• {{ e }}
  • {{ w }}
Choose JSON POST, Form POST, Basic Auth, Bearer Token, or Custom.
Select the shell you will paste into; quoting and line continuation change with this target.
Choose GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS.
Enter a full URL such as https://api.example.com/v1/items.
Use key=value pairs like limit=10&sort=updated, without a leading question mark.
Use None, Basic, Bearer Token, or API Key header; placeholder secrets are safest for sharing.
Enter the Basic Auth username, for example alice.
Use a placeholder until you are ready to copy the command locally.
Paste a token or placeholder; the generated command contains the visible value.
Use a header name such as X-API-Key, X-Auth-Token, or Authorization.
Use a placeholder for docs; paste the real key only at copy time.
Headers:
Choose a common header, then open its row to edit the exact name and value.
Use a header name such as Accept, Content-Type, or X-Request-ID.
Enter the value exactly as the server expects, for example application/json.
Select JSON for validation, Raw for literal payloads, or Form for key=value pairs.
{{ bodyHelp }}
Turn on for readable POSIX, Bash/Zsh, fish, or PowerShell output; CMD and Nushell stay single-line.
{{ multiline && supportsMultilineShell ? 'On' : 'Off' }}
Use Long for shared docs; Short keeps personal commands compact.
Only affects short flags that do not take values.
{{ combine_short_flags ? 'On' : 'Off' }}
Choose a preset client string, Custom, or curl default with no override.
Enter a full client string such as MyApp/1.2 (+https://example.com).
Use a full URL such as https://app.example.com/dashboard, or leave blank.
Enter a local path such as response.json, ./out.txt, or downloads/result.bin.
Turn on when the endpoint returns 301, 302, 307, or 308 redirects.
{{ follow ? 'On' : 'Off' }}
Use only for local testing or known test certificates; avoid for production calls.
{{ insecure ? 'On' : 'Off' }}
Use when the server supports gzip, br, or deflate and you want decoded output.
{{ compressed ? 'On' : 'Off' }}
Keep response bodies visible while making scripts fail on HTTP errors.
{{ fail_with_body ? 'On' : 'Off' }}
Turn on to inspect status lines, redirects, cache headers, and cookies.
{{ include_headers ? 'On' : 'Off' }}
Useful for scripts and CI logs that should not show progress meters.
{{ silent_errors ? 'On' : 'Off' }}
Use carefully with POST/PATCH/DELETE because retrying may repeat side effects.
{{ retry_all_errors ? 'On' : 'Off' }}
Best for local debugging; too noisy for most saved scripts.
{{ verbose ? 'On' : 'Off' }}
Use when testing connection setup or servers sensitive to reused sockets.
{{ no_keepalive ? 'On' : 'Off' }}
Useful when comparing DNS, connect, TLS, and response timing in debug output.
{{ trace_time ? 'On' : 'Off' }}
Turn on when documentation should show the HTTP method explicitly.
{{ force_x ? 'On' : 'Off' }}
Use only when the target supports HTTP/2; do not combine with HTTP/3.
{{ http2 ? 'On' : 'Off' }}
Use only when your cURL build and target both support HTTP/3; do not combine with HTTP/2.
{{ http3 ? 'On' : 'Off' }}
Enter seconds for --max-time, or 0 to leave the command uncapped.
s
Enter the --max-redirs count; 0 omits the limit.
Enter retry attempts for --retry, or 0 to omit retry behavior.
Enter seconds for --retry-delay; use 0 for cURL's default retry timing.
s
Enter seconds for --connect-timeout, or 0 to omit the connection cap.
s
Use values like 500k, 2M, or a plain byte-per-second number.
Paste one cURL command; unsupported flags stay out of the generated field model.
Command parser 

                


                

                                        

                      



                        
                        
                        
                    

                      

                    

                    

                        

                            
                                
                                
                                
                            
                            
                                

                                    Field
                                    Value
                                    Copy
                                

                            
                            
                                

