CBOR
By IETF
CBOR, short for Concise Binary Object Representation, is a binary data serialization format standardized by the IETF that encodes structured data such as maps, arrays, numbers, and strings in a compact form modeled conceptually on JSON's…
Definition
CBOR, short for Concise Binary Object Representation, is a binary data serialization format standardized by the IETF that encodes structured data such as maps, arrays, numbers, and strings in a compact form modeled conceptually on JSON's data model. It was designed to require minimal code to encode and decode, making it suitable for constrained devices and network protocols where message size and parsing overhead matter more than human readability.
Overview
JSON became the dominant format for exchanging structured data on the web because it is human-readable and easy to parse, but its text-based representation carries overhead in message size and parsing cost that becomes noticeable in constrained network protocols or on small embedded devices. CBOR was created to preserve JSON's flexible, self-describing data model, extending it with additional types, while replacing the text encoding with a compact binary format defined in an IETF standard, RFC 8949. Mechanically, CBOR encodes each value with a leading byte that identifies its major type, such as an unsigned integer, byte string, text string, array, map, or a set of simple and floating-point values, followed by the value's length and content in a variable-length encoding scheme. This tag-length-value style structure lets a decoder walk through a CBOR document without needing a schema, similar to how a JSON parser works, while producing noticeably smaller output than the equivalent JSON text, particularly for numeric-heavy data, because numbers are stored as binary rather than as decimal digit characters. CBOR sits near Protocol Buffers and MessagePack in the landscape of binary serialization formats but differs in its design goals: Protocol Buffers requires a predefined schema for both encoding and decoding, trading flexibility for stronger typing and smaller messages in well-controlled systems, while CBOR and MessagePack remain schema-optional and self-describing like JSON, prioritizing ease of adoption and interoperability over the last few percent of size reduction a schema-driven format can achieve. In practice, CBOR is used in network protocols and standards where message size and parsing simplicity matter on constrained hardware, including several IETF-defined protocols for the Internet of Things, the WebAuthn and FIDO2 authentication standards for encoding cryptographic assertions, and various embedded messaging systems. Libraries for encoding and decoding CBOR exist across most mainstream programming languages, and many implementations offer straightforward conversion to and from JSON for interoperability with existing tooling. The main limitation is that CBOR's binary form is not human-readable, so debugging and manual inspection require a decoding tool rather than simply opening a text file, and its ecosystem of tooling, documentation, and community familiarity is smaller than JSON's. For applications where message size or parsing performance on constrained devices is not a real concern, JSON's readability and universal tooling support usually make it the simpler default choice over CBOR, with CBOR reserved for the specific cases where an existing standard mandates it or where the bandwidth and CPU savings on constrained hardware are large enough to justify the added tooling and debugging overhead.
Specification
- Encodes JSON-like data models in a compact binary form
- Standardized by the IETF as RFC 8949
- Requires no predefined schema to encode or decode
- Uses tag-length-value encoding for self-describing structure
- Produces smaller messages than JSON, especially for numeric data
- Supports additional data types beyond JSON's native set
- Widely used in constrained IoT and embedded network protocols
- Underpins cryptographic assertion encoding in WebAuthn and FIDO2