CBOR (Concise Binary Object Representation, RFC 8949) is a compact binary data format modelled on JSON. It is widely used in WebAuthn/FIDO2, COSE, CoAP and other constrained or IoT protocols where small payloads matter.

How are byte strings and tags shown?

Byte strings are rendered as h'…' with their hex contents, and CBOR semantic tags appear as tag(n) wrapping the tagged value, so the JSON stays lossless and readable.

Does it handle floats and indefinite-length items?

Yes. It decodes half, single and double-precision floats and supports indefinite-length byte strings, text strings, arrays and maps terminated by the 0xff break byte.

Is my CBOR data uploaded anywhere?

No. The decoder is pure JavaScript running in your browser. Nothing you paste or upload is sent to a server, which makes it safe for security-sensitive payloads like WebAuthn attestations.

Why does it say trailing bytes remain?

CBOR decodes a single top-level item. If extra bytes follow that item, the tool decodes the first one and warns you, which usually means the input has multiple concatenated items or stray padding.

CBOR to JSON Converter

CBOR (Concise Binary Object Representation) is a binary serialization format defined by RFC 8949 that mirrors the JSON data model — numbers, strings, arrays and maps — but encodes them as compact bytes. It is the wire format behind WebAuthn attestation objects, COSE signatures, CoAP messages and many IoT protocols. This tool decodes raw CBOR back into JSON so you can read and debug those payloads without writing any code.

How it works

CBOR encodes every item with an initial byte whose top 3 bits are the major type and whose low 5 bits are the additional information:

Major types 0 and 1 are unsigned and negative integers (a negative integer encodes the value -1 - n).
Major types 2 and 3 are byte strings and UTF-8 text strings.
Major types 4 and 5 are arrays and maps.
Major type 6 is a semantic tag, and major type 7 covers false, true, null, and IEEE 754 floats.

The additional-info field tells the decoder how to read the length or value: 0–23 are inline, 24/25/26/27 mean 1, 2, 4 or 8 following bytes, and 31 marks an indefinite-length item terminated by a 0xff break byte. The decoder walks the byte stream recursively following exactly these rules, so the output is a faithful, lossless JSON view of the original CBOR.

Example

The hex a26161016162820203 decodes as a map of two entries:

{
  "a": 1,
  "b": [2, 3]
}

Here a2 is a 2-entry map, 61 61 is the text string "a", 01 is the integer 1, 61 62 is "b", and 82 02 03 is a 2-element array [2, 3]. Byte strings appear as h'…' and tags as tag(n) so nothing is lost in translation. All decoding happens locally in your browser.