Free MessagePack and CBOR Decoder
Paste binary MessagePack or CBOR as hex or Base64 and read it as JSON, with errors that say where the bytes go wrong.
What is a MessagePack and CBOR Decoder?
MessagePack and CBOR are binary formats that store the same kinds of data as JSON, maps, arrays, strings and numbers, in far fewer bytes. This decoder takes those bytes, pasted as hex or Base64, and prints the value they hold in readable form.
Decoding is done by @msgpack/msgpack, the reference JavaScript implementation, and by cbor-x for CBOR as defined in RFC 8949. Plain data comes out as valid JSON. Anything JSON can’t express, such as raw bytes, tags or undefined, is written in CBOR diagnostic notation from RFC 8949 section 8.
Key Features
Hex or Base64, Your Choice
Paste hex with or without spaces, colons or 0x prefixes, or paste standard or URL-safe Base64. The Read as stat confirms which one the text was taken to be.
Binary and Tags Kept Visible
Byte strings print as h'…' hex, and CBOR tags print as number(value), so nothing is silently dropped. Dates from CBOR tags 0 and 1 and MessagePack timestamps become ISO 8601 strings.
64-Bit Integers Stay Exact
A uint64 like 18446744073709551615 is printed digit for digit instead of rounded the way JavaScript numbers round. Database IDs and counters survive intact.
Errors That Explain the Bytes
Truncated data, trailing bytes, the reserved MessagePack byte 0xc1 and reserved CBOR values each get their own message. You learn whether to recopy, trim or switch modes.
Decoded on Your Device
Bytes are decoded in the browser tab and never uploaded. Passkey attestations, session data and cached records stay private.
Perfect for everyone
- Backend developers reading cached or queued payloads
- Security engineers inspecting WebAuthn and COSE data
- IoT developers checking sensor messages
- Anyone debugging a binary API
How to Use the MessagePack and CBOR Decoder
Choose the format, paste the bytes, and read or copy the decoded value.
Choose MessagePack or CBOR
Select the format the bytes were written in. The two formats overlap so much that the wrong mode can produce a plausible but wrong value, so check the source if you’re unsure.
Paste the Bytes
Paste hex from a debugger, packet capture or log, or Base64 from an API response. Spaces, line breaks, colons and 0x prefixes are ignored.
Read the Decoded Value
The value appears as indented JSON, with diagnostic notation for bytes, tags and other values JSON lacks. Bytes shows the size of the message, and Read as shows whether it was treated as hex or Base64.
Fix Errors or Copy the Result
If decoding fails, the message says whether the data was cut off, has extra bytes or isn’t that format at all. Otherwise copy the value or download it as a text file.
Real Bytes, Decoded
These byte strings come from the MessagePack spec, RFC 8949’s examples and common protocols. Each answer is the decoder’s exact output in the mode on the chip, so try reading the bytes yourself first.
“82 a4 6e 61 6d 65 a3 41 64 61 a3 61 67 65 1f”
“gqRuYW1lo0FkYaNhZ2Uf”
“a2 64 6e 61 6d 65 63 41 64 61 63 61 67 65 18 1f”
“c1 1a 51 4b 67 b0”
“a2 01 26 04 42 31 31”
“d8 20 76 68 74 74 70 3a 2f 2f 77 77 77 2e 65 78 61 6d 70 6c 65 2e 63 6f 6d”
“cf ff ff ff ff ff ff ff ff”
“d5 05 01 02”
“82 a4 6e 61 6d 65”
“c1”
Reading MessagePack and CBOR by Hand
In both formats the first byte of every value says what follows. Learn these ten and you can read most payloads straight from a hex dump.
MessagePack Fixmap, 0x80 to 0x8f
A map of up to 15 pairs keeps its size in the low four bits. That makes 0x82 a map with two entries.
“What does 0x82 start in MessagePack?”
MessagePack Fixstr, 0xa0 to 0xbf
Strings of up to 31 bytes store their length in the low five bits. The UTF-8 bytes of the string follow directly.
“How long is the string after 0xa3?”
Small MessagePack Integers Take One Byte
Positive fixint covers 0x00 to 0x7f, so 31 is just 0x1f. Negative fixint, 0xe0 to 0xff, covers -32 to -1.
“How is -1 written in MessagePack?”
MessagePack Nil, False and True
0xc0 is nil, 0xc2 is false and 0xc3 is true. 0xc1 is the only byte the specification never assigns.
“Which MessagePack byte is never used?”
MessagePack Bin and Ext
0xc4 to 0xc6 hold raw binary, and 0xd4 to 0xd8 plus 0xc7 to 0xc9 hold extension types. Extension type -1 is the official timestamp.
“Which extension type is the MessagePack timestamp?”
CBOR Major Types Sit in the Top Three Bits
Every CBOR item starts with a major type from 0 to 7: integers, negative integers, bytes, text, arrays, maps, tags and simple values. 0xa2 is major type 5 with two pairs.
“Which major type is 0xa2?”
