What the HTTP Request to Code Converter does
This converter turns a cURL command, or a raw HTTP request, into ready-to-run code for Python requests, JavaScript fetch, Node.js axios, C# HttpClient, Go net/http, PHP cURL and Java HttpClient - with tokens, passwords, API keys and cookies redacted by default and a note for anything a target library cannot do.
The usual source is a browser's "Copy as cURL" or an API's documentation, and both tend to carry a live session cookie or bearer token. The command is only read as text here: it is split into words the way Bash would split it, but never run, and it is not sent anywhere.
How to use it
- Paste a cURL command (multi-line commands with backslash continuations are fine) or a raw request starting with a line such as
GET /path HTTP/1.1. - Leave redaction on unless you are converting for your own machine and understand the risk; with it off, a warning stays on screen.
- Choose Convert and check the summary: method, URL, headers, body type and options such as
-kor-L. - Pick the language tab you need, copy or download the snippet, and read its notes - they explain anything that behaves differently from curl in that library.
- Replace each
[REDACTED]with a value loaded from an environment variable or secret store.
Reading the results
The summary is what the converter understood. If the method or body type is not what you expected, the command probably relies on a curl default: -d implies POST with form encoding, --json sets JSON headers, -G moves data into the query string, and -I means HEAD.
Conversion notes list options that were not converted (a proxy, client certificates, a cookie file), shell variables left as literal text, and placeholders for bodies curl would read from a file.
Per-language notes are about differences, not errors: fetch in a browser cannot send a Cookie header or skip certificate checks; Java's HttpClient refuses some headers and has no multipart builder; C# prefers a shared HttpClient.
Worked example: a JSON POST copied from API documentation
The first example is curl -X POST to https://api.example.com/v1/orders?dry_run=false with a JSON content type, a bearer token, an Idempotency-Key header, a --data-raw JSON body and --compressed. The body contains the phrase it's fine, written in Bash as '...it'"'"'s fine' - a closing quote, a double-quoted apostrophe and a reopening quote - which the tokenizer joins back into one word.
The summary reads POST, three headers and a JSON body. One secret is redacted - the Authorization header becomes Bearer [REDACTED] - while the idempotency key is kept because it is not a credential. Python receives the body as a json= dictionary, fetch as JSON.stringify(...), and C#, Go, PHP and Java as the original JSON string with a JSON content type.
Because the command has no -L, every snippet is set not to follow redirects, matching curl. The Python and Go notes point out that their clients already negotiate gzip, so --compressed needs no code there.
Options that are understood
-X/--request, -H/--header, -d/--data, --data-raw, --data-binary, --data-urlencode (all five forms), --json, -F/--form including @file;type=..., --form-string, -u/--user, --oauth2-bearer, -b/--cookie, -A, -e, -G/--get, -I/--head, -k/--insecure, -L/--location, --compressed, --max-time, --url, joined short flags such as -sSL, and --option=value. Output and logging flags such as -s, -v and -o are accepted and ignored.
Raw requests use the request line, the headers and anything after the blank line as the body. Host becomes the URL's host with https assumed, Content-Length is dropped because every library computes it, and Cookie is treated like -b.
Limitations: what the result does not prove
- Redaction recognises common credential shapes - authorization and cookie headers, API-key headers and query parameters, basic auth, JWTs and well-known key prefixes. A secret in an unusual header or field name can slip through, so read the code before sharing it.
- Files named with
@are not read. The code opens the same path, or contains a placeholder where curl would have inlined the file's contents. - Shell features other than quoting are not evaluated:
$VARIABLES, command substitution and globbing stay as literal text, and a pipeline is cut at the first|,;or&&. - The snippets show one request. Retries, connection reuse, streaming large responses and error handling are left to you.
Privacy: where your data goes
Everything you paste, type or drop is processed in this browser tab. It is not uploaded, logged, stored or sent to analytics. Session recording and tag-manager scripts are switched off on this page.
Standards and sources
- RFC 9110 HTTP Semantics - checked 19 Sep 2026
- curl manual (man page)
- Bash reference - Quoting
- RFC 7578 - multipart/form-data
Frequently asked questions
How do I convert a request copied from Chrome DevTools?
In the Network panel, right-click the request and choose Copy, then Copy as cURL (bash). Paste it here with redaction on: DevTools copies every cookie and authorization header the browser sent, which is usually more than the call needs.
Why does my converted fetch call fail in the browser but the curl command works?
Browsers enforce CORS and forbid some headers, including Cookie and Host, and cannot skip certificate checks. curl has none of those rules. The fetch notes say which parts of your request are affected; the same code usually works unchanged in Node 18 or later.
What is the difference between -d, --data-raw and --data-binary?
All three send a body. -d and --data-binary treat a value starting with @ as a file name; --data-raw never does. When reading a file, -d strips newlines and --data-binary keeps the bytes exactly. The converter follows the same rules for literal values.
Does it handle $'...' quoting and line continuations?
Yes. ANSI-C strings like $'line1\nline2' are decoded, backslash-newline and the Windows ^ continuation join lines, and nested quoting such as 'it'"'"'s' is read the way Bash reads it.
What does curl -k become in each language?
Python gets verify=False, axios an https agent with rejectUnauthorized: false, C# a dangerous certificate callback, Go InsecureSkipVerify and PHP the two SSL verify options - each with a warning. fetch cannot do it at all, and for Java the converter deliberately leaves it out.
Is the command executed or sent to a server to convert it?
No. It is split into words and converted by script in this page. No request is made to the URL in the command, and the text is not uploaded.
Last reviewed by the A2Z.Tools team against the sources listed above.
