cURL Converter: Convert cURL Commands to Code

A cURL converter translates a curl command into request code for a programming language or HTTP client. It is useful when API documentation, a terminal workflow or browser developer tools give you a cURL example but your application uses Python, JavaScript, Go, PHP or another client.

Use generated code as a draft. Before committing it, verify the HTTP method, complete URL, headers, cookies, authentication, body encoding, redirects, TLS behavior, timeouts and file handling. cURL supports a large set of options, and converters differ in the languages and flags they understand. The official cURL man page is the reference for what each option does.

What a cURL converter does

A converter parses command-line arguments into request components and formats those components for a target library. A command such as:

curl -X POST "https://api.example.com/users" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"name":"Ada"}'

usually becomes code that sets the URL, method, headers and JSON body in the selected client.

There is no single universal code representation. One converter may emit browser fetch, another Axios, Python requests, PHP or Go. Some advertise support for everyday flags rather than every cURL option. Parsing can also differ from your shell’s behavior, especially when commands contain variable expansion, command substitution, unusual quoting, binary data or multiple files.

Convert a cURL command step by step

1. Copy the complete command. Include the HTTP method, URL, query string, headers, cookies, body and relevant transfer options. If the command spans lines, preserve the continuation characters while copying, then remove them only where the converter expects a single line.
2. Remove secrets before using an online converter. Replace API keys, bearer tokens, cookies, passwords, signed URLs, private hostnames and sensitive payloads with placeholders. cURL verbose output can contain credentials or other secret data. Check a service’s processing and retention terms before sending command text to it; claims that parsing happens locally are publisher claims rather than an independent audit.
3. Select the actual target. Choose the language and client used by your project, such as Python with requests or JavaScript with fetch. Do not choose a language merely because it is available if your runtime has different timeout, proxy or TLS defaults.
4. Generate and inspect the result. Compare every request component with the original. Treat the output as a starting point, particularly when the command uses files, multipart forms, repeated options or less common flags.
5. Run it with test credentials. Execute it in a development environment, log status and response metadata safely, and compare the response with the known-good cURL request.
6. Harden the code. Move secrets to environment variables or a secret manager, set explicit timeouts, handle non-2xx responses, and avoid logging authorization headers or complete request bodies.

Conversion review checklist

Area	What to verify
Method	GET, POST, PUT, PATCH, DELETE or another method is preserved. A body does not always imply POST.
URL	Scheme, host, path, query parameters, fragments and URL encoding match exactly.
Headers	All headers and values are present. Check repeated headers, Content-Type, Accept, Authorization, Host and custom tracing headers.
Cookies	Cookie names, values and domains are represented safely. Prefer a cookie jar or session rather than hard-coding production cookies.
Body	Confirm whether data is form encoded, JSON, raw bytes, URL encoded or multipart. Repeated --data options can have special behavior.
Files	Check upload paths, field names, MIME types and multipart boundaries. A generated string is not equivalent to opening a file in binary mode.
Authentication	Verify basic auth, bearer tokens, client certificates, signed headers and environment-variable expansion.
Redirects	Options such as -L affect whether redirects are followed and how methods or credentials are handled.
TLS and proxy	Review certificate verification, client certificates, proxy settings and insecure flags. Do not silently carry -k into production.
Timeouts and retries	Set connect, read and total timeouts in the target library. cURL retry flags do not automatically map to equivalent application retry policy.
Compression and output	Check compressed responses, binary output, response files and whether the target library automatically decodes content.

Runnable conversion examples

Source cURL command

curl -X POST "https://api.example.com/v1/widgets?dry_run=true" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  --data '{"name":"demo","enabled":true}'

Python with requests

import os
import requests

url = "https://api.example.com/v1/widgets"
params = {"dry_run": "true"}
headers = {
    "Authorization": f"Bearer {os.environ['API_TOKEN']}",
    "Content-Type": "application/json",
    "Accept": "application/json",
}
payload = {"name": "demo", "enabled": True}

response = requests.post(
    url,
    params=params,
    headers=headers,
    json=payload,
    timeout=(10, 30),
)
response.raise_for_status()
print(response.json())

Using json= lets requests serialize the object and set the appropriate body encoding. If the original uses an exact raw payload, use data= and preserve that text instead.

