Ciborium

Ciborium is a CBOR (Concise Binary Object Representation) serialization and deserialization library for Rust that plugs directly into the Serde ecosystem. It lets you encode any Serde-serializable type into compact CBOR bytes and decode them back, using simple reader/writer entry points.

Designed to work from embedded no_std targets up to full std applications, Ciborium always serializes numbers to their smallest lossless encoding for maximum wire compatibility, and exposes a low-level layer (ciborium-ll) and IO abstraction (ciborium-io) for cases that need finer control.

What You Get

• Serde-based CBOR serialization and deserialization for any derivable type
• Simple from_reader / into_writer entry points that accept streams or byte slices
• A dynamic Value type for building and inspecting arbitrary CBOR structures
• no_std / alloc support for embedded and constrained environments
• A low-level encoder/decoder crate (ciborium-ll) and IO abstraction (ciborium-io) for advanced use

Common Use Cases

• Encoding structured data into compact binary CBOR for network or storage
• Interoperating with other CBOR implementations across languages
• Serializing data on embedded / no_std devices where JSON is too heavy
• Inspecting or transforming arbitrary CBOR payloads via the dynamic Value type

Under The Hood

Architecture — Ciborium is a three-crate Cargo workspace. ciborium-io defines minimal Read/Write traits that work with or without std; ciborium-ll is a low-level CBOR encoder/decoder operating on those IO traits; and the top-level ciborium crate builds the Serde ser/de implementations plus a dynamic value::Value on top of the low-level layer. The public surface is deliberately small — de::from_reader and ser::into_writer drive the whole round-trip.

Tech Stack — Rust (edition 2021, rust-version 1.85), depending only on serde (with alloc/derive) and the sibling ciborium-ll/ciborium-io crates; dev-dependencies include rstest, serde_bytes, and hex for tests. Feature flags gate std vs alloc-only builds for no_std support.

Code Quality — The crate is well-documented (its README encodes explicit design decisions like smallest-lossless numeric encoding), layered cleanly across three crates, and exercised by an rstest-driven test suite. Maintenance cadence has slowed (last release early 2024), but the code is stable and enormously depended upon, with ~196M total downloads.

API Design — The high-level API is about as minimal as serialization gets: two functions (from_reader, into_writer) that accept any reader/writer including byte slices, plus a Value type for dynamic data. This keeps the learning curve very low while the layered crates expose lower-level control when needed.