All tools

curl to code converter

curl commands to fetch, axios, Python, Go, PHP or wget, parsed safely in your browser.

Paste a command from API docs or your browser's “Copy as cURL”. Line breaks with \ (bash), ^ (Windows cmd) or ` (PowerShell) are understood. Nothing is run or sent.

Generated code: fetch (browser)

// curl only follows redirects with -L; fetch follows them by default.
const response = await fetch("https://api.example.com/v1/chat/completions", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "Bearer $API_KEY",
  },
  body: JSON.stringify({
    model: "example-model",
    messages: [
      {
        role: "user",
        content: "Hello",
      },
    ],
    temperature: 0.7,
  }),
});

console.log(response.status);
console.log(await response.text());

What the command does

Method
POST
URL
https://api.example.com/v1/chat/completions
Headers
Content-Type: application/json Authorization: Bearer $API_KEY
Body
form-encoded or raw data (-d)

Notes

  • This request contains credentials (a token, password or cookie). Do not commit the generated code; load secrets from environment variables, and rotate any key that was pasted somewhere public.
  • Shell variables ($API_KEY) were left as text. Read them from the environment in your code instead of pasting the values.

What this tool does

API documentation shows requests as curl commands; your code needs them as a library call. Paste the command and the tool rewrites the same request in seven forms: fetch for the browser, fetch for Node.js (18 and later), axios, Python requests, Go net/http, PHP cURL and wget. Next to the code it lists the method, URL, headers and body it understood, and notes anything that did not carry over.

The command is never run. A small tokenizer written for this tool splits it into words the way a shell would, without expanding anything, and the parser reads the curl options from those words. Nothing is sent anywhere, which matters because pasted commands often contain tokens.

What it understands

  • Quoting: single quotes, double quotes with \" escapes, ANSI-C strings like $'line\n', backslash escapes, and the classic '"'"' trick for a quote inside single quotes.
  • Line continuations: \ at the end of a line (bash and zsh), ^ (Windows cmd) and the backtick (PowerShell). In cmd, \" inside double quotes is read as a quote, as curl.exe does.
  • Options: -X, -H (repeated), -d, --data-raw, --data-binary, --data-urlencode, --json, -F with files and ;type=, -u, -b, -A, -e, -L, -k, -G, -I, -m, --compressed, --oauth2-bearer and --url, in short, long, combined (-sSL) and attached (-XPOST, --header=…) forms.
  • Bodies: several -d values are joined with & like curl does; JSON bodies become objects in fetch, axios and Python (json=), form-encoded bodies become a dictionary in Python; -G moves the data into the query string.

Without -X, curl sends POST when there is a body and GET otherwise; -d adds a form content type unless you set one; --json adds JSON content type and accept headers. The tool follows the same rules, so the generated code sends what curl would have sent.

What does not carry over

Some curl behaviour has no line-for-line equivalent, and the notes say so instead of guessing:

  • Files: -d @file, -F file=@path and -b cookiefile read files on your machine. The code refers to the same path, which must exist where the code runs.
  • Redirects: curl only follows them with -L; fetch, axios, requests and Go follow by default. Where the library can, the code turns that off to match (requests' allow_redirects, Go's CheckRedirect, axios maxRedirects).
  • Browser limits: in browser fetch, headers such as Cookie, User-Agent, Referer and Host cannot be set; they are removed with a comment. Browser requests are also subject to CORS, which curl never is.
  • -k / --insecure turns off certificate checks. Each target says how, with a warning to keep it out of production.
  • Shell variables such as $API_KEY stay as text, and the notes list them: read them from the environment in your code.
  • Windows PowerShell 5: curl there is an alias of Invoke-WebRequest; the tool reads the command as real curl.exe.

Credentials and history

If the command contains a token, password or cookie, the tool says so in bold. Generated code with a real key in it tends to end up committed, pasted into chat or logged. Move the value into an environment variable before you save the file. The same applies to the terminal: commands you type are kept in shell history files. Converting curl commands without leaking secrets explains how to keep keys out of history and code. For the response, the JSON formatter and JWT decoder help.

Frequently asked questions

Is my curl command sent to a server?

No. It is parsed in the page by a tokenizer written for this tool, and nothing is executed or uploaded. That matters because commands often contain API keys.

Why does the generated fetch code not send my Cookie header?

Browsers do not let JavaScript set Cookie, User-Agent, Referer and a few other headers. The browser target removes them with a comment; the Node.js target keeps them.

Does it handle Windows curl commands?

Yes. Lines ending in ^ (cmd) or ` (PowerShell) are joined, and \" inside double quotes in cmd is read as a quote, as curl.exe does.

What happens with -d @file or -F [email protected]?

The generated code refers to the same path (open() in Python, os.Open in Go, CURLFile in PHP, openAsBlob in Node). The file must exist where the code runs; a note reminds you.

Why is POST used when I did not write -X POST?

That is curl's own rule: with -d, --json or -F and no -X, curl sends POST. With -G the data goes into the URL and the method stays GET.

Read more

Updated October 14, 2026 · More in Developer