CBOR (Concise Binary Object Representation) is a binary data format designed to be more efficient than JSON. While JSON sends data as readable text, CBOR sends it as compact binary, resulting in 20-50% smaller file sizes and faster parsing speeds.
CBOR is already widely deployed in production systems. It's the official format for WebAuthn authentication (security keys, Face ID, Touch ID), IoT devices, smart home systems, and blockchain applications. If you've used passwordless login or connected to an IoT device, you've likely used CBOR.
This guide explains what CBOR is, when to use it, and how it compares to JSON. You can test conversions using our CBOR to JSON converter or validate data with the CBOR validator.
What Does CBOR Stand For?
CBOR stands for Concise Binary Object Representation:
Concise - Minimal data size with no wasted bytes
Binary - Encoded as binary (1s and 0s) instead of text for faster processing
Object Representation - Supports all JSON data structures plus additional types like binary data, dates, and large integers
Industry Standard: CBOR is an IETF standard (RFC 8949), officially recognized and maintained by the Internet Engineering Task Force. It's used by major technology companies and standardized protocols worldwide.
Why CBOR Was Created
JSON is excellent for web APIs and configuration files, but it has limitations in resource-constrained environments. CBOR addresses three critical issues:
💾 Data Size
JSON's text format includes quotes, brackets, and whitespace that increase bandwidth costs. CBOR eliminates this overhead, reducing file sizes by 20-50% - critical for IoT devices sending millions of messages.
⚡ Processing Speed
Binary parsing is significantly faster than text parsing. CBOR can be decoded directly into memory structures without string manipulation, reducing CPU usage on battery-powered devices.
🔧 Extended Data Types
JSON only supports strings, numbers, booleans, arrays, objects, and null. CBOR adds binary data, timestamps, arbitrary-precision integers, and tagged values - eliminating the need for base64 encoding or custom serialization.
Size Comparison: JSON vs CBOR
Here's a practical comparison using IoT sensor data to demonstrate the size difference:
JSON Version
67 bytes{
"temp": 22.5,
"humidity": 65,
"sensor": "room-101",
"active": true
}Human-readable: ✅ Perfect!
Size: 67 bytes with all the formatting
CBOR Version (Hex)
42 bytes - 37% smaller!A4 64 74 65 6D 70 F9 41 68 66 68 75 6D 69 64 69 74 79 18 41 66 73 65 6E 73 6F 72 68 72 6F 6F 6D 2D 31 30 31 66 61 63 74 69 76 65 F5
Human-readable: ❌ Nope (but that's okay!)
Size: 42 bytes - Much more efficient!
Why the Size Difference?
- •No quotes around field names and string values
- •No spaces or newlines (binary doesn't need formatting)
- •Numbers stored in their most efficient form
- •Each piece of data has a tiny tag telling you what type it is
For a device sending 1,000 messages per day, this 37% reduction saves 25KB daily (9MB annually) per device. At scale with 10,000 devices, that's 90GB annually in bandwidth savings. Convert your own data using our JSON to CBOR tool.
What Types of Data Can CBOR Handle?
CBOR can represent everything JSON can, plus a bunch more! Here's what you can work with:
📝 Text Strings
Any text you want, just like JSON strings.
"Hello, World!" → stored efficiently as UTF-8🔢 Numbers (All Kinds!)
Integers, decimals, floating-point - CBOR picks the most efficient storage automatically.
42, 3.14159, -100, 9007199254740991 (bigint!)✅ Booleans & Null
True, false, and null - the classics.
true, false, null📦 Arrays & Objects
Lists and nested structures, just like JSON.
[1, 2, 3] or {name: 'Emma', age: 28}💾 Binary Data (NEW!)
This is where CBOR shines! Store images, files, or any binary data directly - no base64 encoding needed.
Raw bytes: FF D8 FF E0 00 10 4A 46...📅 Dates & Times (NEW!)
Built-in support for timestamps. No more converting dates to strings!
2025-12-24T10:30:00Z → stored as Unix timestamp🏷️ Tagged Values (SUPER NEW!)
Add semantic meaning to your data. Mark something as a URL, UUID, or even custom types!
Tag 32: "https://example.com" (marked as a URL)These additional data types make CBOR suitable for applications requiring binary data transmission or precise numeric representations. Validate your CBOR data using our CBOR validator tool.
Key Advantages of CBOR
CBOR provides measurable benefits in production environments:
Reduced Bandwidth Costs
CBOR payloads are typically 20-50% smaller than equivalent JSON. This reduction translates directly to lower bandwidth costs, faster transmission times, and improved performance on mobile networks with limited data plans.
