Curl Command Builder
Turn a form into a correct curl command — POSIX-quoted values, per-flag explanations, and a round-trip check — entirely on this device.
curl \ 'https://api.example.com/v1/items?page=1' \ -H 'Accept: application/json'
4 arguments
Read back with our curl parser: the method, URL, query, headers, body, auth and options all came back the same.
The engine reported nothing about this command.
One entry per flag the command above uses, in the order curl reads them. Each line is this page's summary and links to that flag's entry in the curl manual.
curlThe curl program itself. Everything after it is an argument; nothing here runs until you paste it into a terminal. curl manualURLThe address curl requests. It is a positional argument, and any query string is part of it. curl manual-HSends one request header. Repeat it for more. `Name: value` sets a header, `Name;` sends it with an empty value. curl manual
Copy and Download hand over the command exactly as shown, credentials included. This page never sends the request.
Press ? for shortcuts
Do it offline:$ curl --help all
How to use it
- Enter the URL and pick a method. A space or control character in the address is refused, and the refusal shows the percent-encoded form to paste instead.
- Add query, header and body-part rows as you need them. Each group takes up to 64 rows, and each value up to 8,192 characters.
- Choose a body mode, and an auth mode if the endpoint wants credentials. What you type into the auth fields is never saved and never rides the share link.
- Switch between one line and a backslash-continued block, and between short and long flag spellings, then copy the command or download it as .sh.
Fill in the method, URL, query, headers, body, auth and options; the command appears as you type, already quoted for a POSIX shell. Every value goes into its own argument, so an apostrophe, a dollar sign or a space cannot change what curl requests. Each flag gets a one-line explanation beside it. The request is never sent from this page.
Examples
POST JSON · name O'Brien · -L -m 10curl \
https://api.example.com/v1/items \
-H 'Content-Type: application/json' \
--data-raw '{"name":"O'\''Brien","note":"a b"}' \
-L \
--compressed \
-m 10The apostrophe inside the JSON closes the quote, escapes itself and reopens — '\'' — the one spelling all three supported shells agree on. No -X POST appears: a body already makes curl use POST.
GET with -G · q = "a b"curl https://api.example.com/search --data-urlencode 'q=a b' --data-urlencode lang=en -GThe space rides through as a space: --data-urlencode expects the content raw and encodes it itself, so pre-encoding here would put a%2520b on the wire. -G moves both fields into the query, and the request stays a GET with no body.
Multipart upload · path with a spacecurl \
https://api.example.com/upload \
-F 'file=@/tmp/report q1.pdf' \
-F 'title=Q1 report'The whole name=@path argument is quoted as one word, so the space in the file name never splits it. Give the path in full: quoting also stops a leading ~ expanding. curl picks the boundary itself.
Basic auth on a self-signed hostcurl https://10.0.0.5/admin/status -u 'svc:p@ss w0rd' -kTwo warnings ride with this one: -k stops the certificate check, and a credential written on the line lands in shell history. Credential values are quoted whatever they contain.
Body with $HOME, a backtick, a breakcurl https://api.example.com/echo --data-raw 'cost=$HOME `id` line1
line2'Single quotes make $HOME and the backtick pair inert, so curl receives the twenty-seven characters you typed. The line break is kept where it is, which is why even the one-line form covers two lines here.
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
A word is left bare only when leaving it bare is provably safe
Letters, digits and @ % ^ _ + = : . / ~ - pass through unquoted. Braces and commas do not, because bash and zsh turn v{1,2} into two words; nor does a leading hyphen, which curl would read as a flag. A tilde is quoted wherever a shell expands it, including after an = or a : in the same word.
A line break survives in a body and is refused in a header
Newlines and tabs sit happily inside a quoted body value, and a note says so. A carriage return or newline in a header value is refused with the character named and located: curl cannot put it on the wire, and letting you try would be teaching request splitting.
Two rows with the same header name stay two rows
Both -H flags are emitted, because that is what curl puts on the wire, and reading the finished command back returns both. The divergence is downstream: most HTTP client libraries keep only the last value, so a note appears the moment a name repeats.
What this page will not do
It never runs the request, never stores a header value or a credential between visits, and keeps no history or collections. The quoting targets POSIX sh, bash and zsh; cmd.exe and PowerShell follow different rules and are out of scope.
Common errors
The URL contains a space at position 37 — curl cannot send it raw. Percent-encoded it reads https://api.example.com/v1/items?q=a%20b.- Usually a paste out of a browser address bar; the message hands back the encoded form.
"X Trace Id" is not a valid header name — RFC 9110 §5.1 field names are tokens (letters, digits and ! # $ % & ' * + - . ^ _ ` | ~), with no spaces and no colon.- Header names arrive with the colon still attached, or spaced out as they were written in a ticket.
The value of "X-Trace" contains a carriage return (U+000D) at position 2 — curl cannot send it in a header. Remove it, or percent-encode the value.- A copy out of an editor that carried its line ending along; nothing after the break would stay in this field.
"GET POST" is not a valid HTTP method — RFC 9110 §9 methods are tokens (letters, digits and ! # $ % & ' * + - . ^ _ ` | ~), with no spaces.- The custom-method box takes one token; two words would become two arguments.
"abc" is not a valid --max-time value — enter a positive number of seconds, such as 10 or 2.5.- Zero is refused too: curl reads -m 0 as no limit at all, the opposite of what typing it suggests.
The body is 8193 characters — this builder accepts up to 8192 characters per value.- The figure comes from the engine constant, so the message can never drift from what is enforced.
FAQ
Why is a value quoted when it looks perfectly harmless?
Because a shell decides what a word is before curl ever sees it. Braces expand, a leading hyphen reads as a flag, a tilde becomes a home directory and a bare space becomes an argument boundary — all silently, all producing a request you did not write. Quoting costs nothing, so anything outside a small provably inert set gets it.
Does this page ever make the request I am building?
No. Nothing here opens a connection: the tool assembles text and hands it to you, and the only thing that runs it is the terminal you paste it into. That is also why the target can be a private address, a host that does not exist yet, or an endpoint that would charge you for the call.
Will the command work in PowerShell or cmd.exe?
Not reliably. Single quotes mean different things there, and the backslash-continued layout is a POSIX shell convention. Use the command as written in sh, bash or zsh — Git Bash and WSL count — or translate it deliberately. Curl on Windows is fine; the quoting around it is what differs.
Keyboard shortcuts
- ⌘/Ctrl + C
- Copy the command when nothing is selected and focus is in the tool.
- ⌘/Ctrl + Shift + C
- Copy the command even while text is selected.
- t
- Cycle theme.
- ? or ⌘/Ctrl + /
- Open the shortcut help overlay.
- Esc
- Close the overlay and refocus the form.