HTTP Request Header Builder

The HTTP Request Header Builder turns a plain list of request headers into three things you can use immediately: a clean raw header block, a runnable curl command, and a JavaScript fetch() snippet. Type your headers one per line, pick an HTTP method and target URL, and every output updates as you go — no manual shell quoting, no boilerplate to remember.

It runs entirely in your browser. Nothing you type — including bearer tokens, API keys, or cookies — is ever sent to a server.

How to use it

1. Enter your headers in the textarea, one per line, in Header-Name: value form — for example Content-Type: application/json or Authorization: Bearer <token>.
2. Set the request URL, such as https://api.example.com/users. It is used to assemble the curl command and the fetch() call.
3. Choose the HTTP method — GET, POST, PUT, PATCH, or DELETE.
4. Copy any output. The raw header block is handy for .http files and documentation, the curl command drops straight into a terminal, and the fetch() snippet pastes into JavaScript.

How headers are parsed

Input is read forgivingly so a quick copy-paste still works:

• Blank lines are skipped.
• Lines without a colon are skipped — they are not headers.
• The header name and value are split on the first colon, so values may themselves contain colons (timestamps, URLs, key:value tokens).
• Both name and value are trimmed of surrounding whitespace.
• Lines whose name contains whitespace are dropped, because HTTP field names cannot contain spaces (X Custom: value is invalid and ignored).

FAQ

What is a valid HTTP header name?

A header field name is a token: letters, digits, and a handful of symbols like -, but no spaces or colons. Common examples are Content-Type, Authorization, Accept, User-Agent, and custom X- prefixed names such as X-Request-Id. If a line's name has a space in it, this tool treats it as malformed and skips it.

Why does the curl command use double quotes?

Each header and the URL are wrapped in double quotes so the command is safe to paste into a POSIX shell exactly as shown. Characters the shell still interprets inside double quotes — backslash, double quote, dollar sign, and backtick — are escaped automatically, so unusual values won't break the command.

Does the method matter for the header block?

The raw header block lists only your headers. The HTTP method and URL appear in the generated curl command and fetch() snippet, which together give you a full request preview you can run.

Can I send a request body?

This tool focuses on headers, methods, and the request line. To add a JSON or form body and extra flags, use the companion cURL Command Builder, which pairs a body field with the same header list.

Is my data private?

Yes. All parsing and generation happen locally in your browser. Tokens and secrets in your headers never leave your device, and — because header values often contain credentials — the header textarea is intentionally excluded from shareable links.