Faster Processing
Binary parsing eliminates the overhead of scanning for delimiters, handling escape sequences, and validating syntax. CBOR decoders can directly map binary data to memory structures, significantly reducing CPU cycles on resource-constrained devices.
Extended Battery Life
Reduced data transmission directly impacts battery life. IoT devices using CBOR spend less time with active radios, resulting in 30-40% longer battery life compared to JSON-based implementations in field deployments.
Industry Standard for Security
CBOR is the required format for WebAuthn (W3C standard for passwordless authentication) and COSE (CBOR Object Signing and Encryption). Major security implementations from Yubico, Microsoft, Apple, and Google use CBOR for authentication data.
Cross-Platform Support
Production-ready libraries exist for Python, JavaScript, Go, Rust, C, C++, Java, Swift, Kotlin, and most major programming languages. The format is maintained by the IETF with active community support.
Production Use Cases
CBOR is deployed in production systems across multiple industries:
WebAuthn Authentication
The W3C WebAuthn standard mandates CBOR for all authentication messages. Security keys (YubiKey, Titan), biometric authentication (Touch ID, Face ID, Windows Hello), and passwordless login systems use CBOR for credential exchange.
IoT and Smart Home
Connected devices including thermostats, security cameras, environmental sensors, and home automation systems use CBOR for efficient communication. The format's small size enables longer battery life and reduces network congestion in dense deployments.
Industrial Monitoring
Factory automation systems, logistics trackers, and infrastructure monitoring solutions use CBOR for telemetry data. The compact format enables multi-year battery life for remote sensors and reduces cellular data costs.
Connected Vehicles
Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) systems require low-latency data exchange for safety-critical applications. CBOR's fast parsing and small message size make it suitable for real-time automotive communications.
Mobile Applications
Mobile apps operating on metered connections or in low-bandwidth environments use CBOR to reduce data transfer costs and improve response times. The format is particularly valuable for apps targeting emerging markets with limited connectivity.
Blockchain Systems
Smart contract platforms where transaction costs scale with data size benefit from CBOR's compact representation. Cardano and other blockchain projects use CBOR for on-chain data storage and inter-node communication.
CBOR vs JSON: When to Use Which?
Choose the appropriate format based on your specific requirements:
✅ Use CBOR When:
- •Size matters
Bandwidth costs money or battery life is critical
- •Speed is crucial
Milliseconds matter for your application
- •Binary data involved
Images, encrypted data, or other binary content
- •IoT devices
Sensors, embedded systems, resource-constrained hardware
- •Security protocols
WebAuthn, COSE, or cryptographic applications
📝 Use JSON When:
- •Debugging matters
You want to read and edit data by hand
- •Web APIs
REST APIs where developers expect JSON
- •Browser compatibility
Need native browser support without extra libraries
- •Configuration files
Humans need to read and modify the files
- •Team familiarity
Everyone knows JSON, learning curve is zero
Hybrid Approach
Many production systems use JSON for public APIs (debugging ease, universal compatibility) and CBOR for internal microservice communication or mobile apps (efficiency, speed). Convert between formats using our JSON to CBOR andCBOR to JSON converters.
Implementation Guide
Steps to integrate CBOR into your application:
Pick Your Library
Choose a CBOR library for your programming language:
- • JavaScript: cbor-x (what we use!)
- • Python: cbor2
- • Go: fxamacker/cbor
- • Rust: ciborium
Test with Online Tools
Use online converters to test CBOR with your actual data. Measure the size reduction and verify encoding/decoding before implementing in production code.
Incremental Migration
Begin with a single, non-critical feature such as internal microservice communication or mobile app caching. Measure performance improvements before expanding to additional services.
Maintain JSON for Public APIs
Keep JSON for public-facing APIs to maintain developer familiarity and debugging ease. Use CBOR for internal communication where you control both client and server implementations.
CBOR Development Tools
Online tools for CBOR development and testing:
🔄 CBOR to JSON
Convert CBOR binary data to readable JSON format
🔄 JSON to CBOR
Convert JSON to compact CBOR binary format
✅ CBOR Validator
Check if your CBOR data is valid and well-formed
✨ CBOR Formatter
Format and beautify CBOR diagnostic notation
📝 JSON Formatter
Format JSON before converting to CBOR
✓ JSON Validator
Validate your JSON before converting
Additional Resources
Official specifications and technical documentation:
- •CBOR.io - The official CBOR website with specs and implementations
- •RFC 8949 - The official CBOR specification (very technical but complete)
- •CBOR on GitHub - Community repos, tools, and implementations in all languages
- •WebAuthn Spec - See how CBOR is used in real authentication systems