cURL Converter & HTTP Request Builder

Paste a cURL command in the box at the top and press Import. The easiest source is your browser: in DevTools, open the Network tab, right-click a request and choose Copy as cURL. Both the bash and the cmd variants work, and so do commands you wrote by hand, with single quotes, double quotes, $'...' strings and lines broken with a backslash, a caret or a backtick. The command is split into method, URL, headers and body, and every field becomes editable.

What the importer reads. `-X` or `--request` sets the method. `-H` adds a header. `-d`, `--data`, `--data-raw`, `--data-binary` and `--data-urlencode` set the body; several of them are joined with `&`, as curl does. A body with no `-X` makes the request a POST, and a body with no Content-Type gets application/x-www-form-urlencoded, again as curl does. `--json` sets a JSON body with its two headers. `-u user:pass` becomes a Basic Authorization header, `-A` a User-Agent, `-e` a Referer, `-b` a Cookie. `-G` moves the data into the query string, `-I` sends a HEAD. `-F` form fields are turned into urlencoded fields, because a file upload from your disk cannot be reproduced in a web page. Flags that do not change the request, such as `-L`, `-k`, `-s`, `-v` and `--compressed`, are dropped.

Building a request from scratch. Pick the method (GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS), type the URL, add header rows and write a body. The Query params table lists the parameters of the URL decoded, one per row: edit a value, add a row or remove one and the URL is rewritten with the encoding done for you, so `a&b` becomes `a%26b`. Typing in the URL updates the table the other way. The Auth selector adds an Authorization header for you: Bearer token, or Basic from a username and password (encoded as Base64 of user:pass). An imported Authorization header lands in that selector, so a token is edited in one place. Format JSON pretty-prints the body with two-space indentation and tells you when it does not parse.

Code in five languages. The Code panel rewrites the request as cURL, JavaScript fetch, axios, Python requests or HTTPie, and updates as you type. When the Content-Type is JSON, fetch gets a `JSON.stringify({...})` body, axios gets a plain object and Python gets a `json=` payload with true, false and null turned into True, False and None. The cURL output quotes every value for a POSIX shell, so a URL or a body with an apostrophe in it survives the round trip. Copy puts the current tab on your clipboard.

Sending it. Send runs the request with the browser's fetch and shows the status code, the time it took, the response headers and the body, pretty-printed if it is JSON. The request goes from your browser straight to the API, not through a server of ours. That has two consequences. The API has to allow cross-origin requests (CORS): public APIs usually do, internal and admin APIs often do not, and then the page tells you the request failed and suggests running the cURL in a terminal. And browsers refuse to let a page set some headers, including Cookie, User-Agent, Referer and Host, so those are silently left out of a sent request even though they appear in the generated code.

History. Every request you send, and any you save with the Save button, goes into a History list of the last 30. Click one to load it back into the builder. The list lives in this browser's localStorage and nowhere else, which also means a saved request keeps its Authorization header there: clear the history on a shared computer.