HAR to cURL Extractor
Convert HAR (HTTP Archive) requests into runnable cURL commands — with header, cookie, auth-masking, and body options, plus method/status/type filters.
Input
cURL Options
Filters
Output
| Metric | Value |
|---|---|
| No data yet | |
Guides
What does this tool do?
It converts every request in a HAR (HTTP Archive) network capture into a runnable curl command — turning a browser DevTools export into a script you can replay from the terminal, share with a teammate, or paste into a bug report.
How this tool works
- Paste HAR JSON into the input box, or upload a
.harfile. - Configure the cURL options: include request headers, include the
Cookieheader (off by default, since cookies are often sensitive), include the request body, strip HTTP/2 pseudo-headers (:method,:authority, etc. — invalid in a real cURL command), maskAuthorization/API-key header values, and choose single-line or multi-line (\continuation) output. - Optionally filter by search term, method, status class, or content type (e.g. "Skip static assets" to focus on API calls) before extracting.
The Summary shows how many requests matched out of the total and how many unique domains they hit. Each generated command is preceded by a # [n] METHOD status host/path comment for easy scanning, and requests are separated by a blank line.
Auth masking
With Mask Authorization / token header values on, Authorization, Proxy-Authorization, and common API-key headers (X-Api-Key, X-Auth-Token, etc.) have their values replaced with <TOKEN> — for Authorization/Proxy-Authorization the auth scheme word (Bearer, Basic) is preserved so the shape of the command still makes sense. Turn this on before sharing a HAR-derived script outside your team.
Request bodies
JSON and other raw text bodies become --data-raw. Form-urlencoded bodies are reassembled from the HAR's parsed parameters. Multipart form bodies become one -F flag per field, with file fields written as @filename (the actual file content isn't in the HAR, so you'd need to supply that file yourself to replay the request).
Common uses
- Turning a captured request into a reproducible cURL command for debugging
- Building a quick regression script from a recorded user session
- Sharing "here's exactly what request failed" with a backend teammate, safely (with auth masked)
- Filtering a large capture down to just the API calls worth replaying
Privacy
This tool runs entirely in your browser. Your HAR file is never uploaded to a server.
Use it from code
From 3 credits per callREST API
curl -X POST https://api.iotools.cloud/v1/tool/har-to-curl-extractor \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"harInput": "{\n \"log\": {\n \"version\": \"1.2\",\n \"entries\"…",
"includeHeaders": "true",
"includeCookies": "true",
"includeBody": "true",
"stripPseudo": "true",
"maskAuth": "true",
"multiline": "true",
"filterSearch": "",
"filterMethod": "any",
"filterStatus": "any",
"filterType": "any"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `har-to-curl-extractor` tool (HAR to cURL Extractor) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.