JavaScript with fetch

const token = process.env.API_TOKEN;
const controller = new AbortController();
const timer = setTimeout(() => controller.abort(), 30_000);

try {
  const response = await fetch(
    'https://api.example.com/v1/widgets?dry_run=true',
    {
      method: 'POST',
      headers: {
        authorization: `Bearer ${token}`,
        'content-type': 'application/json',
        accept: 'application/json'
      },
      body: JSON.stringify({ name: 'demo', enabled: true }),
      signal: controller.signal
    }
  );

  if (!response.ok) {
    throw new Error(`HTTP ${response.status}: ${await response.text()}`);
  }
  console.log(await response.json());
} finally {
  clearTimeout(timer);
}

Browser and server-side fetch have different capabilities. Browser JavaScript cannot freely set some protected headers, use arbitrary client certificates or bypass cross-origin rules. A Node.js process does not have those browser restrictions, but it still needs explicit timeout and error handling.

cURL equivalent for a JSON request

curl -X POST "https://api.example.com/v1/widgets?dry_run=true" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  --data '{"name":"demo","enabled":true}'

Common cURL options and their code equivalents

cURL option	Meaning	Review point
-X, --request	Sets the HTTP method.	Set the method explicitly in the target client when it is not the default.
-H, --header	Adds a request header.	Preserve repeated headers and avoid accidentally combining values.
-d, --data	Sends data as provided.	The cURL documentation says cURL does not convert, change or improve the data. Preserve exact encoding when required.
--data-urlencode	URL encodes data before sending.	Do not URL encode a second time in application code.
-F, --form	Sends multipart form data.	Open files and let the client create boundaries and content length.
-u, --user	Supplies basic authentication credentials.	Use the target library’s auth facility and keep credentials outside source code.
-b, --cookie	Sends cookies or reads a cookie file.	Use a session or cookie jar when responses set additional cookies.
-L, --location	Follows redirects.	Check redirect limits and whether credentials may be forwarded.
--compressed	Requests and decodes compressed responses.	Most modern clients negotiate compression automatically; verify decompression behavior for binary data.
--connect-timeout, --max-time	Limits connection or total time.	Map these to connect, read and total timeout controls.
-k, --insecure	Skips TLS certificate verification.	Use only for controlled local diagnosis; fix certificates in production.
-o, --output	Writes response bytes to a file.	Use binary-safe file APIs and do not assume the response is text.
-v, --verbose	Prints transfer diagnostics.	Redact logs because verbose output can expose credentials and sensitive data.

Shell quoting and variables

A converter receives command text, while your shell normally performs expansion before cURL runs. That distinction causes many translation errors.

• In POSIX shells, '$TOKEN' is literal text, while "$TOKEN" expands the variable. Preserve the intended value in application code with an environment lookup.
• Command substitution such as $(cat payload.json) must be replaced by an explicit file read or string construction.
• Windows PowerShell quoting and escaping differ from Bash. A command copied from one shell may not parse identically in another.
• JSON quotes, newlines and backslashes can be altered by multiple parsing layers. Prefer structured JSON objects where the target library supports them, then compare the serialized bytes when exact fidelity matters.

Multipart uploads and binary data

For a command such as:

curl -X POST https://api.example.com/upload \
  -H "Authorization: Bearer $API_TOKEN" \
  -F "description=demo" \
  -F "file=@./report.pdf;type=application/pdf"

the equivalent Python should open the file in binary mode:

import os
import requests

with open("./report.pdf", "rb") as file_obj:
    response = requests.post(
        "https://api.example.com/upload",
        headers={"Authorization": f"Bearer {os.environ['API_TOKEN']}"},
        data={"description": "demo"},
        files={"file": ("report.pdf", file_obj, "application/pdf")},
        timeout=(10, 120),
    )
response.raise_for_status()

Do not manually copy a multipart boundary from a captured request. Let the client generate it, and do not set a conflicting Content-Type header.

Choosing a converter

Axis	Questions to ask
Target support	Does it emit the language and client your project uses, such as fetch, Axios, Python requests, PHP or Go?
Flag coverage	Does it handle your exact data, auth, redirect, file and form options, or only common flags?
Privacy	Is parsing local, or does command text reach a server? What do the service’s terms say about logging and retention?
Transparency	Can you inspect parsed URL, headers, body and authentication separately before copying code?
Workflow	Would a local package, command-line tool or library integration fit better than a browser page?

