tool4.dev

HTTP & APIs / LOCAL TOOL

cURL Converter & Explainer

Read what a curl command actually does, then convert it to JavaScript, Python, Go, Java, C#, PHP, Ruby, or Rust, in your browser.

Runs locally — input is never uploaded
Paste a curl command
What it doesReady when you are
Ready when you are

WHAT IT DOES

Read the command first. Convert it second.

Paste a curl command and it is read into its parts first: the request, the credential, the headers, the body, how the connection is made, and what happens to the response. The code comes after that, in whichever of eight languages you pick: fetch, requests, net/http, java.net.http, HttpClient, PHP's cURL extension, Net::HTTP, or reqwest. The command is tokenized the way a shell would tokenize it, so quoted headers, escaped bodies, and commands wrapped over several lines survive intact.

Why use it?

A request copied from a terminal or browser often needs to become application code. Converting the syntax is only useful if you also know which behavior the target client can reproduce.

How to use this tool

  1. Paste a cURL command, using dummy credentials when working on an example.
  2. Choose the target runtime and convert the command.
  3. Review the request summary and capability verdicts beside the code before copying it. Test the generated request against a service you control; this page does not send it.

Details and limitations

  • Every feature the command uses gets a verdict for the language you picked: reproduced, close but not identical, or not reproduced at all. A proxy is real code in Python and Go and impossible in a browser, and the page says which of those you are looking at.
  • The verdicts are what the eight targets actually differ on. PHP is libcurl, so a cookie jar and a unix socket convert exactly; Ruby's Net::HTTP will not follow a redirect, so -L becomes a loop; reqwest is the only one whose redirect policy takes a number, so --max-redirs converts exactly there and nowhere else.
  • Quoting follows shell rules: single quotes are literal, double quotes escape only what a shell escapes, and a quoted header stays one argument.
  • Line continuations are accepted in all three forms people paste: a trailing backslash, a caret from cmd, and a backtick from PowerShell.
  • Where a language keeps a header somewhere unusual, the code puts it there. .NET refuses Content-Type on the request rather than the content, and does it silently, so the generated C# sets it on the content.
  • The method is inferred the way curl infers it: -d makes it a POST, -T makes it a PUT, and -I makes it a HEAD, unless -X says otherwise.
  • Without -L, curl does not follow redirects, and all three clients do. The generated code turns following off, because that difference is the one that quietly changes what a script reads.
  • -H 'Name:' and -H 'Name;' are different instructions. The first suppresses a header curl would generate; the second sends an empty one. Both are carried through to the code, where the language allows it.
  • A header written twice stays written twice where the client allows it. fetch gets a list of pairs, Go gets Header.Add, Java and Rust append, PHP sends a list, and Python gets the comma-joined form with a note, because a mapping cannot hold both.
  • --data-binary @file names a file curl reads at run time, and the code reads the same file rather than sending the path as text.
  • -b takes either a cookie string or a cookie file, and they are told apart the way curl tells them apart: an argument with an = in it is a string.
  • Connection flags are carried as far as each client goes: --connect-timeout and --max-time, --retry, -x, -k, --compressed, and the HTTP version flags.
  • What happens to the response is part of the command too. -o, -O, -i, -I, -D, -w, -c, and -f all change the code that is generated.

Convert cURL without silently changing request behavior

Read the request before the code

Use the example below in the cURL converter. The data option makes the request a POST even without -X POST. The Content-Type header describes the request body. The example domain is deliberately nonproduction, and the token is a dummy value: do not replace it with a live secret when sharing a screenshot or support report.

curl 'https://api.example.com/items' -H 'Content-Type: application/json' -H 'Authorization: Bearer DEMO_ONLY' --data '{"name":"widget"}'

Compare the capability ledger

Choose the runtime in which the code will actually run. The feature verdicts beside the generated code distinguish reproduced behavior from approximations and unsupported features. A browser cannot configure an HTTP proxy or disable certificate verification through fetch. Server clients have different capabilities; copying a request into another language is not evidence that every flag kept its meaning.

Watch redirects and errors

cURL follows redirects when asked with -L. Many client libraries follow by default, so generated code may explicitly turn that behavior off. Browser manual redirects have visibility restrictions; use the converter's warnings rather than assuming a browser can expose the same response that a command-line client can. Likewise, an HTTP 404 and a failed network connection are not interchangeable. Check what the original command does with -f and what the generated client reports.

Verify against a safe endpoint

Before deployment, run the generated code against a test service you control. Compare method, path, request body, repeated headers, redirects, and error handling. The tool does not send the request for you. Local parsing protects the command while using this page, but pasted credentials still enter the clipboard and any generated source file you save. Replace secrets with your application's credential mechanism before committing code.

References

WORKED EXAMPLES

A JSON POST without an explicit method

The --data option supplies the body and implies POST. This dummy command is never sent by the converter.

Command

curl 'https://api.example.com/items' -H 'Content-Type: application/json' --data '{"name":"widget"}'

Expected result

Method: POST. Body: {"name":"widget"}. Redirect following is not requested; inspect the selected runtime's verdicts.

COMMON QUESTIONS

cURL Converter questions

Does my API key get sent anywhere?
No. Parsing and code generation both run in your browser, so the command never leaves the page. That matters more here than on most converters, because the interesting curl commands are the authenticated ones.
Why did my command become a POST when I did not write -X POST?
Because curl does the same thing. Any of -d, --data, --data-raw, --data-binary, or --json makes the request a POST unless -X names a different method. Reproducing that is the point: a hand-written port that leaves it as a GET is a bug that only shows up against a real server.
What happens to -k?
In Go it becomes InsecureSkipVerify and in Python verify=False, both with the warning that goes with them. In JavaScript it cannot be reproduced: a browser will not let a page skip certificate verification, so it is listed as not reproduced rather than generating code that quietly verifies when the original did not.
Why does the code turn redirect following off when my command has no -L?
Because that is what curl does. curl reports a 3xx and stops unless you pass -L, while fetch, requests, and net/http all follow redirects by default. Leaving it alone is the difference between reading the redirect and reading the page it points at, so the generated code says redirect: "manual", allow_redirects=False, or CheckRedirect returning ErrUseLastResponse.
My command uses a proxy. Why does the JavaScript not?
Because a page cannot choose one. The browser uses the system proxy and fetch has no option for it, so the proxy is listed as not reproduced with the address the command used. Python and Go both get real proxy code.
Does -I give me the headers?
Yes. -I is a HEAD request, and the generated code prints the response headers rather than a body a HEAD response does not have. In a browser only the CORS-safelisted headers plus whatever Access-Control-Expose-Headers names are readable, which is said on the page rather than left to be discovered.
Is the generated Go actually compilable?
Yes. It is a complete main package with the imports it uses and nothing more. Every example on the page is checked against gofmt by the test suite, so a change that breaks the Go it writes fails the build.
Which flags are ignored?
Only the ones that change what curl prints on your terminal rather than what it sends or does: -s, -S, -v, the progress meter, and the trace options. Everything else either changes the generated code or is named on the page, including flags the parser does not recognise.
Can it convert a command with several URLs in it?
It converts the first and lists the rest. curl repeats the whole request for each URL on the command line, and --next starts a different request with its own flags; both are reported so that nothing is lost, but the code below is one request.