cURL Toolbox

Features

• Seven targets: JavaScript (fetch), Node.js (node:https — the only one that can honour -k and -u), Python (requests), feapder, PHP (cURL), Go (net/http), Java (HttpClient)
• Three directions sharing one input box: to code, parse into fields, build from a request
• Shell-aware parsing: single quotes, escapes inside double quotes, backslash continuations
• Handles -X, -H, -d / --data-raw, -F forms, -u auth, -b cookies, -A / -e and more
• -G appends the data to the query string instead of sending a body, matching curl
• Both -sSL style clusters and --opt=value are understood
• Unrecognised options are listed as comments at the top rather than silently dropped
• Parse: method, URL, query parameters, headers and body listed field by field, with JSON bodies pretty-printed
• Parse: the password in -u is masked, so the plaintext in your command never reappears on screen
• Parse: -k gets a banner of its own rather than blending in with ordinary options
• Build: first line "METHOD URL", body after a blank line (the .http format used by the VS Code REST Client)
• Build: single quotes escaped the shell way (`'\''`), so an apostrophe in the body cannot truncate the command
• Wrap long strings at 80 / 100 / 120 columns using the language's concatenation operator (PHP `.`, the rest `+`); wrapping changes how a string is written, never what it contains

How to use

1. Pick a direction: to code, parse, or build
2. To code: copy a curl command from your terminal or DevTools, paste it in, pick a target language
3. Parse: paste a curl command and see field by field what it really sends
4. Build: write "METHOD URL" on the first line, headers next, a blank line, then the body
5. If the code runs long, set wrapping to 80 or 100 columns
6. Comments at the top of the code list any options that were skipped
7. Copy the result and use it

FAQ

Why not just split the command on spaces?

Because a curl command is a shell command line, not a run of space-separated strings. The space in -d '{"a": 1}' is data, and the quotes in -H "X: a\"b" are escapes. Splitting on spaces cuts arguments in the wrong places, and the result is code that looks entirely normal and sends the wrong request — the hardest kind of bug to notice.

Why does the generated code contain comments?

Those record what the original command did that the generated code does not express directly: -k disabling certificate checks, -L following redirects, and options like --retry or --connect-timeout that make no difference to a single request. They are listed so you know how the code differs from the command, rather than having something quietly missing.

Are cookies and Basic auth supported?

Yes. Cookies from -b are split on semicolons and written as headers, and -u user:pass becomes each language's own auth idiom (the auth parameter in Python, SetBasicAuth in Go) rather than a hand-built Base64 Authorization header.

Does wrapping long strings change my data?

No. It only changes how a string is written, not what it contains: a 300-character URL is split into several pieces joined by that language concatenation operator (`.` in PHP, `+` in the other six), and joining them back gives the original character for character — there are tests pinning that. Two things are deliberately avoided: escape sequences are never split (`\"` broken into `\` and `"` turns the output into a syntax error), and quotes inside comments are never touched (the explanatory notes at the top contain quotes, and treating those as strings would wreck the comment). So you only need this when you are pasting into code with a line-length limit.

Is the command uploaded?

No. Parsing and generation happen in the browser and the page sends no requests — curl commands often carry Authorization headers and tokens, and none of it leaves the machine.

Why does Build use a text format instead of a form?

Because a form cannot express an arbitrary request body, and the body is exactly the part you want to copy and paste. The format is: "METHOD URL" on the first line (the method can be omitted, meaning GET), headers up to the blank line, body after it. That is the `.http` convention used by the VS Code REST Client and the JetBrains HTTP Client, not something invented here — and it has a side benefit, since you can paste a whole request straight out of documentation, a ticket or a colleague's message.

Why is the built command multi-line?

Two reasons. Each option is preceded by a backslash continuation (a backslash at the end of the line, the next line continuing) so a human can read it; that is perfectly legal pasted into a terminal or a script. And newlines inside the body are preserved verbatim inside single quotes — the shell allows a single-quoted string to span lines, curl accepts it, and not one character of the content changes. If you need to paste the result into something that only reads one line, join it yourself first. Collapsing the body to one line would change the data (newlines in JSON do not matter, but they can in signatures, plain text and form posts), so this tool keeps it faithful.

Why is the password masked in the parsed output?

Because this panel gets screenshotted, put on shared screens and left open in a browser session — the fact that you pasted something does not mean it should be displayed back to you. The password plays no part in any conversion (what actually matters is that curl Base64-encodes it into an Authorization header, and the tool says so right next to the row), so masking costs you nothing. One more thing worth saying out loud: Basic auth Base64 is not encryption, it is equivalent to plain text, so over HTTP it is broadcast.