CBOR decoder for WebAuthn payloads
Walk a CBOR (RFC 8949) blob into a structural tree. Accepts hex or base64url. Built for WebAuthn attestation objects, COSE keys, and CTAP2 messages — but works for any CBOR.
How to use this tool
What it does
Decodes CBOR (RFC 8949) into readable structure — the binary format under CTAP2 and COSE.
When to use it
Use it when a CTAP2 message or attestation object is CBOR-encoded and you need to see its map.
Worked example
Decode a CTAP2 response to read its numeric keys and nested values.
Input
Decoded
About CBOR
CBOR (Concise Binary Object Representation) is the wire format used by FIDO CTAP2, COSE (RFC 8152), the WebAuthn attestation object, and many constrained-device protocols. The major-type encoding makes parsers compact and fast even on small MCUs.
Spec
RFC 8949 (CBOR data model and encoding).
Companion tools
Pillar reading
Frequently asked questions
What is CBOR?
A binary serialisation format defined in RFC 8949 with a data model close to JSON but a compact binary encoding. WebAuthn, COSE and CTAP2 all use it.
How does CBOR encode a value?
The initial byte carries a 3-bit major type and a 5-bit argument. The major type says whether the item is an integer, a byte string, a text string, an array, a map, a tag or a simple value; the argument gives the length or value, possibly in following bytes.
Why does my WebAuthn blob decode as a map with three keys?
Because it is an attestationObject: fmt, attStmt and authData. The authData value is a byte string that needs parsing separately as a fixed-layout structure, not as CBOR.
Does CBOR guarantee one encoding per value?
Not in general, but WebAuthn requires the CTAP2 canonical form — deterministic map ordering and shortest-form arguments — because signatures are computed over the encoded bytes.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.