Skip to content
ecdsa.com

CWT (CBOR Web Token)

The CBOR counterpart of JWT (RFC 8392): a claims set encoded as a CBOR map with integer claim keys and protected by COSE signing, MAC or encryption.
Also written asCBOR Web TokenRFC 8392CWT claims

Registered claims use small integer keys: iss 1, sub 2, aud 3, exp 4, nbf 5, iat 6, cti 7 (the CWT ID). A CWT is usually a COSE_Sign1 or COSE_Mac0 structure, optionally wrapped in CBOR tag 61. The compact binary form fits QR codes, NFC and constrained devices better than base64url JSON.

Uses include the EU Digital COVID Certificate (HCERT, a COSE-signed CWT in a QR code), the ACE framework for constrained devices (RFC 9200), proof-of-possession keys in cnf (RFC 8747) and status list tokens. The COSE/CWT decoder decodes them locally.

Standards and references

All terms