Softonic

cURL Converter

Step 1 / 4cURL converter

Paste a cURL command

Maximum 256 KiB, 4,096 shell tokens, 200 headers, and 128 KiB of body data.

Turn a POSIX-style cURL command into browser Fetch, Node.js fetch, Python Requests or PHP cURL code without running the request. The converter understands common methods, repeated headers, inline bodies, URL-encoded fields, basic authentication, cookies, text-only multipart fields, redirects and compression. It blocks file-reading, certificate, proxy and output options, then shows exactly what was parsed before generating code. Commands up to 256 KiB stay inside your browser.

How it works

  1. 1

    Paste the command

    Add one POSIX-style cURL command. Shell quotes and escaped line continuations are parsed locally, not executed.

  2. 2

    Review the request

    Check the URL, method, headers, body, form fields, warnings and any blocked options.

  3. 3

    Choose a target

    Generate browser Fetch, Node.js fetch, Python Requests or PHP cURL code, then copy or download it.

What the converter preserves

The parser follows common POSIX shell quoting rules for a single cURL command. It supports -X/--request, repeated -H/--header, -d/--data/--data-raw, --data-urlencode, -u/--user, -b/--cookie, text-only -F/--form, -L and --compressed. Escaped line continuations are joined before tokenization. The official cURL man page notes that headers and form options may be repeated; this converter keeps their order while warning when a target library may collapse duplicate names.

cURL input Generated equivalent Important limit
-H 'Name: value' Target header collection Duplicate names may collapse
-d 'a=1' Text request body Multiple values are joined with &
--data-urlencode 'q=a b' Percent-encoded text body File-based variants are blocked
-F 'name=value' Text multipart field @file and <file are blocked
-L Redirect-following option Redirect security still depends on the runtime

Browser Fetch cannot set some forbidden request headers, including Cookie; when a cookie string is present, browser output uses credentials: "include" and warns that it is not an exact replacement. MDN documents Fetch as the browser interface for network requests. Generated code is only a starting point: CORS, credentials, redirects and server policy still apply.

Safety boundaries

The converter never executes the command or contacts its URL. Options that read local files, upload files, select client certificates, configure proxies, resolve hosts specially, or write transfer output are blocked. This includes @file body/header values, --upload-file, certificate/key options, proxy options and output/config/trace options. Unknown options are blocked rather than guessed.

Secrets can still appear in the generated code. Review basic-auth values, cookies and authorization headers before saving or sharing it. For Python, the output follows the Requests API conventions for method, headers, authentication and timeouts. PHP output uses curl_setopt_array; the PHP manual explains that each CURLOPT_* value configures the transfer handle.

Privacy and limits

Parsing and generation happen in Alpine inside this browser. The command, parsed request and code are never server-side properties and never enter a funnel URL. During the four-step flow, the command and selected target are stored for up to two hours in tab-scoped IndexedDB; starting over deletes the record. Bounds of 4,096 tokens, 200 headers and 128 KiB of body data prevent unbounded parsing. The tool handles one HTTP or HTTPS URL and does not emulate a complete shell or every cURL option.

Frequently Asked Questions

No. It tokenizes and translates the text locally. It never sends the request, resolves the host, opens a proxy or reads a referenced file.

File, certificate, proxy, custom resolution, output and trace options can cross the safe text-only boundary. The converter blocks them instead of pretending the generated code is equivalent.

Browser JavaScript cannot set the Cookie header directly. Browser output uses credentials: include, which sends cookies already held for an allowed same-site or CORS request.

No. Commands stay in browser memory and temporary IndexedDB during a funnel. However, generated code can contain the same secrets, so remove them before sharing or committing it.

Related Tools

ASCII Table Reference

Full ASCII table from 0 to 127 with decimal, hex, octal, binary, standard names and HTML numeric-reference notation, including NUL, LF and DEL.

Color Palette Generator

Generate monochromatic, analogous, complementary, triadic or tetradic color palettes from a base HEX color and export copy-ready CSS variables.

HEX Color Picker

Pick or enter a HEX colour and get RGB, HSL, approximate CMYK, relative luminance and contrast ratios against white and black.

HTML Character Reference

Searchable list of HTML entities, their named and numeric codes, and a one-click copy for special characters and symbols.

JSON Formatter

Paste JSON to pretty-print with 2 or 4 spaces, minify it to compact output, or run a quick syntax check before copying the result.

Phone Validator

Validate phone numbers by country, detect the region and type, and normalize valid numbers to E.164, international, national and RFC 3966 formats.

Tool available in other languages