CBOR Decoder & Encoder
Decode CBOR from hex or base64 into readable JSON and encode JSON back to canonical CBOR hex — for WebAuthn, COSE and IoT payloads. Free, no upload.
🔒 Everything runs in your browser — the payload is never uploaded. Ideal for inspecting WebAuthn, COSE and IoT data with sensitive keys.
Decode and encode CBOR without a schema
CBOR (Concise Binary Object Representation, RFC 8949) is a compact binary data format — think JSON, but smaller and binary. Paste a CBOR payload as hex or base64 and this tool decodes it into readable, indented JSON: unsigned and negative integers, byte and text strings, arrays, maps, booleans, null and floating-point numbers, including deeply nested structures. Flip the direction and it encodes JSON back to canonical CBOR as lowercase hex, using shortest-form integers and sorted map keys so the output is deterministic. No .cddl schema is required — the CBOR wire format is self-describing.
Built for WebAuthn, COSE and IoT
CBOR is the encoding behind WebAuthn/FIDO2 attestation objects, COSE keys and signatures (used in passkeys and CWT tokens), and countless IoT and embedded protocols. This decoder lets you inspect those payloads at a glance — read a COSE_Key, check an attestation statement, or debug a sensor message — and re-encode edited values for testing. Everything runs entirely in your browser: the bytes never leave your device, so it is safe for private keys and credentials. Byte strings are shown as hex, and integers too large for JavaScript are preserved exactly.
Frequently asked questions
What is CBOR and how is it different from JSON?
CBOR (Concise Binary Object Representation, RFC 8949) is a binary serialization format with the same data model as JSON — numbers, strings, booleans, null, arrays and maps — but encoded as compact bytes instead of text. It also adds byte strings and exact 64-bit integers. This tool converts between CBOR (as hex or base64) and readable JSON in both directions.
Do I need a schema or .cddl file to decode?
No. The CBOR wire format is self-describing: every item carries its own type and length, so the decoder recovers the full structure without any schema. Field meanings defined only in a CDDL schema (for example which integer key is which COSE label) are not shown, but the values and structure are.
Can I decode a WebAuthn or COSE payload, and is my data uploaded?
Yes — paste the attestation object, COSE_Key or token payload as hex or base64 and it decodes to JSON. Byte strings appear as hex, and a semantic tag keeps its number and is labelled with what that number means — 0 and 1 for date/time, 2 and 3 for bignums, 21 to 23 for an expected base64url, base64 or base16 conversion — so re-encoding gives back the bytes you started from. Nothing is uploaded; the decoding runs entirely in your browser, so it is safe for credentials and private keys.