Feature lists and local-processing statements are claims made by the respective tool publishers. The available research does not establish a universal accuracy ranking or prove that every converter preserves every cURL behavior.

Troubleshooting converted code

401 or 403 after conversion

Cause: a token, cookie, basic-auth value or signature was omitted, changed by shell expansion or sent in the wrong header.

Fix: compare the authorization header byte for byte, load the secret from the correct environment variable, check clock-dependent signatures and confirm whether redirects removed credentials.

400 or 415 response

Cause: the body encoding or Content-Type differs from cURL. Common examples are JSON sent as form data, double URL encoding or a manually copied multipart boundary.

Fix: use the target client’s JSON, form or multipart API and inspect the final outgoing body.

Different query parameters

Cause: parameters were concatenated without encoding, encoded twice or moved into a body.

Fix: use a URL or query-parameter builder and compare the final URL, including repeated keys and empty values.

Redirect loop or unexpected method

Cause: redirect-following defaults differ between cURL and the target client, or a redirect changes how a method and body are replayed.

Fix: enable redirects deliberately, set a maximum, and inspect each response’s Location header.

Certificate or TLS failure

Cause: cURL and the application use different trust stores, client certificates, proxies or hostname checks.

Fix: install the correct CA chain or configure the documented certificate options. Avoid disabling verification as a permanent fix.

Timeouts or hanging requests

Cause: the generated code has no timeout, only a connect timeout, or waits indefinitely while reading a response.

Fix: configure connect and read or total timeouts, cancel requests when the caller disconnects, and add bounded retries only for operations safe to repeat.

File upload is empty or corrupted

Cause: a path was sent as text, the file was opened in text mode or the multipart content type was assembled manually.

Fix: open the file as bytes, pass it through the client’s multipart API and verify the field name and MIME type.

Works in cURL but fails in browser JavaScript

Cause: browser security rules such as CORS and forbidden headers apply to page JavaScript.

Fix: call the API from a server you control, configure the API’s CORS policy, or use the browser-supported subset of headers and methods.

Performance, reliability and cost

• Use connection reuse. A Python Session or a long-lived Node HTTP client can avoid repeated TCP and TLS setup.
• Set bounded timeouts. Separate connection, read and total limits so a stalled upstream does not consume workers indefinitely.
• Retry carefully. Retry transient network failures and selected 5xx responses with exponential backoff. Do not blindly retry non-idempotent POST requests unless the API offers idempotency keys.
• Limit response memory. Stream large downloads to disk instead of building a full response string.
• Reuse converted code. Keep one reviewed request function rather than running a converter at application runtime.
• Account for service billing. Your HTTP client, API provider and converter may each have separate costs. A converter’s advertised convenience does not establish accuracy, latency or price advantages.
• Measure the final client. Compare status, headers, body bytes and latency against the original cURL request in a controlled environment.

Or skip the browser setup

If the request you need is a website screenshot, ScreenshotNeo provides a direct HTTP endpoint instead of requiring you to install and operate a browser. One GET request returns a PNG, JPEG, WebP or PDF. The same request can be copied into a converter and reviewed like any other cURL command.

See the ScreenshotNeo API documentation for the complete option list. This cURL example captures Stripe as WebP:

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp

Python

import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)

Node.js

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' }); const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);

ScreenshotNeo removes cookie banners, newsletter popups and chat widgets before capture. Bot checks, blank pages, failed loads and cache hits are not billed, and response headers identify the page verdict and billing result. Its MCP server lets Claude, Cursor and other MCP clients call take_screenshot, get_page_info and capture_pdf. Every feature is included on every plan; 1,000 screenshots per month are free with no card, and paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.

FAQ

Does a converter reproduce every cURL command exactly?

No. Support varies by target and flags, so inspect generated code and test it against the original request.

Should I paste a production command into an online converter?

Redact credentials, cookies, private URLs and sensitive payloads first, and review the converter’s data-handling terms.

Which target should I choose for a web app?

Use browser fetch only when the API permits the request under browser security rules. Put secrets and unrestricted requests in a server-side client.

How can I prove the conversion is correct?

Run both versions with the same test inputs and compare method, URL, headers, body bytes, status, response headers and response content.

Where are cURL’s option definitions documented?

Use the official cURL man page for option semantics, then consult the target client’s documentation for its timeout, TLS, streaming and retry behavior.