CBOR Decoder (Diagnostic Notation)
Developer
CBOR (Concise Binary Object Representation, RFC 8949) is a compact binary data format used by WebAuthn/FIDO2, COSE, the C509 certificate work, and many IoT protocols — but as raw bytes it's unreadable. Paste the bytes as hex or base64 and this tool decodes them into CBOR diagnostic notation, the standard human-readable form from the spec: integers and bignums, byte strings as h'…', text strings, arrays and maps with nesting, tagged values like 0("2013-03-21T20:04:00Z"), the simple values false/true/null/undefined, half/single/double floats, and indefinite-length strings, arrays, and maps written with the _ marker. It validates as it goes and flags truncated input or trailing bytes after the first data item. The decoder is checked against the full RFC 8949 Appendix A example table. Everything runs locally; nothing is uploaded.
CBOR decode error: unexpected end of input
Output is RFC 8949 diagnostic notation: h'…' byte strings, 1 vs 1.0, tag(content), and _ for indefinite-length items.
How to use
- Choose whether your input is hex or base64 (base64url is accepted too).
- Paste the CBOR bytes.
- Read the decoded diagnostic notation and copy it.
Frequently asked questions
- What is diagnostic notation?
- It's the human-readable text form of a CBOR data item defined in RFC 8949 §8 — similar to JSON but able to express everything CBOR can: byte strings as h'…', distinct integer vs float (1 vs 1.0), tags as number(content), the simple values undefined and simple(n), and indefinite-length items with an underscore, e.g. [_ 1, 2]. It's the standard way to show what a CBOR blob contains.
- How do I get the hex for a CBOR value?
- Anything that emits CBOR gives you bytes: a WebAuthn attestationObject, a COSE_Key or COSE_Sign1, an IoT sensor frame, etc. Capture those bytes and paste them as hex (with or without spaces or a 0x prefix) or base64. The tool ignores whitespace and accepts base64url.
- Why does it show 1 and 1.0 differently?
- CBOR distinguishes integers from floating-point numbers at the byte level, and diagnostic notation preserves that: the integer one is 1, while the floating-point one is 1.0. Half-precision floats (2 bytes), single (4), and double (8) all decode to their exact value, including NaN and ±Infinity.
- What does 'trailing bytes' mean?
- A CBOR message is a single data item. If there are extra bytes after the first complete item, the tool reports them rather than silently ignoring them — usually it means the input is a sequence of items, was truncated mid-item, or the format (hex vs base64) is wrong.
Related tools
Base64 to Hex Converter (and back)
Convert a Base64 string to hexadecimal bytes and hex back to Base64, with URL-safe support, in your browser.
Quoted-Printable Encoder & Decoder
Encode text to MIME Quoted-Printable (RFC 2045) or decode it back — handling =XX escapes, soft line breaks, and UTF-8 — entirely in your browser, with 76-character line wrapping on encode.
Hash Generator (SHA)
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text.
URL Encoder / Decoder
Percent-encode text for URLs, or decode encoded URLs back to text.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 back to text, instantly.
JSON Formatter & Validator
Format, beautify, minify, and validate JSON right in your browser.