curl Command Builder
Visual builder for curl commands. Fill in method, headers, and body — copy the exact command.
Privacy: This page only assembles text. It never sends a request to the URL you enter, and nothing you type is uploaded or logged. Note that tokens and passwords you enter do appear in the shareable link, so treat that link as a secret.
Nothing is requested from the URL you type — this page only assembles text. The form is mirrored into the query string (under 2 KB) so you can share a prefilled builder.
What it does
Fill in a method, URL, query parameters, headers, auth, and a body, and get back a
correctly quoted curl command you can paste into a shell without editing. The
same request is also emitted as a browser fetch() call and as an HTTPie command,
which is useful when you need to hand the same request to three different people
who each live in a different tool.
It also works backwards. Paste a curl command someone sent you — the kind with
eleven flags and a body full of quotes — into the import pane and it is
decomposed into editable fields. Chrome and Firefox both offer “Copy as cURL” in
the network panel, and that output is exactly what the importer is built to eat.
How it works
Everything is string manipulation in your browser. The tool never sends a request
to the URL you type, which is deliberate: there is no CORS negotiation to lose, no
risk of firing a DELETE at production because you were mid-edit, and no reason
for your credentials to touch the network. The URL is the only thing the page does
touch, and only to mirror your form into the query string so a prefilled builder
can be shared.
Quoting is the part worth caring about. Every emitted value is wrapped in POSIX
single quotes with embedded single quotes escaped as '\'', which is the only
form that survives an arbitrary byte sequence in bash, zsh, and sh. Double
quotes are not safe for this because the shell still expands $, backticks, and
backslashes inside them, so a JSON body containing $ref quietly becomes a
different body. The importer applies the same rules in reverse, tokenizing quotes,
escapes, and trailing-backslash line continuations before it interprets any flags.
Body mode changes which flag is emitted. JSON and raw use --data-raw, not -d,
because -d strips newlines and treats a leading @ as a filename — two ways to
silently send something other than what you pasted. Form mode emits one
--data-urlencode per field so curl handles the percent-encoding. File mode emits
-F field=@path for a multipart upload when you name a field, and
--data-binary @path when you do not, which sends the file as the entire body. No
file is ever opened by this page; the path is only text destined for your shell.
Where the translations stop being exact
The fetch() output is a faithful translation until it hits something the browser
will not do. -k has no equivalent, because no browser lets script skip
certificate validation, so the snippet carries a comment instead of a silent lie.
Basic auth becomes an explicit Authorization header built with btoa, since
fetch has no credential parameter for it — the encoding is defined in
RFC 7617 and is base64, not
encryption, so treat it as plaintext over the wire. File uploads become a comment
too: a browser cannot read ./payload.json off disk, so you need a File from an
<input type="file">.
Redirect handling is the subtle one. fetch follows redirects by default, whereas
curl does not follow them at all without -L, so leaving -L unchecked emits
redirect: "manual" to preserve the behaviour you asked for. And when you do use
-L, remember curl converts a redirected POST into a GET on 301, 302, and
303, matching browsers and
RFC 9110. If you
need the method preserved, --post301 --post302 forces it, but the real fix is a
server that returns 307 or 308.
When to reach for it
Reach for it when you are writing a request into a runbook and want it right the first time, when you are converting a browser network-panel entry into something a CI job can run, or when a colleague sends you an unreadable one-liner and you want to see its structure before you run it against anything. It is also the safe place to disassemble a command from an untrusted source, since importing it here cannot execute it. The curl manual remains the authority for the several hundred flags this builder does not cover.
Related tools
- HTTP header inspector to see what a request actually gets back.
- HTTP status code reference for the redirect and error semantics referenced above.
- JWT decoder to check the bearer token before you send it.
- JSON formatter to tidy a request body first.
- URL encoder/decoder for query strings that need percent-encoding by hand.
Frequently asked questions
Does this tool actually send the request?+
fetch is issued to the host you type, so there is no CORS problem and no accidental write to a production endpoint. Copy the command and run it in your own shell where you can see exactly what happens.Why does the output use --data-raw instead of -d?+
-d (an alias for --data) strips carriage returns and newlines from the payload, which silently corrupts a pretty-printed JSON body. --data-raw sends the bytes exactly as given. -d also treats a leading @ as “read from this file”, so a body that starts with @ gets misread. See the curl manual.Why did my POST turn into a GET after a redirect?+
-L follows the redirect and curl, like browsers, converts a redirected POST to a GET on 301, 302, and 303. Add --post301 --post302 to keep the method, or better, fix the server to return 307/308, which forbid the rewrite. Check the status code reference for the distinction.How do I quote a JSON body so the shell does not mangle it?+
'\''. This builder does that automatically for every value it emits. Double quotes are the wrong choice for JSON bodies because the shell will still expand $, backticks, and backslashes inside them. On Windows cmd.exe the rules differ entirely; use WSL, Git Bash, or PowerShell with its own quoting.Is it safe to put a token in the command line?+
ps on many systems and is written to your shell history. For anything real, use -H "Authorization: Bearer $TOKEN" with the token in an environment variable, or put the header in a file and use curl --config. Same applies to -u user:pass; passing just -u user makes curl prompt instead.Related tools
HTTP Header Inspector
Paste a URL, see the response headers with a plain-English explanation of each.
HTTP Status Code Reference
Searchable HTTP status reference with links to the RFC and common causes for each code.
JWT Decoder
Decode a JWT header and payload. Optionally verify HS256/RS256 signatures — all client-side.