CBOR, specified in RFC 8949, encodes the same kinds of values as JSON, objects, arrays, strings, numbers and booleans, plus byte strings and tagged types, in a compact binary form that a tiny decoder can parse without a schema. A short integer takes one byte and keys can be integers instead of strings, which is how a message that is verbose in JSON can shrink to a fraction of its size.
The IETF built it with constrained devices in mind: CoAP uses it as a standard content format, COSE provides signatures and encryption over it, and it underlies SUIT firmware manifests. The trade-off versus Protocol Buffers is that CBOR does not require a shared schema, which simplifies evolution but means field names or numbering conventions must still be agreed. See CoAP explained.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.