                                    Shell
                                    {{ shellLabel }}
                                    
                                        
                                    
                                

                                

                                    Flag style
                                    {{ flagStyleDisplay }}
                                    
                                        
                                    
                                

                                

                                    Short flag combo
                                    {{ combineShortFlagsDisplay }}
                                    
                                        
                                    
                                

                                

                                    Method
                                    {{ method }}
                                    
                                        
                                    
                                

                                

                                    URL
                                    {{ finalUrl }}
                                    
                                        
                                    
                                

                                

                                    Headers
                                    {{ headerCount }}
                                    
                                        
                                    
                                

                                

                                    User-Agent
                                    {{ userAgentDisplay }}
                                    
                                        
                                    
                                

                                

                                    Referer
                                    {{ refererDisplay }}
                                    
                                        
                                    
                                

                                

                                    Body bytes
                                    {{ bodyBytes }}
                                    
                                        
                                    
                                

                                

                                    Flags
                                    {{ flagsList.join(' ') || '—' }}
                                    
                                        
                                    
                                

                                

                                    Retry policy
                                    {{ retrySummary }}
                                    
                                        
                                    
                                

                                

                                    Limit rate
                                    {{ limitRateDisplay }}
                                    
                                        
                                    
                                

                                

                                    Auth
                                    {{ authSummary || '—' }}
                                    
                                        
                                    
                                

                            
                        

                    

                


                

                                        

                      



                        
                        
                    

                      

                    

                    

                

            


        

    

                

                

                    

                        

                            Tags: Devtools, HTTP, Shell
                        

                        

                            
                            
                        

                    

                

            

        

    


                    
        

        

        

            

            
        

        


                    

                

                

                    

                                                                                

                                
                                    
                                        Wget Command Generator
                                                                                    Build a wget command for downloads, mirrors, API fetches, and FTP pulls with shell-aware quoting, import parsing, and safety warnings.
                                                                            
                                    
                                
                            

                                                                                

                                
                                    
                                        Netcat Command Generator
                                                                                    Build netcat and ncat commands for authorized connect, listen, scan, TLS, proxy, and transfer tasks with shell quoting and warnings.
                                                                            
                                    
                                
                            

                                                                                

                                
                                    
                                        Application Programming Interface (API) Testing Tool
                                                                                    Test browser-visible HTTP API requests with cURL import, auth, body modes, CORS failure clues, response traces, and local saved presets.
                                                                            
                                    
                                
                            

                                                                                

                                
                                    
                                        Hypertext Transfer Protocol (HTTP) Header Checker
                                                                                    Check a live URL's HTTP headers, redirect hops, cache semantics, cookies, CORS exposure, and hardening priorities from one report.
                                                                            
                                    
                                
                            

                                            

                

            

        
                                                                                                                                                                                                                                                        
        

        

            
            

                Customize

                

                    

                        

                            
                            
                        


                        

                            
                            
                        


                        

                            
                            
                        

                    


                    

                        Advanced

                        

                            

                                
                                

                                    
                                    
                                

                            


                            

                                
                                

                                    
                                    
                                

                            


                            

                                
                                

                                    
                                    :
                                    
                                

                            


                            

                                
                                

                                    
                                    
                                

                            


                            

                                

                                    
                                    
                                

                            


                            

                                

                                    
                                    
                                

                            


                            

                                
                                
                            


                            

                                
                                
                            

                        

                    

                

            

            
        


        

            
            
            
        


        
        

    

    

        

  

    
    
API instructions often travel as terminal text. A support note, runbook, README, incident ticket, or SDK example may need to show the exact HTTP request without assuming that the reader has the original client library, browser session, or test harness. curl is common in that space because it can express the request target, method, headers, authentication, payload, and transfer choices as a command that can be reviewed before it is run.

    
The hard part is not only choosing the right curl option. A shell reads the command first, so quotes, backslashes, carets, dollar signs, line breaks, and path characters can change the argument list before curl starts. A Bash example, PowerShell snippet, Windows CMD one-liner, and Nushell external command can represent the same HTTP request with different text.

