cURL Converter

Convert command-line cURL syntax into production HTTP client code for JavaScript, Python, Go, PHP, Java, and C#, or reverse application code into reproducible shell commands.

Syntax:
Language:

HTTP Method

POSThttps·SSL Verified

Host & Path

api.example.com/v1/invoices

Headers & Auth

3 headers·🔑 Bearer Token

Body Payload

JSON Object·179 B (<1ms)
cURL Command
Lines13
Size363 B
Format:Bash/cURL
async function sendRequest() {
  try {
    const response = await fetch("https://api.example.com/v1/invoices", {
      method: "POST",
      headers: {
        "Authorization": "Bearer sec_tok_9876543210",
        "Content-Type": "application/json",
        "Accept": "application/json"
      },
      body: JSON.stringify({
        "customer_id": "cust_48291",
        "amount": 149.5,
        "currency": "USD",
        "items": [
          {
            "id": "prod_1",
            "qty": 1,
            "price": 149.5
          }
        ],
        "auto_send": true
      }),
    });
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    const data = await response.json();
    console.log(data);
    return data;
  } catch (error) {
    console.error('Request failed:', error);
  }
}

sendRequest();
Converted in <1ms
Lines:35
Size:850 B

CLI Lexing & Multi-Shell Escaping Architecture

Parsing cURL commands from real-world terminal sessions requires simulating shell tokenizer state machines across POSIX shells (Bash, Zsh), Windows Command Prompt (cmd.exe), and Windows PowerShell. Naive regular expressions or space splits corrupt string literals whenever payloads contain escaped quotation marks, spaces, or embedded newlines:

POSIX Quoting Disciplines (Bash / Zsh)

Single quotes ('...') enforce literal character preservation: no variable expansion, no globbing, and backslashes possess no escape power. Double quotes ("...") allow parameter expansion and interpret backslash escapes (\", \\, \$). ANSI-C quoting ($'...') interprets escape sequences like \n, \r, and \xHH hex byte literals, which the converter transforms into binary-clean payloads.

Windows Shell Differences (cmd.exe / PowerShell)

Windows Command Prompt does not support single-quote string boundaries. Arguments must be enclosed in double quotes, with internal quotes escaped via double-double quotes ("") and line continuation signaled by carets (^). PowerShell uses backticks (`) for continuation and escape sequences. The preprocessor strips continuation markers and harmonizes cross-platform line breaks prior to lexical argument tokenization.

cURL CLI Flags to HTTP Client Translation Matrix

The cURL utility translates command-line flags into HTTP protocol primitives governed by RFC 9110. The table below details how standard command-line options map to programming runtime primitives:

cURL FlagProtocol MeaningJavaScript FetchPython RequestsGo net/http
-X, --requestExplicit HTTP verb (GET, POST, PUT, DELETE, PATCH)method: "POST"requests.post(...)http.NewRequest("POST", ...)
-H, --headerRFC 9110 field-name : field-value pairheaders: { ... }headers={ ... }req.Header.Set(k, v)
-d, --data-rawLiteral request body; implicitly switches verb to POSTbody: JSON.stringify(...)json=... or data=...strings.NewReader(...)
--data-binaryExact payload preservation including CRLF line endingsbody: rawString / Bufferdata=b"..."bytes.NewReader(buf)
--jsoncURL 7.82+ JSON flag; auto-injects Content-Type & Acceptbody: JSON.stringify(...)json=dict_payloadbytes.NewBuffer(jsonBytes)
-u, --userRFC 7617 Basic Authentication credentialsAuthorization: Basic b64auth=("usr", "pwd")req.SetBasicAuth(u, p)
-b, --cookieCookie key-value pair string or jar inputCookie header stringcookies={ ... }req.AddCookie(&http.Cookie)
-F, --formRFC 7578 Multipart form field or file uploadnew FormData()files={ ... }multipart.NewWriter(...)
-L, --locationFollow HTTP 3xx redirect responsesredirect: "follow"allow_redirects=TrueDefault Client behavior
-k, --insecureDisable TLS certificate verificationrejectUnauthorized: falseverify=FalseTLS: InsecureSkipVerify
-m, --max-timeMaximum total execution duration in secondsAbortSignal.timeout(ms)timeout=secscontext.WithTimeout(...)

