Hunt
Skip to content

cURL Converter

Paste a curl command, from your browser's dev tools or an API's documentation, and get working code for JavaScript fetch, Node.js, Axios or Python requests. Headers, JSON bodies, form uploads, basic auth and timeouts are converted, with notes on anything that can't be.

Runs in your browser

cURL command

Paste a command or press Sample

Code

The code will appear here

What this tool does

API documentation shows requests as curl commands, and browsers can copy any request as one (right-click a request in the Network panel, then Copy, then Copy as cURL). Turning that into code by hand means re-typing every header and escaping the body. This tool reads the command the way a shell would and writes the equivalent code.

The command never leaves your browser. That matters, because copied requests often contain session cookies or API tokens.

How to use the cURL Converter

  1. Paste a curl command, or press Sample. Multi-line commands with \ line continuations work.
  2. Choose the target: JavaScript (fetch), Node.js (fetch), Axios or Python (requests).
  3. Read the notes below the code for anything that couldn't be converted exactly.
  4. Copy the code or download it as a file.

Examples

A GET request with headers, as fetch

Input
curl 'https://api.example.com/users?page=2' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Accept: application/json'
Output
const response = await fetch("https://api.example.com/users?page=2", {
  headers: {
    Authorization: "Bearer YOUR_TOKEN",
    Accept: "application/json",
  },
});

const data = await response.json();
console.log(data);

A JSON POST, as Python requests

Input
curl -X POST https://api.example.com/users \
  -H 'Content-Type: application/json' \
  -d '{"name": "Ada", "admin": true, "manager": null}'
Output
import requests

response = requests.post(
    "https://api.example.com/users",
    json={
        "name": "Ada",
        "admin": True,
        "manager": None,
    },
)

print(response.json())

true and null become Python's True and None, and json= sets the Content-Type header for you.

Basic auth and a timeout, as Axios

Input
curl -u ada:secret --max-time 10 https://example.com/report
Output
import axios from "axios";

const response = await axios({
  method: "get",
  url: "https://example.com/report",
  headers: {
    Authorization: "Basic YWRhOnNlY3JldA==",
  },
  timeout: 10000,
});

console.log(response.data);

-u becomes an Authorization header with the Base64-encoded user:password. Base64 is an encoding, not encryption: anyone who sees the header can read the password.

What is converted

  • Method and URL: -X, --url, -G (data appended to the query string) and -I (HEAD). Without -X, a request with data becomes a POST, as in curl.
  • Headers: -H, plus -b (cookies), -A (user agent) and -e (referer), which become headers.
  • Bodies: -d, --data-raw, --data-binary, --data-urlencode and --json. JSON bodies become objects (JSON.stringify(…) for fetch, json= for Python), with values copied exactly.
  • Forms: -F name=value and file uploads (-F file=@photo.jpg) become FormData or files=.
  • Auth and options: -u user:password becomes a Basic Authorization header (or auth= in Python), --max-time a timeout, and -k the closest equivalent where one exists.
  • Shell syntax: single and double quotes, backslash line continuations and $'…' strings, as produced by Chrome, Firefox and Safari.

Browsers are stricter than curl

curl can send anything; JavaScript in a browser can't. The JavaScript (fetch) output is meant for a web page, so the tool warns about the differences:

  • Some headers, including Cookie, User-Agent, Referer and Host, can't be set by JavaScript. The browser adds its own.
  • A request to another site only succeeds if that site allows it with CORS headers. If it doesn't, call the API from your server (the Node.js or Python output) instead.
  • Certificate checks can't be turned off (-k).

Options

Convert to
JavaScript (fetch) for browsers; Node.js (fetch) for Node 18 and later, where fetch is built in and browser restrictions don't apply; Axios; or Python's requests library.

Limitations

  • The command is read as a bash command line. Windows cmd syntax (^ line continuations) isn't supported; in Chrome, use Copy as cURL (bash).
  • Reading files with -d @file or -T isn't converted; the file name appears as text.
  • Less common options (proxies, client certificates, cookie jars, retries) are listed in the notes but not converted.
  • fetch, Axios and requests follow redirects by default; curl only does with -L.

Frequently asked questions

Is my command sent to a server?

No. The command is converted entirely in your browser. That matters, because copied requests often contain session cookies and API tokens.

How do I copy a request as cURL?

In Chrome, Edge or Firefox, open the dev tools, go to the Network panel, right-click the request and choose Copy, then Copy as cURL (in Chrome, choose the bash version). In Safari, right-click the request and choose Copy as cURL.

Why does the fetch code fail with a CORS error?

curl ignores CORS; browsers enforce it. A page can only read a response from another site if that site sends the right Access-Control-Allow-Origin headers. If it doesn't, make the request from your server instead, using the Node.js or Python output.

Should I keep the token in my code?

No. Copied commands contain real credentials. Move tokens to environment variables or a secrets manager before committing the code, and rotate any token you've shared by accident.