BYTETOOLS

CBOR Decoder

Decode CBOR (RFC 8949) from hex or Base64 into readable JSON and diagnostic notation, with tags, maps, indefinite lengths and half floats.

69
Bytes read
15
Data items

Root item is a map

JSON

{
  "name": "ByteTools",
  "tags": [
    "cbor",
    "rfc8949"
  ],
  "count": 3,
  "ok": true,
  "ratio": 1.5,
  "id": "AQIDBA=="
}

CBOR diagnostic notation

{
  "name": "ByteTools",
  "tags": [
    "cbor",
    "rfc8949"
  ],
  "count": 3,
  "ok": true,
  "ratio": 1.5,
  "id": h'01020304'
}

What is the CBOR Decoder?

The ByteTools CBOR Decoder turns Concise Binary Object Representation bytes into something you can actually read.

  • Full RFC 8949 major types 0 through 7
  • Indefinite-length strings, arrays and maps with break codes
  • Half, single and double precision float decoding
  • Semantic tags decoded, including dates and bignums
  • Both JSON and official CBOR diagnostic notation output
  • 100% client-side — your bytes are never uploaded

How to use the CBOR Decoder

  1. 1

    Pick whether your CBOR is hex or Base64 in the input format list.

  2. 2

    Paste the bytes into the CBOR data box; spaces, line breaks and 0x prefixes are ignored.

  3. 3

    Read the JSON view for a familiar structure, or the diagnostic notation view for a lossless, spec-accurate rendering.

  4. 4

    Copy either output, or download the JSON, and check the header line for the root type, any semantic tags and leftover trailing bytes.

About the CBOR Decoder

The ByteTools CBOR Decoder turns Concise Binary Object Representation bytes into something you can actually read. It parses every RFC 8949 major type — unsigned and negative integers, byte and text strings, arrays, maps, semantic tags and the floats and simple values of major type 7 — and gives you both pretty JSON and the official CBOR diagnostic notation.

Trickier parts of the format are handled properly: indefinite-length strings, arrays and maps terminated by the 0xff break code, half-precision binary16 floats, 64-bit integers that exceed what JavaScript numbers can hold, and semantic tags 0 and 1 for dates and 2 and 3 for bignums. Tags that appear in your data are listed so you know what conventions the encoder used.

Decoding happens 100% locally in your browser — nothing is uploaded or stored. That matters more than usual here, because CBOR routinely carries COSE security tokens, WebAuthn attestation objects and telemetry from real devices. You can paste a payload straight out of a debugger or a packet capture without it ever crossing the network, and the page keeps working offline.

Frequently asked questions

What is CBOR used for?

CBOR is a compact binary format modelled on JSON's data types, standardised as RFC 8949. You will meet it in COSE and CWT security tokens, WebAuthn and FIDO2 attestation objects, and a lot of constrained IoT messaging where every byte on the wire counts.

What is CBOR diagnostic notation?

It is the human-readable text form defined in the CBOR specification. It looks a little like JSON but keeps distinctions JSON cannot express, such as byte strings written as h'0102' and integer map keys. Use it when you need to describe a CBOR value exactly.

Why does the JSON output differ from the diagnostic notation?

JSON has no byte-string type and requires string keys, so byte strings are converted to Base64 and non-string map keys are turned into text, following the conversion guidance in RFC 8949. The diagnostic notation keeps the original types intact, which is why both views are shown.

Can this decode a COSE or WebAuthn attestation object?

Yes. Those objects are ordinary CBOR, so paste the hex or Base64 and the structure comes straight out, including the tag numbers COSE uses. You will still need the relevant specification to interpret what each labelled field means.

Is my CBOR data sent to a server?

No. All parsing runs in your browser with JavaScript and the page makes no network requests, so security tokens and device telemetry stay on your machine.

Related tools