curl-converter

Paste a curl command — including the multi-line kind Chrome/Firefox DevTools' "Copy as cURL" produces — and get working request code in the language of your choice: method, headers, body, basic auth, and the -k/insecure flag all translated.

client-side only 7 languages multi-line aware

curl command

output:

Paste a curl command on the left and click Convert.

// what gets translated, in every language

Method — explicit -X/--request, or inferred: POST if a body is present, otherwise GET.
Headers (-H, repeatable).
Body (-d / --data-raw / --data-binary, repeatable, joined with &) — its content type comes from an explicit Content-Type header if you passed one; otherwise it defaults to application/x-www-form-urlencoded, matching curl's own default for -d.
Basic auth (-u user:pass) — base64-encoded exactly like curl does it, using each language's native basic-auth mechanism where one exists (Python's auth=, axios's auth:, Go's SetBasicAuth) and a manually-built header where it doesn't (fetch, Java, PowerShell's Invoke-RestMethod).
-k / --insecure — translated faithfully to each language's TLS-bypass mechanism, always with a warning comment. It's exactly as dangerous in the generated code as it is on the command line — fetch is the one exception, see below.
-G / --get — data gets appended to the URL as a query string instead of a body, method forced to GET, matching curl's behavior.

// what doesn't

Multipart form data (-F/--form) isn't auto-converted in any language — building a multipart body correctly means constructing a real MultipartFormDataContent/FormData/equivalent by hand, so the tool lists the original -F arguments as a comment instead of guessing. Flags that don't affect the request itself (-v, -s, -L, --compressed, output/timeout/proxy options) are silently ignored, since most HTTP clients either have no equivalent or handle the underlying behavior differently by default.

// the fetch exception

│

Every other language gets a faithful -k/--insecure translation because each has a per-request or per-client way to disable TLS verification. Browser fetch has no such option at all — TLS trust is the browser's job, not the page's — and Node's fetch only offers a process-wide environment variable (NODE_TLS_REJECT_UNAUTHORIZED=0), not a per-request flag. The generated code notes this rather than pretending an equivalent exists.