Browser DevTools Ingestion & Network Sanitization

Exporting requests via Chrome, Firefox, or Edge DevTools (Copy as cURL) captures browser-specific transport states. Direct re-execution in backend runtimes frequently causes failures if client-internal headers are not sanitized:

HTTP/2 & HTTP/3 Pseudo-Header Stripping

Browser DevTools export HTTP/2 pseudo-headers (:authority:, :method:, :path:, :scheme:). In HTTP/1.1 client libraries (like Node.js fetch or Go net/http), header names beginning with a colon are forbidden by RFC 9110 token grammars and immediately trigger runtime exceptions (e.g. ERR_INVALID_HTTP_TOKEN). The parser detects and strips these pseudo-headers automatically while preserving target path information.

Client Hint & Fingerprint Header Isolation

Browser exports include ephemeral security and telemetry headers (sec-ch-ua, sec-fetch-dest, sec-fetch-mode, sec-fetch-site). When testing public REST APIs, these headers are superfluous and occasionally trigger Web Application Firewall (WAF) blocking when mismatched with backend user agents. The parser isolates these headers, letting developers inspect and prune unnecessary browser telemetry.

Supported Language Runtimes & Execution Profiles

Different programming language runtimes adopt distinct architectures for connection lifecycle management, status code error boundaries, and socket timeout controls:

Target RuntimeUnderlying EngineConnection LifecycleError Status HandlingTimeout Mechanism
JavaScript (Fetch)WHATWG Fetch StandardAutomatic keep-alive poolRequires checking response.oksignal: AbortSignal.timeout(ms)
JavaScript (Axios)axios HTTP adapterNode.js http.Agent poolingAutomatically rejects non-2xx statustimeout: ms
Python (Requests)urllib3 enginePooled via Session objectRequires resp.raise_for_status()timeout=(connect, read)
Python (HTTPX)httpcore engineHTTP/1.1 & HTTP/2 multiplexingRequires resp.raise_for_status()httpx.Timeout(secs)
Go (net/http)Standard libraryStrictly requires defer resp.Body.Close()Returns error only on transport failurecontext.WithTimeout(...)
PHP (ext-curl)libcurl C-bindingHandle closed via curl_close($ch)Read with curl_getinfo(..., CURLINFO_HTTP_CODE)CURLOPT_TIMEOUT
Java (OkHttp)Square OkHttp 4.x/5.xConnectionPool; requires Response.close()Evaluated via response.isSuccessful()callTimeout(duration)
C# (HttpClient)System.Net.HttpSocketsHttpHandler socket reuseRequires EnsureSuccessStatusCode()CancellationTokenSource

Bidirectional Reverse Conversion: Code to cURL Synthesis

Debugging backend microservice communication or drafting integration test cases often requires transforming application source code back into a copy-pasteable terminal command. The reverse synthesizer implements lexical pattern matching to reconstitute shell one-liners from JavaScript fetch, Axios, and Python requests snippets:

URL & Parameter Parsing

Extracts the target endpoint from function call signatures, preserving existing query strings without introducing double percent-encoding.

Header Serialization

Maps object properties and dictionary entries to explicit -H "Key: Value" arguments, applying POSIX escaping for internal quotation marks.

Body Reconstruction

Detects whether payloads are stringified JSON or form parameters, emitting clean POSIX-escaped -d '...' payload switches.

Frequently Asked Questions

Why does running cURL commands in Windows PowerShell fail or return unexpected HTML objects?