    

      
Request target

      
The scheme, host, path, and query string decide where the request is sent.

      
Request metadata

      
Headers, User-Agent, Referer, and authentication fields describe the client and its credentials.

      
Request body

      
JSON, raw text, or form fields change both the bytes sent and the content type that a server expects.

      
Transfer behavior

      
Redirects, retries, timeouts, TLS checks, compression, output files, and protocol preferences affect how curl performs the transfer.

    

    

      HTTP request parts mapped into curl shell arguments
    

    
Small command choices can change the server-side result. JSON has to remain valid after shell parsing. Form fields need predictable name-value encoding. A redirect limit has no effect unless redirects are followed. Retry options can repeat a POST, PATCH, or DELETE request after the server has already acted on the first attempt.

    
Command snippets also carry secrets and operational intent. Tokens, passwords, private API endpoints, request bodies, output file paths, and trace settings can land in clipboard history, terminal history, downloaded scripts, screenshots, ticket comments, and shared URLs. Placeholder values are usually the safest draft form until the command is ready to run on the machine that owns the credential.

    
A generated curl command is a precise request draft, not proof that the API call will succeed. The final result still depends on the local curl build, TLS trust, server behavior, redirects, intermediaries, protocol support, and the permissions attached to the credentials used for the run.

  






  

    
How to Use This Tool:

    
Start with the request shape, then pick the shell that will receive the command. Make the shell choice before final copying because it changes quoting, line continuation, and path output.

    
    
      
  1. Choose a preset for JSON POST, form POST, Basic auth, bearer auth, or leave Custom selected. To start from an existing example, paste one curl command into Import existing cURL command and use Import Command.
    2. 
      
  2. Select Shell. The generator supports POSIX sh, Bash or Zsh, fish, Nushell, PowerShell, and Windows CMD, with multi-line output only where that target supports it here.
    3. 
      
  3. Set Method, URL, and optional Query string. The request target must be an absolute http or https URL.
    4. 
      
  4. Add headers from the header menu or edit the rows manually. Use Authentication for Basic auth, bearer tokens, or API-key headers so the auth summary stays visible.
    5. 
      
  5. Choose Body mode when the request sends data. JSON mode validates and minifies JSON, raw mode sends text as provided, and form mode emits only valid name=value pairs.
    6. 
      
  6. Open Advanced for flag style, short-flag combining, User-Agent, Referer, output file, redirects, TLS verification, compression, response headers, failure handling, retries, timeouts, rate limits, keep-alive, tracing, and HTTP/2 or HTTP/3 preference.
    7. 
      
  7. Fix errors before copying. Review warnings, then use cURL Command for runnable text, Request Fields for the audit table, or JSON for a structured snapshot.
    8. 
    

    
Imported commands should still be checked field by field. The parser handles many common curl options, but it is not a full shell interpreter and unsupported flags are not preserved as hidden behavior.

  






  

    
Interpreting Results:

    
Check the command preview as the text that will be copied. Use Request Fields as the audit view: it summarizes shell target, flag style, method, final URL, header count, User-Agent, Referer, body bytes, flags, retry policy, rate limit, and authentication state.

    
Errors mean generation stopped because a runnable command would be misleading or incomplete. Warnings mean a command exists, but one setting deserves attention before running it. Typical warnings cover ignored header lines, retry delay without retry attempts, retry-all-errors without retry attempts, redirect limits without redirect following, unusual rate-limit text, and GET requests with bodies.

    
    
      
  • If the final URL looks wrong, check whether the base URL already had a query string before adding the separate query field.
    • 
      
  • If the header count is lower than expected, check for a dedicated User-Agent or Referer value replacing a manual header with the same name.
    • 
      
  • If Body bytes is 0, no payload was generated because body mode is off, the body text is blank, or the selected body mode did not produce valid data.
    • 
      
  • If Flags omits a setting you expected, use the field table as the audit record because it reflects the emitted options.
    • 
      
  • If Auth is populated, treat the command as sensitive unless every credential-like value is a placeholder.
    • 
    

    
A protocol flag such as --http2 or --http3 requests curl behavior. It does not guarantee that the local curl build, network path, TLS negotiation, and server will complete the transfer with that protocol.

