cURL to Code Converter

Convert a cURL Command to Working Code

Copying a request as cURL from Chrome DevTools, Postman, or an API's documentation is the fastest way to capture exactly what a request looked like — but then you still have to translate it into whatever language your app is written in. This free tool does that translation for you: paste a cURL command and get equivalent fetch(), Python requests, or Node axios code, ready to drop into your project.

How It Works

• Paste your cURL command into the left editor, or click Sample to try an example login request.
• Click Convert (or just keep typing — it converts automatically) to parse the method, URL, headers, body, and auth.
• Switch tabs to see the same request as fetch(), Python requests, or Node axios code.
• Copy or download the generated code directly into your project (request.js or request.py).

What's Supported

The converter understands the flags that show up in real-world cURL commands: -X/--request for the HTTP method, -H/--header for headers, -d/--data/--data-raw for the request body (including JSON bodies, which get converted to a proper object literal or dict), -u/--user for Basic Auth, -b/--cookie, -F/--form for multipart form uploads, and -G for converting data into query parameters. Multi-line commands copied from DevTools (with trailing \ line continuations) are handled automatically. If a request body is itself a JSON payload you want as typed models, JSON to Code turns it into TypeScript, Python, or Go types.

The complete list, read from the converter's code:

The HTTP method is chosen like this:

How Headers, Bodies and Auth Are Mapped

Headers are copied with their original name and case. Bodies that parse as JSON become an object in every language: a JSON.stringify({...}) call in fetch(), a payload = {...} dict sent with json=payload in Python (with true, false and null written as True, False and None), and a data: {...} object in axios, which sends it as JSON. Any other body is kept as a string, and Python sends it with data=. For JSON bodies the generated code leaves the Content-Type header out, because Python and axios set it themselves. fetch() does not: a string body is sent as text/plain, so with fetch() you must add "Content-Type": "application/json" to the headers yourself, as in Example 1 below, where it is missing from the output.

Authentication has three paths. -u user:pass becomes "Authorization": "Basic " + btoa("user:pass") in fetch(), auth=("user", "pass") in Python and auth: { username, password } in axios. An Authorization header you pass with -H (Bearer tokens, API keys) is copied as it is, and if a command has both, the header wins and -u is dropped. Because btoa() only handles Latin-1 text, a password with other characters makes the fetch() version throw; build that header with the Base64 encoder, which handles UTF-8. Cookies, User-Agent and Referer are added as ordinary headers; browsers refuse to let fetch() set some of them (Cookie and Referer among them), while Node and Python can.

Worked Examples in All Three Languages

Every command and output below was produced by running the live converter, character for character.

Example 1: a JSON login request (this is the page's Sample button)

curl -X POST https://api.example.com/v1/login \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{"username":"ada","password":"s3cret"}'

fetch("https://api.example.com/v1/login", {
  method: "POST",
  headers: {
    "Accept": "application/json"
  },
  body: JSON.stringify({
    "username": "ada",
    "password": "s3cret"
  }),
})
  .then(response => response.json())
  .then(data => console.log(data))
  .catch(error => console.error("Error:", error));

import requests

url = "https://api.example.com/v1/login"

payload = {
    "username": "ada",
    "password": "s3cret"
}

headers = {
    "Accept": "application/json",
}

response = requests.post(url, headers=headers, json=payload)
print(response.status_code)
print(response.json())

const axios = require('axios');

axios({
  method: "post",
  url: "https://api.example.com/v1/login",
  headers: {
    "Accept": "application/json"
  },
  data: {
    "username": "ada",
    "password": "s3cret"
  },
})
  .then(response => console.log(response.data))
  .catch(error => console.error(error));

Look at what changed. The JSON body became a real object, the Content-Type header disappeared (fine in Python and axios, but add it back in fetch()), the -X POST became the library's POST call, and the generated code ends by printing the parsed JSON response.