In Windows PowerShell 5.1, "curl" is aliased by default to the built-in cmdlet "Invoke-WebRequest", which parses parameters completely differently from curl.exe (for example, misinterpreting -d or -H and returning an HtmlWebResponseObject). To execute genuine cURL commands in PowerShell, invoke "curl.exe" explicitly or remove the alias in your session profile via "Remove-Item alias:curl". The converter generates standard CLI syntax and idiomatic programming code unaffected by PowerShell alias collisions.

Why can passing a raw "Accept-Encoding: gzip, deflate, br" header corrupt response bodies in Python or Go?

Modern HTTP client engines (including Python urllib3/requests and Go net/http) automatically negotiate transparent transport decompression when Accept-Encoding is omitted. If you manually inject an explicit "Accept-Encoding: gzip, deflate, br" header copied from a browser cURL snippet, libraries like Requests disable their automatic decompression hooks, leaving the response content as raw compressed binary bytes that fail UTF-8 decoding. When converting commands to Python or Go, it is strongly recommended to remove manual Accept-Encoding headers to let the client library decompress responses automatically.

How are multipart file uploads (-F or --form) adapted into production client code?

When translating -F "file=@document.pdf", command-line syntax cannot simply be copied to client libraries because browsers and servers require real file descriptors. The converter maps form parameters into standard request payloads; for production file uploads, developers should bind real file streams—such as Python requests files={"file": open("document.pdf", "rb")}, browser/Node FormData with File/Blob objects, or Go multipart.NewWriter—to compute RFC 7578 boundaries and stream binary contents efficiently.

How does the converter handle duplicate headers, such as multiple "Set-Cookie" or custom tracking keys?

Per RFC 9110 Section 5.3, multiple header fields with the same field name can be combined into a single comma-separated value, with the strict exception of "Set-Cookie". In the converter, headers are stored in standard key-value maps and emitted as idiomatic dictionaries (or req.Header.Set in Go), where duplicate keys resolve to the last occurrence. If your endpoint mandates discrete multi-valued headers or multiple cookies, adapt the output to use your library's multi-value methods (such as req.Header.Add in Go or multidict in Python).

How do HTTP 307 and 308 redirects differ from 301 and 302 when converting the -L flag?

cURL with -L (--location) follows all 3xx redirects. Under RFC 9110, status codes 301 and 302 historically allow clients to rewrite POST requests to GET on redirection (dropping the request body). In contrast, 307 (Temporary Redirect) and 308 (Permanent Redirect) strictly forbid changing the HTTP method or body payload. Standard client libraries like Python Requests follow redirects automatically by default, while Go net/http allows configuring custom CheckRedirect policies when granular redirect control is required.

How are proxy configurations (-x) and custom CA certificates (--cacert) mapped to application code?

Proxy switches (-x http://proxy:8080) and custom certificate flags (--cacert) govern transport-level socket routing rather than per-request HTTP headers. In application code, these are configured at the HTTP client transport layer—such as the "proxies" dictionary in Python Requests/HTTPX, "http.ProxyURL" inside Go http.Transport, or https-proxy-agent in Node.js. For self-signed certificates, point your client TLS settings to the certificate file path rather than bypassing verification.

Can the converter parse GraphQL queries embedded inside cURL JSON payloads?

Yes. GraphQL requests over HTTP are transmitted as POST payloads with a JSON structure containing "query" and optional "variables" keys. The converter safely parses JSON payloads containing embedded quotation marks and escaped newlines, preserving the GraphQL query and variables structure as clean, idiomatic JSON objects across all supported languages.

How should large request payloads or binary streams be handled to avoid buffering into RAM?

Standard cURL streams file uploads on the fly without consuming excess memory. When converting file-based cURL commands to high-throughput production code, avoid loading full file contents into memory via read() or fs.readFileSync(). Instead, use streaming primitives: fs.createReadStream() in Node Fetch, passing file-like objects to Python Requests data/files parameters, or os.Open() passed to Go http.NewRequestWithContext.