CBOR Encoder and Decoder: JSON to CBOR and Back
Encode JSON to CBOR as hex or Base64 and decode CBOR hex, Base64 or files to JSON or diagnostic notation in your browser. RFC 8949, exact 64-bit integers, deterministic encoding. Nothing is uploaded.
0 characters, 0 bytes
0 characters, 0 bytes
About the CBOR Encoder and Decoder
The CBOR Encoder and Decoder converts JSON to CBOR and CBOR back to JSON. CBOR, the Concise Binary Object Representation, is a binary data format defined in RFC 8949. It carries the same kinds of values as JSON (numbers, text, arrays, maps, true, false and null) plus byte strings, tags and exact 64-bit integers, in fewer bytes and without text parsing. It is used by WebAuthn and passkeys, COSE signatures, the EU Digital COVID Certificate, CoAP on small devices and many IoT protocols. Paste JSON to get CBOR as hex or Base64, or paste hex or Base64, or choose a binary file, to see what it contains. Everything runs in your browser; your data is never uploaded.
How to use it
Encode
- Choose Encode and type or paste JSON.
- Pick Hex or Base64 for the output. The note under the output gives the size in bytes.
- Turn on Sort map keys (deterministic) when the bytes must be reproducible, for example before signing or hashing them.
Decode
- Choose Decode and paste CBOR as hex or Base64. Spaces and a leading
0xare allowed, and the format is detected for you, or set it yourself. - Or press Choose file to read a binary
.cborfile directly. - Show the result as JSON or as Diagnostic notation, the human-readable form from RFC 8949 that keeps every CBOR detail.
How values are encoded
Preferred serialisation
The encoder follows the preferred serialisation of RFC 8949 section 4.1: every length and integer uses the shortest form, and every float uses the shortest of half, single and double precision that keeps its exact value. So 1.5 takes three bytes and 1.1 takes nine. Maps and arrays always have definite lengths.
Integers and floats
JSON does not separate integers from floats, so the encoder reads how each number is written: 1 becomes the integer 1, while 1.0 and 1e2 become floats. Integers are exact at any size. Values up to 18446744073709551615 use the native 64-bit form, and larger ones become bignums (tags 2 and 3), so nothing is rounded the way a JavaScript number would be.
Deterministic encoding
With the option on, map keys are sorted by the bytewise order of their encoded form, the core deterministic rule of RFC 8949 section 4.2.1. Two programs that follow the rule produce identical bytes for identical data. Duplicate keys are rejected, because a map with duplicate keys is not valid CBOR.
Reading the decoded output
The decoder accepts every well-formed item, including indefinite-length strings, arrays and maps and all three float sizes. JSON cannot hold everything CBOR can, so some values are shown in a substitute form and a note under the output explains each one: tags as an object with tag and value fields, byte strings as base64url text as RFC 8949 section 6.1 suggests, undefined, NaN and Infinity as null, and map keys that are not text as their diagnostic notation. Bignums become plain integers. The Diagnostic notation view has no such gaps: it shows h'…' byte strings, tag numbers, undefined and the _ marker for indefinite lengths exactly. Errors give the byte offset where the data stopped making sense, such as a truncated item, a reserved header value or invalid UTF-8 in a text string.
Privacy
Encoding and decoding happen entirely in your browser. Your JSON, CBOR and files are never sent to a server, and nothing is kept once you close the tab.
Related tools
Tidy or validate the JSON first with the JSON Formatter. To turn the raw bytes into Base64 for a URL, header or config file, use the Base64 Encoder, and to inspect them byte by byte, see Text to Hex.
Open-source credits
- The codec is written in-house on this site and follows RFC 8949, Concise Binary Object Representation, including its preferred serialisation, deterministic map ordering and diagnostic notation. No library is used. It is tested against every example in RFC 8949 Appendix A.
Frequently asked questions
What is CBOR and where is it used?
CBOR, the Concise Binary Object Representation, is a binary data format standardised in RFC 8949. It models the same data as JSON plus byte strings, tags and exact 64-bit integers. WebAuthn and passkeys, COSE signatures, CoAP, the EU Digital COVID Certificate and many IoT protocols use it.
Why does the same JSON sometimes give different CBOR bytes?
CBOR allows several encodings of one value, for example different key orders or longer number forms. This tool always uses preferred serialisation, the shortest form of every number. Turn on Sort map keys (deterministic) to also fix the key order, so identical data always gives identical bytes.
Why does 1.0 encode differently from 1?
JSON has a single number type, so the tool reads how a number is written. 1 becomes a CBOR integer, while 1.0 or 1e0 becomes a float, encoded here as a three-byte half-precision value. Write the number the way the receiving program expects to read it.
What is diagnostic notation?
It is the human-readable text form of CBOR defined in section 8 of RFC 8949. It looks like JSON but also shows byte strings as h'…', tags as a number followed by the tagged value in parentheses, undefined, and indefinite lengths with an underscore, so nothing is lost when you read it.
Is my data uploaded to decode it?
No. Encoding and decoding run in your browser with code on this page, and files you choose are read locally. Nothing is sent to a server or kept after you close the tab.