Research lab Ink & Switch has released bijou64, a variable-length integer encoding designed so that every integer maps to exactly one valid byte sequence, developed by Brooklyn Zelenka to eliminate a class of canonicality bugs that has historically plagued binary protocols.
The Problem With Traditional Varints
Standard varint formats like LEB128 split integers into 7-bit chunks with a continuation bit on each byte, which allows the same number to be represented by multiple different byte sequences (zero, for instance, can be encoded as either a single byte or padded across two). In systems relying on cryptographic signatures, content addressing, or distributed consensus, that redundancy creates an attack surface: specifications typically require decoders to reject non-canonical encodings, but Zelenka notes developers frequently skip or optimize away that separate validation step, a pattern behind past vulnerabilities in PKCS#1 v1.5, GnuTLS, and Bitcoin transaction malleability.
Structural Prevention Instead of More Checks
Bijou64 avoids the problem architecturally rather than through additional validation. Zelenka frames the goal as removing the one check that mattered, so that with no canonicality check at all, only one valid encoding exists for any given value. Values from 0 to 247 are represented directly in a single initial byte, while bytes from 248 to 255 signal how many payload bytes follow, with each length tier adding a fixed offset so smaller values can never be padded into a larger byte tier.
Performance Gains From a Simpler Structure
Because the payload is a contiguous big-endian integer, compilers can reduce decoding to a single load and byte swap. On both x86 and ARM hardware, bijou64 decodes small numbers roughly twice as fast as LEB128 and larger numbers between 8 and 10 times faster, largely by avoiding LEB128's bit-masking and branch-heavy continuation-bit scanning.
Some Pushback From the Community
Reaction to the release has been mixed on technical grounds. One commenter argued that comparisons against scalar decoders miss where high-performance parsing has actually moved, noting that SIMD-based approaches tend to outperform scalar formats regardless of encoding scheme. Another questioned the core security claim, pointing out that bijou64 narrows rather than eliminates the checked boundary, since a missed range check on the maximum-length case remains just as plausible a bug as a missed check under LEB128, and arguably more likely precisely because smaller values look safe enough to skip validating. Others noted that non-canonical padding in formats like LEB128 is sometimes deliberate, used by linkers in WebAssembly and DWARF to leave room for in-place patching of unlinked references.
Availability
A reference implementation is available in Rust on crates.io under dual MIT and Apache 2.0 licenses, with JavaScript wrappers on npm and community ports in Elixir, Go, Perl, and Java. Width variants bijou32 and bijou128 are also covered in the specification, alongside bijou64 itself.