# CborDecode()

Decodes CBOR (Concise Binary Object Representation) binary data into native CFML types. CBOR is a binary data format similar to JSON but more compact and efficient — it's used by WebAuthn/passkeys, IoT protocols, and other systems where size and speed matter.

Returns the appropriate CFML type: struct, array, string, number, binary, or boolean.

**Requires Extension:** [Crypto Extension](https://download.lucee.org/#17AB52DE-B300-A94B-E058FC978BE4542D)

```
CborDecode( data=any, options=struct );
```

**Returns:** any

# Arguments

| Argument | Type | Required | Description | Default |
|----------|------|----------|-------------|---------|
| data | any | Yes | CBOR-encoded binary data |  |
| options | struct | No | Optional struct with: preserveTags (boolean, default true) - when false, tagged values are unwrapped to just the inner value |  |

# Usage Notes

CBOR maps can have integer keys (e.g. COSE keys use `1`, `3`, `-1`), but CFML struct keys are always strings. Integer keys are converted to their string representation — so CBOR key `1` becomes struct key `"1"`. See [CborEncode()](cborencode.md) for how this is handled on re-encoding.

**Tagged values:** Some CBOR protocols use tags to mark the meaning of a value (e.g. tag 1 = epoch timestamp). By default, tagged values are returned as `{ tag: N, value: ... }`. Pass `{ preserveTags: false }` to unwrap them and get just the inner value.

**Binary data:** Unlike JSON, CBOR natively supports binary (byte strings). These are returned as CFML binary values, not base64-encoded strings.

# Examples

```cfml
// Decode CBOR bytes back into a CFML struct
cbor = CborEncode( { name: "Zac", age: 42 } );
data = CborDecode( cbor );
// data.name == "Zac", data.age == 42

// Works with all CFML types: arrays, strings, numbers, booleans, binary
cbor = CborEncode( [ 1, "two", true, 3.14 ] );
arr = CborDecode( cbor );
// arr[1] == 1, arr[2] == "two", arr[3] == true

// Binary data survives the roundtrip (unlike JSON which can't hold binary)
payload = charsetDecode( "binary payload", "UTF-8" );
decoded = CborDecode( CborEncode( payload ) );
// isBinary( decoded ) == true

// Tagged CBOR values (used by some protocols to mark types like timestamps)
// are returned as structs with "tag" and "value" keys by default
// Set preserveTags=false to just get the inner value without the tag wrapper
data = { key: "value" };
decoded = CborDecode( CborEncode( data ), { preserveTags: false } );
// decoded.key == "value"

// WebAuthn: decode the attestation object from a passkey registration
attestationObject = CborDecode( Base64UrlDecode( response.attestationObject ) );
// attestationObject.fmt, attestationObject.authData, attestationObject.attStmt
```







# Categories

[Cryptography](../../categories/crypto.md)

# See Also

[CborEncode()](cborencode.md), [CborToJson()](cbortojson.md), [CoseToKey()](cosetokey.md)