  






  

    
Technical Details:

    
curl receives a sequence of command-line arguments and maps them into a transfer. For HTTP and HTTPS, the core request pieces are the method, target URL, request headers, optional request body, and options that affect the transfer rather than the message itself. Shell parsing happens first, so the same logical header or JSON body has to survive the shell before curl can send it.

    
HTTP methods are not all interchangeable. GET and HEAD requests are usually retrieval-oriented, while POST, PUT, PATCH, and DELETE often have side effects or change server state. Retrying or redirecting those requests can be useful in scripts, but the caller has to know whether the endpoint is idempotent or whether repeating the request might create duplicate work.

    
Transformation Core:

    

      

        
        
          

            Stage
            Rule
            Audit cue
          

        
        
          

            Request target
            Accept an absolute http or https URL and append the raw query string after any existing query.
            URL and the host badge show the assembled target.
          

          

            Method
            Emit -X or --request when the method is not GET, when the request flag is forced, or when GET carries a body.
            Method and Flags reveal whether the method is explicit.
          

          

            Headers and auth
            Parse header rows, add Basic, Bearer, or API-key auth, then apply dedicated User-Agent and Referer values last.
            Headers, User-Agent, Referer, and Auth summarize the metadata.
          

          

            Body
            Use JSON, raw text, or URL-encoded form rules and emit the matching data arguments.
            Body bytes and data flags show payload handling.
          

          

            Transfer flags
            Add redirect, TLS, compression, failure, retry, timeout, rate-limit, output-file, tracing, keep-alive, and protocol switches.
            Flags is the compact transfer-behavior audit.
          

          

            Shell rendering
            Quote each argument for the selected shell and format multi-line output where supported.
            cURL Command changes when shell or flag style changes.
          

        
      

    

    
Body Mode Rules:

    

      

        
        
          

            Body mode
            Command behavior
            Content-Type behavior
          

        
        
          

            None
            No data argument is emitted.
            No body content type is added.
          

          

            JSON
            The JSON must parse successfully, then it is minified and sent with --data-raw.
            Content-Type: application/json is added when missing.
          

          

            Raw
            The entered text is sent with --data-raw.
            No content type is inferred.
          

          

            Form URL-encoded
            Valid name=value pairs split by newlines or ampersands become repeated --data-urlencode arguments; entries without = are skipped.
            Content-Type: application/x-www-form-urlencoded is added when missing.
          

        
      

    

    
Byte Count Core:

    
The body-size value is the UTF-8 byte length of the body text after the chosen body mode prepares it for the request-size cue.

    

      
        
          bodyBytes
          =
          |
          preparedBody
          |
          
            UTF
            8
          
        
      
    

    
JSON mode counts the minified JSON string. Raw mode counts the entered text. Form mode counts the entered form text even though only valid pairs become --data-urlencode arguments. The number helps spot a missing or unexpectedly large payload, but it does not prove that the server will accept the body.

    
Validation and Warning Rules:

    

      

        
        
          

            Condition
            Result
            Reason to review
          

        
        
          

            Relative, missing, or malformed URL
            Generation stops with an error.
            The request target must be an absolute HTTP or HTTPS URL.
          

          

            Invalid JSON body
            Generation stops with an error.
            Malformed JSON should not be hidden inside a copied command.
          

          

            Basic auth without username, or empty bearer/API-key values
            Generation stops with an error.
            A command with missing credential parts would be misleading.
          

          

            HTTP/2 and HTTP/3 both selected
            Only one protocol preference can be active.
            curl can be asked to prefer one protocol mode at a time in this command.
          

          

            Retry delay or retry-all-errors with zero retry attempts
            The command is generated with a warning.
            Those settings have no useful effect unless --retry is present.
          

