cURL to Code Converter
Paste any cURL command and get clean, runnable code for Python, JavaScript, Node.js, cURL, PowerShell, Go, PHP, Ruby, Java or raw HTTP — converted live, 100% in your browser.
Copy the curl line out of an API browser, a Postman export or a terminal history and paste it
below. The converter understands multi-line commands with backslash or Windows ^ continuations,
single- and double-quoted values, and the full range of common options: headers, request bodies (JSON,
form data, multipart file uploads), authentication (basic, bearer, cookies), redirects, TLS settings,
timeouts, proxies and more. Pick a target language from the tabs and copy or download the result.
🔒 100% private — nothing is uploaded or stored.
Your cURL command is parsed and converted entirely in this browser tab and never leaves it —
there is no server-side processing and no network request. Commands often contain API keys, tokens
and credentials; converting them here means those secrets never touch a server. It also keeps
working offline.
Try a sample:
cURL command
Paste your curl command — single line or wrapped across many lines. The
conversion updates as you type.
Converted code
How the converter parses your command
cURL commands are shell commands, so the first job is a small shell-style tokenizer rather than a naive split on spaces. It handles:
- Line continuations. A trailing backslash (Unix) or caret (cmd.exe) at the end of a line joins the next line, so commands copied from terminals or PowerShell wrap cleanly.
- Quoting. Single quotes are fully literal; double quotes process backslash escapes
(
\",\\,\$). Unquoted text is split on whitespace, and a backslash escapes the next character. - Options. Long options (
--data-raw), short options (-d), combined shorts (-sL), attached values (-d'{"a":1}',-XPOST) and the--option=valueform are all recognised. - Shell leftovers. If the paste contains a pipe, redirect or command chain
(
curl ... | jq), only thecurlpart is converted and you are told what was dropped. Shell variables such as$TOKENcannot be expanded in the browser, so they are kept verbatim with a warning — paste the expanded value for a faithful result.
What gets preserved
| cURL option | Where it goes in the generated code |
|---|---|
-H / --header | Request headers, in original order. Header: with an empty value suppresses that default header, exactly like curl. |
-d, --data-raw, --data-binary | Request body. Multiple -d flags are joined with &, as curl does. |
--data-urlencode | Body (or query string with -G), with the value percent-encoded. |
-F / --form | Multipart body using each language's multipart API, including @file uploads with ;type= and ;filename= modifiers. |
-u / --user | Basic auth: auth=(user, pass) in requests, SetBasicAuth in Go, or a pre-computed Authorization: Basic header elsewhere. |
--oauth2-bearer | Authorization: Bearer header. |
-b / --cookie | Cookie header (a cookies dict in requests). |
-A, -e | User-Agent and Referer headers. |
-X, -I, -T, -G | Method. -G moves body data into the query string and forces GET, as in curl. |
-L, --max-redirs | Redirect following (and a note where the target has no max-redirects setting). |
-k, --cacert, --cert / --key | TLS verification settings: verify=False, custom CA bundles, client certificates where the target supports them. |
--max-time, --connect-timeout | Timeouts. |
-x / --proxy | Proxy configuration where the target supports it. |
--compressed | Accept-Encoding header (Go already does this automatically, so it is left to the standard library there). |
| URL query string | Kept in the URL for most targets; a params mapping in Python requests. |
Behaviour differences to know
-
Redirects. curl does not follow redirects unless you pass
-L. Most HTTP libraries do the opposite: requests, fetch, Go, PHP and Java follow by default. The generated code is written to match your command — no-Lmeans the code will not follow either. -
-kin the browser. Browsers cannot skip TLS certificate verification for security reasons, so the JavaScript (fetch) output carries a comment instead of a flag. The Node.js, Python, Go, PHP, Ruby and Java outputs can all disable verification. -
Cookies in the browser. Browsers forbid scripts from setting the
Cookieheader on cross-origin requests; the fetch output includes a note. Same-origin or Node.js usage is unaffected. -
JSON bodies. When the body is valid JSON and you did not set your own
Content-Type, Python requests usesjson=and fetch usesJSON.stringify()— both setContent-Type: application/jsonthemselves. If you did set aContent-Type, the raw body is sent as-is to keep your header authoritative. -
-Xis a hint, not a rule. curl sends whatever body you give it even if the method looks wrong (-X GET -d 'a=b'sends a body on a GET). The converter preserves that faithfully — including the oddness. -
File uploads and file bodies. The converter cannot read your files, so
-F name=@fileand--data-binary @filebecome code that reads the file at runtime from the same path. Move the file next to the script (or adjust the path) before running. -
Display-only options.
-s,-v,-#,-wand the--trace*family only affect curl's own output, so they are dropped silently. Options that cannot be represented (FTP/SSH options,--raw,--netrc, custom cipher suites, ...) are dropped with a visible warning.
Supported options at a glance
| Status | Options |
|---|---|
| Preserved |
-X -I -T -G -d
--data-raw --data-binary --data-urlencode
-F --form-string --json --url-query
-H -A -e -b -u
--oauth2-bearer --password -L
--max-redirs -k --cacert --cert
--key -x --proxy-header --max-time
--connect-timeout --retry --compressed
-o --url
|
| Noted (kept as a comment in the output) |
--http1.1 --http2 --http3 --ipv4
--ipv6 --limit-rate --fail --include
--globoff --path-as-is --resolve
--interface --location-trusted --post301/302/303
--basic --retry-delay --retry-max-time
|
| Dropped with a warning |
FTP/SSH/Telnet options, --raw, --netrc, --config,
--unix-socket, --socks4/5, custom cipher suites and TLS version
pins, --digest/--ntlm auth, --cookie-jar,
--doh-url, --parallel
|
| Dropped silently (display-only) | -s -S -v -# -w --trace --trace-ascii --trace-time --log-error --progress-bar |
⚠️ Things to know
- The output is a starting point. Secrets pasted into the command end up in the generated code verbatim. For anything you commit, move tokens into environment variables or a secrets manager first.
- Unrecognised options are never guessed at. If an option is not in the table above, you get a warning naming it — the generated code is never silently wrong about what it does.
-
Multiple URLs and
--nextdescribe several transfers; the first transfer is converted and the rest are reported.
Suggested