Example 2: Basic Auth, query data with -G and an Accept header

curl -u ada:s3cret -G https://api.example.com/search -d "q=hello world" -d page=2 -H 'Accept: application/json'

fetch("https://api.example.com/search?q=hello%20world&page=2", {
  method: "GET",
  headers: {
    "Accept": "application/json",
    "Authorization": "Basic " + btoa("ada:s3cret")
  },
})
  .then(response => response.json())
  .then(data => console.log(data))
  .catch(error => console.error("Error:", error));

import requests

url = "https://api.example.com/search?q=hello%20world&page=2"

headers = {
    "Accept": "application/json",
}

response = requests.get(url, headers=headers, auth=("ada", "s3cret"))
print(response.status_code)
print(response.json())

const axios = require('axios');

axios({
  method: "get",
  url: "https://api.example.com/search?q=hello%20world&page=2",
  headers: {
    "Accept": "application/json"
  },
  auth: { username: "ada", password: "s3cret" },
})
  .then(response => console.log(response.data))
  .catch(error => console.error(error));

Here -G turned the two -d values into ?q=hello%20world&page=2, the space written as %20 (see the URL encoder for the rules), no body is sent, and the Basic Auth credentials went to each library's own option.

Example 3: a multipart upload with -F

curl -X POST https://api.example.com/upload -F 'title=My file' -F 'file=@photo.jpg' -H 'X-Api-Key: abc123'

const formData = new FormData();
formData.append("title", "My file");
formData.append("file", /* File object */ "photo.jpg");

fetch("https://api.example.com/upload", {
  method: "POST",
  headers: {
    "X-Api-Key": "abc123"
  },
  body: formData,
})
  .then(response => response.json())
  .then(data => console.log(data))
  .catch(error => console.error("Error:", error));

import requests

url = "https://api.example.com/upload"

files = {
    "title": (None, "My file"),
    "file": open("photo.jpg", "rb"),
}

headers = {
    "X-Api-Key": "abc123",
}

response = requests.post(url, headers=headers, files=files)
print(response.status_code)
print(response.json())

const axios = require('axios');

const FormData = require('form-data');
const form = new FormData();
form.append("title", "My file");
form.append("file", fs.createReadStream("photo.jpg"));

axios({
  method: "post",
  url: "https://api.example.com/upload",
  headers: {
    ...form.getHeaders(),
    "X-Api-Key": "abc123"
  },
  data: form,
})
  .then(response => console.log(response.data))
  .catch(error => console.error(error));

Multipart forms need care. In fetch() the file field is only a placeholder: /* File object */ "photo.jpg" is a string, so replace it with a File from an <input type="file">. In Python, open("photo.jpg", "rb") works if the file is next to your script. In axios, the code uses fs.createReadStream but does not require('fs'), and it needs the form-data package, so add const fs = require('fs'); and install it with npm install form-data.

Common Mistakes When Pasting from DevTools

• Copying the Windows (cmd) variant. Chrome on Windows offers "Copy as cURL (cmd)" with ^ escapes, which this tool does not understand. Choose "Copy as cURL (bash)" instead.
• Bash copies with $'...'. When a body has line breaks or non-ASCII characters, the bash variant wraps it as $'...'. The converter does not handle that quoting and leaves a stray $ in the body. Remove the $ and write the escape sequences out by hand, or paste the body into the JSON unescape tool first.
• Leaving every browser header in. DevTools copies origin, referer, user-agent, accept-language, sec-* headers and cookies. Most are noise in a script, some are refused by fetch(), and the cookie and authorization values are secrets, so remove what you do not need.
• Trusting the method. -XDELETE without a space becomes a GET. Check the method line in the output.
• Large numbers in JSON bodies. A body value such as 12345678901234567890 is parsed as a JavaScript number first and comes out as 12345678901234567000. Send big IDs as strings.
• Assuming the response is JSON. All three outputs parse the response as JSON. That fails for HEAD, 204 responses and HTML pages.
• Sharing the output. Tokens and cookies from the cURL command are copied into the code. Replace them with environment variables before committing it.

What Is Not Supported

These are the limits we found by testing the live converter with real command variations:

If a command uses something from this list, convert it first as far as the tool allows and then correct the generated code by hand, or fix the command (for example with a space after -X) and convert again.

Privacy

Parsing and code generation happen entirely in your browser using JavaScript. Your cURL command — which often contains auth tokens, cookies, or API keys — is never uploaded to a server.

Related Tools

• JSON to code generator: generate classes for the response body.
• URL encoder and decoder: encode query strings before you paste them into a command.
• Base64 encoder and decoder: decode a Base64 value from a header or body.
• JSON escape and unescape tool: escape a JSON string for a request body.
• mock data generator: generate sample request bodies.
• JWT decoder: read the token from an Authorization: Bearer header.
• JSON Schema generator: describe the JSON response of the request as a schema.
• JSONPath tester: pick fields out of the response you got back.
• JSON formatter and fixer: validate, format and repair JSON before you use it here.
• all JSON tools: every free tool listed on one page.

Last updated: October 2026