          

            Redirect limit without redirect following
            The command is generated with a warning.
            --max-redirs limits redirects only when curl is following them.
          

          

            GET request with body data
            The command is generated with a warning.
            GET request content has no generally defined HTTP semantics and may be ignored or rejected.
          

        
      

    

    
The importer is quote-aware and maps common flags for methods, headers, auth, data, redirects, TLS checks, compression, failure handling, retries, timeouts, rate limits, output files, User-Agent, Referer, and HTTP version preference. It does not preserve arbitrary shell expansion, every curl option, or multipart upload semantics, so imported commands still need manual review.

  






  

    
Privacy and Safety Notes:

    
This tool builds command text and export views in the browser. It does not send the HTTP request. The sensitive part is the text you create, copy, download, or share afterward.

    
    
      
  • Use placeholder secrets while drafting examples for documentation, tickets, or chat.
    • 
      
  • Do not treat exports as scrubbed. Some credential fields are masked in the structured snapshot, but the runnable command can still contain live values.
    • 
      
  • Be careful with shared page URLs after entering tokens, passwords, API keys, private endpoints, or request bodies.
    • 
      
  • Avoid Insecure TLS for production calls because it disables certificate verification.
    • 
      
  • Use Retry all errors cautiously with methods that can create, modify, or delete server state.
    • 
    

  






  

    
Worked Examples:

    
For a JSON API POST, choose JSON POST, set the endpoint URL, keep JSON body mode active, and add bearer authentication if the API requires it. The command should include a JSON content type, an authorization header, a data argument, and the selected shell quoting around the JSON body.

    
For a URL-encoded form submission, choose Form POST, enter pairs such as name=Ada and email=ada@example.com, and switch to long flags when the command will be pasted into documentation. If you add three retry attempts and a two-second retry delay, the field table should show the retry policy before you copy the command.

    
For a support handoff from Unix to Windows, import the existing curl example, switch Shell to PowerShell or Windows CMD, and compare Method, URL, Headers, Body bytes, and Flags against the original intent.

    
For redirect troubleshooting, set Follow redirects before entering a Max redirects value. A redirect limit without redirect following suggests more behavior than curl will perform.

  






  

    
FAQ:

    

      Does this tool send the HTTP request?
      
No. It creates command text, field summaries, and exports. Nothing is sent until you run the generated command in your own shell.

    

    

      Why does shell choice matter?
      
Shells parse quotes, escapes, line breaks, and paths differently. Picking the target shell helps keep headers, JSON, tokens, URLs, and output paths intact when pasted.

    

    

      Can it create multipart file-upload commands?
      
No. The supported body modes are JSON, raw text, and URL-encoded form pairs. Multipart uploads need manual curl work.

    

    

      Will an imported command round-trip exactly?
      
Not always. The importer handles common curl shapes, but complex shell interpolation, unsupported options, and multipart upload flags require manual review.

    

    

      Are secrets hidden in the generated command?
      
No. The runnable command needs the values that curl will send. Use placeholders for shared drafts and paste live secrets only when you are ready to run locally.

    

    

      Does choosing HTTP/3 guarantee HTTP/3 will be used?
      
No. The command can ask curl to use HTTP/3, but success depends on the local curl build, TLS support, network path, and server configuration.

    

  






  

    
Glossary:

    

      
curl

      
A command-line transfer tool commonly used to make HTTP and HTTPS requests from a terminal or script.

      
HTTP method

      
The request verb, such as GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS, that tells the server what kind of action is being requested.

      
Header

      
A named request field such as Accept, Authorization, Content-Type, or User-Agent.

      
URL-encoded form data

      
A name-value body format where reserved characters are encoded for application/x-www-form-urlencoded requests.

      
Shell quoting

      
The escaping rules that keep spaces, punctuation, secrets, JSON, and file paths intact while a shell parses the command line.

      
Retry policy

      
The retry count, delay, and error coverage that control whether curl should attempt a failed transfer again.

    

  






  

    
References: