cURL to Code Converter

About cURL to Code Converter

The cURL to Code Converter takes a command you already have — copied out of an API’s documentation, or out of your browser’s network panel with Copy as cURL — and rewrites it as the same request in Python, JavaScript, Node.js, Go, Java, C#, or PHP. It does not pattern-match the text: the command is tokenized the way a shell would tokenize it, so quotes group, backslashes escape, and a JSON body full of spaces and braces survives intact. Then curl’s own implicit rules are resolved once — that -d means POST and form-urlencoded, that -F means multipart, that -G moves the body into the query string — before any code is written, which is why all seven outputs describe the same request rather than seven slightly different ones. A JSON body comes out as a native dict, object or array you can edit, not as an escaped string you have to unpick. Everything runs in your browser, so the token in that Authorization header never leaves your machine.

Key features

• Seven targets from one command: Python requests, browser JavaScript fetch, Node.js axios, Go net/http, Java 11+ HttpClient, C# HttpClient, and PHP cURL
• Standard-library output where a standard library exists — the Go, Java and C# snippets pull in no third-party packages at all
• A real shell tokenizer — single quotes, double quotes, $’…’ ANSI-C quoting, backslash escapes and line continuations are all handled, so a pasted multi-line command works as-is
• Reads the Windows shapes of Copy as cURL too: cmd.exe with ^ continuations and doubled "" quotes, and PowerShell with backtick continuations
• Method inference matching curl’s own: -d implies POST, -F implies POST, -T implies PUT, -I implies HEAD, and an explicit -X always wins
• Body kinds recognised and expressed idiomatically — JSON as a native structure, form data as URLSearchParams or url.Values or an array, multipart as FormData or CURLFile or multipart.Writer, and a raw body left exactly as written
• -u becomes each language’s auth idiom: a requests tuple, an axios auth object, Go’s SetBasicAuth, C#’s AuthenticationHeaderValue, a Java Base64 encoder, CURLOPT_USERPWD, and for browser fetch the base64 Authorization header it would have produced
• Go imports, C# usings and Java imports are each computed from what the snippet actually uses, so nothing arrives unused or missing
• -G with --data-urlencode is folded into the query string, decoded back into readable key/value pairs
• Redirect behaviour is always stated explicitly, because curl and the seven clients disagree about the default — curl needs -L, requests, fetch, axios, Go and C# follow regardless, and Java refuses unless asked
• Flags that cannot survive the translation are reported rather than dropped in silence: client certificates, DNS overrides, Unix sockets, cookie files
• A summary row showing the method, host, header count, body kind and any warning, so you can check the parse before you trust the code
• Copy to clipboard or download as a .py, .js, .go, .java, .cs or .php file — and nothing you paste is uploaded

How to use it

1. Paste your cURL command into the left pane, replacing the sample. A multi-line command with backslashes at the end of each line is fine.
2. Pick your target language from the selector in the toolbar.
3. Read the badges under the panes to confirm the method, host, headers and body kind were parsed the way you expected.
4. Read the generated code on the right — it re-runs on every keystroke and every change of language.
5. Copy it, or download it as a file, and replace any credentials with a variable before you commit it.

Tips & common mistakes

• The fastest way to get a command worth converting is your browser: open the network panel, right-click the request, and choose Copy as cURL. It captures the exact headers and cookies the page sent, which is usually what you were trying to reproduce.
• Check the redirect line before you ship the snippet. Every generated snippet states it, because curl and the client libraries disagree: curl does not follow a 301 unless you pass -L; requests, fetch, axios, Go’s http.Client and .NET’s HttpClient all follow by default; and Java’s HttpClient follows nothing unless you ask it to. A POST that silently follows a redirect is turned into a GET by most servers, which is a genuinely confusing bug to chase.
• Anything you paste stays in the browser, but the code you copy out does not. A command copied from a browser carries session cookies and bearer tokens — move them into an environment variable before the snippet reaches a repository.
• A JSON body is re-emitted as a dict, object or PHP array in the languages that have a literal syntax for one — Python, JavaScript, Node and PHP. That is deliberate: it is the form you will want to edit, and it removes a whole class of escaping bugs. Go, Java and C# have no such literal, so they get a string that needs no escaping instead: a Go backtick literal and a C# verbatim string. Either way, a body that is not valid JSON is kept exactly as written.
• For browser fetch, -k has no counterpart and is reported instead of quietly ignored. A page cannot turn off certificate verification — that is the browser’s decision, not the script’s. Node, Python, Go, C# and PHP all can, and their snippets do. Java can too, but only by building an SSLContext by hand, so the snippet says where to put it rather than printing twenty lines you did not ask for.
• The C# snippet puts Content-Type on the content object, never on request.Headers. That split trips up almost everyone writing HttpClient for the first time: .NET refuses to attach a content header to a request, and TryAddWithoutValidation drops it silently rather than throwing, so the request goes out with no type at all and the server answers 415.
• Java gets a hand-built multipart body because java.net.http has no builder for one. It is more code than the other targets, and it is the code you would have had to write yourself — boundary, part headers, CRLFs and the closing delimiter — against a stock JDK with no dependency added.
• A multipart Content-Type header from the original command is deliberately dropped. The header has to carry the boundary that the client generates for the body it just built, so copying the old one across would describe a body that no longer exists.
• Data read from a file with -d @payload.json cannot be inlined, because the file is on your machine and this tool never sees it. The snippet opens the file by name instead, which is almost always what you wanted.
• The converter reports what it cannot carry across rather than pretending. A client certificate, a --resolve DNS override, a Unix socket, or a cookie jar on disk are all configuration of the transport that no short snippet can express — they appear as a warning so you can add them yourself.
• If the parse looks wrong, check the quoting first. A command that was pasted through a chat client often loses its backslashes or has its quotes turned into typographic ones, and no shell would read that command the way you intended either.

Related tools