOR.
How does CBOR compare to MessagePack?
Both are binary JSON alternatives. CBOR is an IETF standard (RFC 8949) with formal specification and extensibility. MessagePack is community-driven with broader language support. CBOR has better support for IoT-specific features like deterministic encoding and preferred serialization. MessagePack has more implementations and is more common in web infrastructure.
Why is CBOR used in WebAuthn?
WebAuthn authenticators (security keys, biometric sensors) are constrained devices with limited memory and processing power. CBOR's compact encoding and fast parsing make it ideal for the authenticatorGetAssertion and authenticatorMakeCredential commands defined in the FIDO2 CTAP specification.
Can CBOR encode binary data natively?
Yes. CBOR has a dedicated byte string major type (type 2). This is an advantage over JSON, where binary data must be base64-encoded, adding 33% overhead. Byte strings in CBOR are stored as raw bytes with a length prefix.
Conclusion
CBOR is the standard binary format for IoT (CoAP), authentication (WebAuthn), and smart home protocols (Matter). This tool provides instant encoding and decoding using the cbor-x library. Use it to inspect WebAuthn assertion data, debug CoAP payloads, or compare serialization efficiency with JSON and MessagePack.