📦 CBOR Decoder & Diagnostic Viewer
Paste CBOR bytes (hex or base64) to see the decoded value as diagnostic notation and a typed tree — integers, strings, arrays, maps, tags and floats.
Diagnostic notation
{"age": 1000, "name": "Chloe"}
Structure
Paste a CBOR (Concise Binary Object Representation, RFC 8949) message as hex or base64 to decode it into readable diagnostic notation and a typed structure tree. CBOR is a compact binary format used by WebAuthn/passkeys (COSE), IoT protocols and more. The decoder handles integers (exact to 64 bits), byte and text strings, arrays, maps, tags, half/single/double floats and indefinite-length items — all in your browser, with nothing uploaded. 🔒 100% client-side.
How the cbor decoder & diagnostic viewer works
CBOR (Concise Binary Object Representation, RFC 8949) is a compact binary data format — think of it as binary JSON with a few extra types. Every item starts with one byte that encodes a major type (unsigned int, negative int, byte string, text string, array, map, tag, or float/simple value) and a length or value. This tool reads the bytes (hex or base64) and decodes the whole structure into the RFC's diagnostic notation — a JSON-like text where byte strings are written h'…', tags as N(value) and floats with a decimal point — alongside a typed tree you can scan. It handles definite and indefinite lengths, tags, simple values (true/false/null), and half, single and double-precision floats, using BigInt so 64-bit integers stay exact.
CBOR is everywhere in modern security and IoT: it is the encoding inside WebAuthn/passkey attestation and COSE-signed objects, and it is used by many constrained-device and IoT protocols. Decoding a message is the quick way to see what a passkey response or a signed token actually contains. This is a decoder, not a validator — it shows the structure faithfully but does not check signatures or a schema — and everything runs in your browser, so a potentially sensitive payload is never uploaded.
Frequently asked questions
What is CBOR?
CBOR (Concise Binary Object Representation) is a compact binary serialization format defined in RFC 8949 — essentially a binary, more efficient cousin of JSON that also supports byte strings, tags and exact integers. It is widely used where small size and fast parsing matter, such as WebAuthn/passkeys and IoT.
What is CBOR diagnostic notation?
A human-readable text form of a CBOR value defined by the RFC: it looks like JSON but writes byte strings as h'0102', tags as N(content), and floats with a decimal point (1.0, 1.5). This tool outputs it so you can read a binary CBOR message at a glance.
Can I decode a WebAuthn or passkey response with this?
Yes — WebAuthn attestation objects and COSE keys are CBOR, so pasting the raw bytes (as hex or base64) decodes the structure into readable form. Note it shows the contents; it does not verify the attestation signature.
Does it handle all CBOR types?
It decodes all the major types — unsigned and negative integers (exact to 64 bits via BigInt), byte and text strings, arrays, maps, tags, and simple/float values including half-precision — plus indefinite-length strings, arrays and maps.
Is CBOR the same as MessagePack?
They're similar compact binary formats, but not the same — different byte encodings and type sets. This tool decodes CBOR (RFC 8949); a MessagePack blob won't decode correctly here.
Is my data uploaded?
No — the message is decoded entirely in your browser and nothing is transmitted, so sensitive payloads stay on your device. It works offline too.