Curl Command Converter: Convert cURL to Fetch, Python, Go, and PHP

How to use

1. Paste a curl command into the input. The page loads with a POST example containing a URL, headers, JSON data, and Basic auth.
2. Review the parsed method, base URL, query parameters, headers, cookies, authentication, body, ignored flags, and unconvertible parameters.
3. Copy the generated Fetch, Python, Go, or PHP code block.

What the converter parses

Copy a request from the Chrome DevTools Network panel and inspect it locally in the browser. The converter supports POSIX single and double quotes, escaped characters, backslash line continuations, and bare words. It recognizes request options including -X/--request, -H/--header, -d/--data, --data-raw, --data-urlencode, --data-binary, -F/--form, -G/--get, -u/--user, -b/--cookie, user-agent and referer options, redirect and TLS options, --compressed, and --url.

The request-details view separates the URL path from its query table, preserves query pairs in order, and keeps duplicate entries visible. Cookies from -b and Cookie headers are combined in source order; generated request headers use the last value for a duplicate cookie name. An explicit Cookie header is shown as cookie data rather than duplicated as a separate generated header.

Data, encoding, and request-body rules

Repeated data options are joined with & in command order. --data, --data-raw, and --data-binary preserve the supplied text. --data-urlencode keeps the text before the first = as the name and applies JavaScript encodeURIComponent to the value; an argument without = is encoded as one query component when used with -G.

If data or form fields are present and no explicit method was supplied, the parser sets the method to POST. In curl, -d uses POST by default and its conventional content type is application/x-www-form-urlencoded; this converter preserves the joined body text and does not invent a missing Content-Type header. With -G, data is moved into the URL query and the body is removed. Existing query text remains, and new data is appended.

-F is displayed as multipart/form-data, with each form item split at its first =. Generated browser FormData code lets the runtime create the multipart boundary. Do not add a fixed multipart Content-Type boundary to the Fetch output.

Basic authentication

-u user:password is represented as Basic authentication. The generated Authorization value is Basic followed by the Base64 encoding of user:password, shown as base64(user:password); Base64 is an encoding, not encryption. The implementation encodes the credential string as UTF-8 bytes before browser Base64 conversion. A password may contain additional colons because the credential is split at the first colon. Treat copied credentials, bearer tokens, and cookies as secrets.

Runtime notes and limitations

This is a bounded curl command parser, not a Bash interpreter or a complete curl implementation. Variable expansion such as $TOKEN, command substitution such as $(command), backtick substitution, pipelines, and redirection produce a specific unsupported-shell-feature error with a token location. Unknown options are listed under “Unconvertible parameters” instead of being silently discarded. Local output flags such as -s, -S, -v, -o, -O, and -w are listed separately as ignored flags.

Redirect and TLS behavior can differ by runtime. The generated Fetch example uses redirect: "follow" for -L and redirect: "error" otherwise, approximating curl’s default; browser Fetch may also be blocked by CORS or restricted request headers. A normal browser page cannot disable TLS verification for -k, so the Fetch output warns about that limitation. Python requests uses allow_redirects and can represent verify=False; Go uses an explicit redirect policy and can configure an insecure TLS transport; PHP uses CURLOPT_FOLLOWLOCATION and the corresponding insecure TLS settings. Compression handling remains runtime-dependent and browsers generally handle response decompression internally.

FAQ

What is a curl command converter?

It turns a supported curl command into a structured request summary and equivalent-looking code for JavaScript Fetch, Python requests, Go net/http, and PHP cURL. This converter also exposes query pairs, headers, merged cookies, authentication, body type, ignored local flags, and unconvertible parameters.

How do I copy a request as cURL from Chrome DevTools?

Open Chrome DevTools, go to the Network panel, select the request, open its context menu, and choose “Copy” followed by “Copy as cURL.” Paste the copied command into the converter. The page supports the quoted and continued-line forms used by the parser.

How do I convert cURL to Python requests?

Paste the command and copy the Python requests block. The generated call uses named request arguments such as method, URL, headers, data, auth, redirect handling, and TLS verification when those values apply. Review warnings and unconvertible parameters before using it.

How does --data-urlencode differ from --data?

Ordinary data preserves its supplied text. --data-urlencode percent-encodes the value after the first =; with -G, the encoded result is appended to the query. For example, spaces and ampersands in a value become encoded characters rather than changing the query structure.

Why does curl data default to POST and form encoding?

Curl treats request data as POST data when no explicit method is supplied. Its conventional default content type is application/x-www-form-urlencoded. This converter follows the method inference and preserves repeated data by joining parts with &; an explicit -X remains in control.

How are cookies from -b and the Cookie header combined?

Both sources are parsed as semicolon-separated name=value pairs and displayed together in source order. Values are split at the first =, so a value can contain another equals sign. For duplicate names, the last value becomes the effective value in generated headers while all parsed pairs remain inspectable.

Can browser Fetch reproduce curl’s -k insecure TLS option?

No. A normal browser page cannot turn off TLS certificate verification. The generated Fetch code includes a warning instead of claiming that -k was reproduced. Python, Go, and PHP outputs can express insecure TLS settings, but using them reduces connection security.

Why can generated code differ from curl?

Fetch may encounter CORS and browser header restrictions. Redirect defaults differ across curl, Fetch, Requests, and Go, so the outputs set or document redirect behavior. Compression is handled by the target runtime, and multipart boundaries are generated at runtime rather than copied as a fixed string. Shell expansion and unknown curl options are outside this converter’s supported language.

Privacy reminder

Copied browser commands can contain bearer tokens, cookies, URLs with private data, and Basic credentials. Inspect the output carefully and avoid sharing sensitive command text. This tool processes the input in your browser without sending or saving the command.