CBOR Decoder & Encoder
Decode CBOR (RFC 8949) from hex or base64 to indented JSON, or encode JSON back to canonical CBOR hex with sorted keys — for WebAuthn, COSE and IoT payloads.
Ideal for inspecting WebAuthn, COSE and IoT data with sensitive keys.
Decode and encode CBOR without a schema
CBOR (Concise Binary Object Representation, RFC 8949) is a compact binary data format — think JSON, but smaller and binary. Paste a CBOR payload as hex or base64 and this tool decodes it into readable, indented JSON: unsigned and negative integers, byte and text strings, arrays, maps, booleans, null and floating-point numbers, including deeply nested structures. Flip the direction and it encodes JSON back to canonical CBOR as lowercase hex (or base64 or base64url, picked under Output), using shortest-form integers and sorted map keys so the output is deterministic. No .cddl schema is required — the CBOR wire format is self-describing. Copy link puts the payload in the link it copies, after the #. The direction, the output format, the encoding and the CBOR sequence switch sit in the page address, so a reload keeps them, but the payload itself is not written into the address bar, and one too long for a link gets a note instead.
Built for WebAuthn, COSE and IoT
CBOR is the encoding behind WebAuthn/FIDO2 attestation objects, COSE keys and signatures (used in passkeys and CWT tokens), and countless IoT and embedded protocols. This decoder lets you inspect those payloads at a glance — read a COSE_Key, check an attestation statement, or debug a sensor message — and re-encode edited values for testing. Everything runs entirely in your browser: the bytes never leave your device, so it is safe for private keys and credentials. Byte strings are shown as hex, and integers too large for JavaScript are preserved exactly.
Frequently asked questions
What is CBOR and how is it different from JSON?
CBOR (Concise Binary Object Representation, RFC 8949) is a binary serialization format with the same data model as JSON — numbers, strings, booleans, null, arrays and maps — but encoded as compact bytes instead of text. It also adds byte strings and exact 64-bit integers. This tool converts between CBOR (as hex or base64) and readable JSON in both directions.
Do I need a schema or .cddl file to decode?
No. The CBOR wire format is self-describing: every item carries its own type and length, so the decoder recovers the full structure without any schema. Field meanings defined only in a CDDL schema (for example which integer key is which COSE label) are not shown, but the values and structure are.
Can I see the CBOR as diagnostic notation or annotated hex?
Yes. The Output menu switches between JSON, diagnostic notation and annotated hex, where each byte is labelled with the item it begins.
Can I get the CBOR as base64, read a CBOR sequence, or open a .cbor file?
Yes. In the JSON → CBOR direction the Output menu writes CBOR (hex), CBOR (base64) or CBOR (base64url), and the download is named for the form you chose. Tick the CBOR sequence checkbox to read several items written back to back — as a JSON array, as diagnostic notation items or as annotated hex item by item — and, in the other direction, to write each element of a JSON array as an item of its own. Open file… also takes a raw binary .cbor, .cose or .bin file, reads its bytes as hex and turns the page to decoding them.
Can I send a payload to someone as a link?
Yes. Copy link puts the payload in the link it copies, after the #, and the link opens the page on that payload in the same direction and output format. The settings — direction, output format, encoding and the CBOR sequence switch — are kept in the page address as you work, but the payload is not, and one too long for a link gets a note instead of a link.