cURL Command Builder
Build a ready-to-paste curl command from a URL, HTTP method, headers, request body, Basic Auth, and common flags (-L, -k, -v, -i) — no manual shell quoting required.
Input
One header per line, formatted as "Key: Value".
Sent with -d. Meaningful for POST/PUT/PATCH; ignored if left blank.
Output
Guides
What is the cURL Command Builder?
curl is the command-line tool most developers reach for to test an HTTP endpoint, debug an API, or reproduce a request from a bug report. Its syntax is unforgiving: methods, headers, bodies, and credentials all have to be typed and shell-quoted by hand, and a missing quote or an unescaped " inside a JSON body is enough to send the wrong request. This builder assembles the command from a plain form, so quoting is handled automatically and the result is always safe to paste into a terminal.
How to use it
- Enter the target URL and pick an HTTP Method (GET, POST, PUT, PATCH, DELETE, or HEAD).
- Add any Headers, one per line, formatted as
Key: Value— for exampleContent-Type: application/json. - For POST/PUT/PATCH requests, paste the Request Body (typically JSON) into the body field.
- For HTTP Basic Authentication, fill in Basic Auth Username and Basic Auth Password — both fields must be set for
-uto appear. - Toggle the flags you need: Follow redirects (
-L), Skip SSL certificate verification (-k), Verbose output (-v), and Include response headers (-i). - The cURL Command box updates as you type — copy it into your terminal, or download it as a shell script.
How the command is built
-X <METHOD> is included for every method except a plain GET with no body — curl already defaults to GET, but silently switches to POST the moment -d is present, so an explicit -X GET is added whenever a GET has a body too. Each header line becomes its own -H '...' flag in the order entered; a non-empty body becomes -d '...'; Basic Auth becomes -u 'user:pass'. Every value — headers, body, credentials, and the URL — is wrapped in single quotes, with any literal single quote escaped as '\'' (the standard way to embed a quote inside a single-quoted POSIX shell string), so special characters like spaces, $, backticks, and " can never break out of the command.
FAQ
Why does -X GET sometimes appear even though I picked GET?
Only when a request body is also set — curl would otherwise default to POST once -d shows up, so an explicit -X GET keeps the request a GET.
Why do I need both a username and a password for -u to show up?
-u expects a username:password pair; the builder requires both fields rather than guessing at a blank half.
What does -k do, and is it safe?
-k (--insecure) skips TLS certificate validation — useful for local or self-signed certs, but never against a production endpoint, since curl won't detect a man-in-the-middle attack.
What's the difference between -i and -v?
-i prints the response headers above the body; -v (verbose) logs the entire request/response conversation, handy for debugging.
Can I use this for form-data or file uploads?
Not directly — this builder covers raw bodies (-d), suited to JSON, XML, and plain text APIs. Multipart uploads (-F) aren't generated here.
Privacy
This tool runs entirely in your browser. The URL, headers, body, and any credentials you enter — including the Basic Auth username and password — are never sent to or stored on our servers, and they're excluded from shareable tool links.