Protobuf decoder

What is a Protobuf Decoder?

Protocol Buffers (protobuf) is Google's compact binary serialization format, used by gRPC, many Google APIs, Kubernetes internals and mobile apps. Because protobuf messages are binary and field names are not included, captured payloads are unreadable without the .proto schema. This decoder parses the wire format directly, showing field numbers, wire types and values so you can debug messages even when you do not have the schema.

How to use it

  1. Paste the message bytes as hex.
  2. Review the decoded field list.
  3. Match field numbers to your schema if you have it.

How the wire format works

A message is a sequence of key-value pairs. Each key is a varint containing (field_number << 3) | wire_type. Wire types are:

  • 0 VARINT: int32, int64, uint, bool, enum.
  • 1 I64: fixed64, sfixed64, double.
  • 2 LEN: strings, bytes, nested messages and packed repeated fields, preceded by a length.
  • 5 I32: fixed32, sfixed32, float.

Example

Hex 08 96 01 12 04 74 65 73 74 decodes as:

  • 08: field 1, varint; 96 01 = 150.
  • 12: field 2, length-delimited; 04 = 4 bytes; 74 65 73 74 = test.

Limits of schemaless decoding

  • Field names are unknown; only numbers are shown.
  • A length-delimited field could be a string, raw bytes or a nested message; the decoder guesses.
  • Varints could be signed with zigzag encoding (sint32) or plain; values may need reinterpretation.
  • gRPC frames add a 5-byte prefix (compression flag and length) before the protobuf message; remove it first.

Frequently Asked Questions

Can I decode protobuf without the .proto file?

Yes, partially. Field numbers, wire types and raw values can be decoded, but names and exact types require the schema.

What is a varint?

A variable-length integer encoding where each byte carries 7 bits of the value and the top bit signals whether more bytes follow.

How do I decode a gRPC message?

Remove the 5-byte gRPC frame header, which holds a compression flag and the message length, then decode the remaining bytes.

Why does a string field show as a nested message?

Length-delimited fields can contain strings, bytes or messages. Without a schema the decoder has to guess.