Loading tool…
ToolWrenPaste a CoAP packet as hex bytes to break it down into its header fields, token, options and payload. Useful for IoT debugging and learning the Constrained Application Protocol (RFC 7252).
Loading tool…
CoAP is a free, private online tool that lets you decode a CoAP binary message from hex: header, type, code, message ID, token, options and payload. It runs entirely in your browser, so nothing you enter is uploaded to a server.
0x are ignored).Privacy: this tool runs entirely in your browser. Your input is never sent to, received by, or stored on any server — there are no uploads and no tracking of what you enter.
The Constrained Application Protocol (CoAP) is a lightweight, RESTful protocol defined in RFC 7252 for constrained devices and networks (IoT). It runs over UDP and mirrors HTTP concepts — GET, POST, PUT, DELETE and response codes — with very low overhead.
Every message starts with a fixed 4-byte header: a 2-bit Version, 2-bit Type (CON, NON, ACK, RST), 4-bit Token Length, an 8-bit Code (e.g. 0.01=GET, 2.05=Content) and a 16-bit Message ID. The header is followed by the token (0–8 bytes), then options in delta-encoded TLV format, then an optional payload preceded by the 0xFF marker.
Options use delta encoding: each option's number is the previous number plus the 4-bit delta nibble. Nibble values 13 and 14 signal one- or two-byte extended fields. This decoder resolves common option numbers (Uri-Path, Content-Format, Observe, etc.) and renders string/uint values where appropriate.
0x prefixes are ignored, so 41 01 12 34 and 41011234 both work.class.detail. Class 0 = request method (0.01 GET, 0.02 POST, 0.03 PUT, 0.04 DELETE). Class 2 = success (2.05 Content), 4 = client error, 5 = server error.CoAP — the Constrained Application Protocol (RFC 7252) — is a lightweight, RESTful protocol designed for the Internet of Things. It brings the familiar web model of GET, POST, PUT and DELETE to tiny, battery-powered devices and lossy, low-bandwidth networks where full HTTP would be far too heavy. It runs over UDP instead of TCP, keeping overhead to a minimum so sensors and actuators can talk efficiently.
Every CoAP message begins with a compact fixed header just four bytes long. It packs a 2-bit version, a 2-bit type (Confirmable, Non-confirmable, Acknowledgement or Reset), a 4-bit token length, an 8-bit code (the method or response status), and a 16-bit message ID used to match requests with their acknowledgements and detect duplicates.
After the header comes a token (0–8 bytes) that correlates a request with its response. Then come the options — CoAP's equivalent of HTTP headers (Uri-Path, Content-Format, Observe and so on) — encoded in a compact delta format where each option's number is expressed as an offset from the previous one. Finally, if present, a single 0xFF marker separates the options from the payload that follows.
Paste a CoAP message as hexadecimal bytes and the tool walks it field by field: it splits out the version, type, code (shown as the readable class.detail form like 0.01 for GET or 2.05 for Content), message ID and token, then decodes each delta-encoded option to its named value, and finally extracts the payload after the 0xFF marker. It is built to match the structure defined in RFC 7252.
CoAP codes use a class.detail notation. Class 0 is a request method (0.01 GET, 0.02 POST, 0.03 PUT, 0.04 DELETE). Class 2 means success (2.05 Content), class 4 a client error (4.04 Not Found), and class 5 a server error (5.00 Internal Server Error). The parallels with HTTP status codes are deliberate, which makes CoAP approachable for anyone who already knows the web.
This decoder is for IoT developers debugging device traffic — captured from Wireshark, or printed by libraries like libcoap, aiocoap or node-coap. It parses plaintext CoAP structure only; encrypted transports (DTLS or OSCORE) must be decrypted first. Everything happens in your browser, so device data never leaves your machine.