CBOR Fits Values Up to 23 in One Byte
The low five bits hold the value or length directly up to 23. Values 24 to 27 mean the next 1, 2, 4 or 8 bytes carry it.
“How does CBOR write the integer 31?”
CBOR Text Versus Byte Strings
Major type 3, 0x60 to 0x7b, is UTF-8 text, and major type 2, 0x40 to 0x5b, is raw bytes. Raw bytes print as h'…' because JSON has no binary type.
“How are the bytes 42 31 31 shown?”
CBOR Tags Add Meaning
Major type 6 wraps the next item in a registered tag: 0 and 1 for dates, 2 and 3 for big integers, 32 for URIs. Tags the decoder doesn’t interpret print as number(value).
“What does tag 1 mark?”
CBOR Simple Values and Floats
0xf4 is false, 0xf5 true, 0xf6 null and 0xf7 undefined. 0xf9, 0xfa and 0xfb start half, single and double precision floats.
“What does 0xf6 decode to?”
MessagePack, CBOR and JSON Compared
Both binary formats model JSON-like data, but they come from different places and serve different protocols.
MessagePack: Compact JSON
Designed as a smaller binary JSON, MessagePack has few types and no tags. Redis Lua scripts, the Fluentd forward protocol and Neovim’s RPC all use it.
CBOR: An IETF Standard
CBOR, published as RFC 8949, adds tags, indefinite lengths and a registry of meanings. WebAuthn passkeys, COSE signatures and CWT tokens are built on it.
Same Record, Different Sizes
A record with name Ada and age 31 takes 15 bytes in MessagePack, 16 in CBOR and 23 as minified JSON. CBOR spends the extra byte because 31 is above its one-byte limit of 23.
Integer Keys in CBOR Protocols
COSE and CWT use small integers as map keys to save space, so label 1 means alg and 4 means kid. Those keys print unquoted here, as diagnostic notation writes them.
Base64 in Transit
Binary payloads usually travel as Base64 inside JSON APIs, logs and WebAuthn responses, which use the URL-safe alphabet. Paste either alphabet and check the Read as stat.
Not the Same as Protocol Buffers
MessagePack and CBOR carry their own types and field names, so they decode without a schema. Protobuf needs a .proto file to name its fields, so use a wire decoder for that.
Decoding Mistakes to Avoid
Binary formats fail quietly. These are the slips that most often produce a wrong value or a confusing error.
Pick the Right Mode First
Many byte sequences are valid in both formats but mean different things, so MessagePack read as CBOR gives nonsense rather than an error. If a result looks wrong, switch modes before anything else.
Text Made of Hex Digits Is Read as Hex
A string like cafe or 0102 is taken as hex even though it’s also valid Base64. Base64 that happens to use only hex letters is rare, but the Read as stat tells you which reading won.
Copy the Whole Message
Logs and debuggers often shorten binary fields, which shows up here as data ending partway through a value. Take the bytes from the raw source instead.
Split Streams Into Single Values
Streams such as msgpack-rpc and CBOR sequences put values back to back, which reads here as extra bytes. Decode one value at a time, starting at its first byte.
Big Integers Lose Precision in JavaScript
18446744073709551615 is shown exactly here, but JSON.parse turns it into 18446744073709552000. Keep 64-bit IDs as strings or BigInt in your own code.
MessagePack Integer Keys Print as Strings
The MessagePack decoder turns numeric map keys into strings, so a key of 1 appears as "1". CBOR maps keep their key types.
Dates Are Shown in UTC
CBOR tags 0 and 1 and the MessagePack timestamp extension print as ISO 8601 UTC strings with milliseconds. Convert to local time in your own code.
Diagnostic Output Isn’t Always JSON
Byte strings, tags, undefined and NaN are written in diagnostic notation, which JSON parsers reject. Plain data with string keys remains valid JSON you can copy.
When You Need to Decode Binary Payloads
Whenever a system stores or sends data you can’t read in a text editor.
Inspecting a Cached Value
Services that cache MessagePack blobs leave unreadable values in redis-cli. Copy the bytes as hex and decode them to see the stored fields.
Reading a WebAuthn Attestation
Passkey registration returns an attestationObject in CBOR, encoded as Base64url. Paste it to see fmt, attStmt and authData without writing a parser.
Checking a COSE Key or CWT
COSE keys and CBOR Web Tokens use integer labels, such as 1 for kty and 3 for alg. The raw map lets you match each label against the IANA registry.
Debugging an RPC or Game Protocol
Capture a frame from a MessagePack-based API or game server and paste its payload. A wrong type or a missing field is visible at once.
Verifying an Encoder
After serializing a test object, decode the bytes to confirm your library wrote the types you meant, such as an integer rather than a float.
Reading IoT Sensor Payloads
Constrained devices send CBOR over CoAP and LoRaWAN to save bandwidth. Decode a captured payload to check its readings and timestamps.
Comparing Payload Sizes
Paste the same record encoded both ways and compare byte counts. The Bytes stat shows how much each format saves over JSON.