Ambimat GroupAmbimatAmbiSecureSIMAuthAmbiAutomationEngineering BlogAhmedabad · India · Est. 1982
WebAuthn / CTAP2

CBOR decoder for WebAuthn payloads

Walk a CBOR (RFC 8949) blob into a structural tree. Accepts hex or base64url. Built for WebAuthn attestation objects, COSE keys, and CTAP2 messages — but works for any CBOR.

How to use this tool

What it does

Decodes CBOR (RFC 8949) into readable structure — the binary format under CTAP2 and COSE.

When to use it

Use it when a CTAP2 message or attestation object is CBOR-encoded and you need to see its map.

Worked example

Decode a CTAP2 response to read its numeric keys and nested values.

Input

Decoded

Paste CBOR bytes to decode.
All decoding runs locally.

About CBOR

CBOR (Concise Binary Object Representation) is the wire format used by FIDO CTAP2, COSE (RFC 8152), the WebAuthn attestation object, and many constrained-device protocols. The major-type encoding makes parsers compact and fast even on small MCUs.

Spec

RFC 8949 (CBOR data model and encoding).

Frequently asked questions

What is CBOR?

A binary serialisation format defined in RFC 8949 with a data model close to JSON but a compact binary encoding. WebAuthn, COSE and CTAP2 all use it.

How does CBOR encode a value?

The initial byte carries a 3-bit major type and a 5-bit argument. The major type says whether the item is an integer, a byte string, a text string, an array, a map, a tag or a simple value; the argument gives the length or value, possibly in following bytes.

Why does my WebAuthn blob decode as a map with three keys?

Because it is an attestationObject: fmt, attStmt and authData. The authData value is a byte string that needs parsing separately as a fixed-layout structure, not as CBOR.

Does CBOR guarantee one encoding per value?

Not in general, but WebAuthn requires the CTAP2 canonical form — deterministic map ordering and shortest-form arguments — because signatures are computed over the encoded bytes.

Does anything I paste leave my browser?

Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.