How CBOR Works

  • CBOR = Concise Binary Object Representation (RFC 8949) — a binary superset of JSON's data model
  • Type+length prefix: each value is tagged with its type and size, so no quotes, commas, or braces needed
  • Result: typically 15–50% smaller than equivalent JSON and faster to parse
  • NOT encryption — anyone who has the bytes can decode them instantly

Common Uses

  • IoT sensors: Constrained devices (MQTT, CoAP) use CBOR to minimise bandwidth and battery
  • APIs: CBOR over HTTP with Content-Type: application/cbor for tighter payloads
  • Storage: Cache or persist structured data more compactly than JSON in IndexedDB/localStorage
  • WebAuthn / FIDO2: Browser authentication data is CBOR-encoded (attestation objects, client data)
  • COSE: CBOR Object Signing and Encryption — the binary equivalent of JOSE/JWT

CBOR vs JSON vs MessagePack

  • JSON: Human-readable, universally supported, largest size, slowest parse
  • MessagePack: Binary JSON superset, very compact, great ecosystem, no schema
  • CBOR: IETF standard (RFC 8949), self-describing, supports tags/bignum/dates natively
  • Rule of thumb: Use JSON for APIs humans debug, CBOR/MessagePack when bytes or speed matter

CBOR Tags (Bonus Features)

  • Tag 0 / 1: Date/time — encode timestamps natively, not as strings
  • Tag 2 / 3: Bignum — integers larger than 64-bit without loss
  • Tag 21–23: Base64url / Base64 / Hex encoding hints for embedded byte strings
  • Tag 37: UUID — compact 16-byte representation
  • Application-defined tags let you annotate values with semantic meaning

Watch Out For

  • CBOR is NOT human-readable — always keep the JSON source if you need to edit values
  • Float precision: CBOR encodes floats as IEEE 754 — round-trip may change decimal representation
  • Map key ordering: CBOR maps are unordered; key order may differ after decode
  • Byte strings (not text): CBOR has a distinct bytes type — this tool uses the text/map/array subset that maps to JSON
  • Indefinite-length encoding: some CBOR generators produce indefinite-length items; this tool uses definite-length only

Debugging CBOR by Hand

  • First byte tells you everything: 0xa1 = map(1), 0x62 = text(2 bytes), 0xf5 = true
  • Major types (top 3 bits): 0=uint, 1=negint, 2=bytes, 3=text, 4=array, 5=map, 6=tag, 7=float/simple
  • Additional info (bottom 5 bits): 24=1-byte follows, 25=2-byte, 26=4-byte, 27=8-byte
  • Online reference: cbor.me lets you paste hex and see the decoded structure