About this tool
A curl command is the common language of API bug reports, but quoting it correctly is fiddly: single quotes inside JSON break bash, cmd.exe treats & and % specially, and PowerShell aliases curl to something else entirely. This generator builds the command from a form (method, URL, query parameters, headers, Basic/Bearer/API-key auth, JSON, form-encoded or raw body, and -i, -L, --compressed, -k and timeout options) and quotes it correctly for bash, Windows cmd and PowerShell 7.3+. The same request is also rendered as JavaScript fetch, a Playwright APIRequestContext test, Python requests and a REST Assured given/when/then chain. The Parse tab works the other way: paste a curl command, including browser “Copy as cURL” output, and it fills the form.
How to use it
- Fill in the method and URL, then add query parameters, headers, authentication and a body. Untick a row to leave it out without deleting it.
- Pick an output: cURL for your shell, or fetch, Playwright, Python or REST Assured, and copy it.
- To convert an existing command, switch to “Parse cURL”, paste it and click “Parse into form”. Unsupported options are listed rather than silently dropped.
cURL Command Generator FAQ
Why does my curl command work in bash but fail in Windows?
cmd.exe does not understand single quotes, and PowerShell 5.1 maps curl to Invoke-WebRequest and strips embedded double quotes from native arguments. Use the cmd variant (double quotes with caret escaping) or the PowerShell 7.3+ variant, which calls curl.exe explicitly.
What is the difference between -d, --data-raw and --data-binary?
-d treats a leading @ as a file name and strips newlines from files; --data-raw sends the string exactly, even if it starts with @; --data-binary sends file contents without stripping newlines. All three imply POST and form Content-Type unless you set one.
Is it safe to use -k in tests?
Only against local or test environments with self-signed certificates. -k disables certificate verification, so a test using it would not notice an expired or mismatched certificate that real clients reject.