curl-converter
Paste a curl command — including the multi-line kind Chrome/Firefox DevTools' "Copy as cURL" produces — and get working request code in the language of your choice: method, headers, body, basic auth, and the -k/insecure flag all translated.
Paste a curl command on the left and click Convert.
// what gets translated, in every language
Headers (-H, repeatable).
Body (-d / --data-raw / --data-binary, repeatable, joined with &) — its content type comes from an explicit Content-Type header if you passed one; otherwise it defaults to application/x-www-form-urlencoded, matching curl's own default for -d — see why that default exists and how it silently breaks JSON APIs if the header wasn't in your original command.
Basic auth (-u user:pass) — base64-encoded exactly like curl does it, using each language's native basic-auth mechanism where one exists (Python's auth=, axios's auth:, Go's SetBasicAuth) and a manually-built header where it doesn't (fetch, Java, PowerShell's Invoke-RestMethod).
-k / --insecure — translated faithfully to each language's TLS-bypass mechanism, always with a warning comment. It's exactly as dangerous in the generated code as it is on the command line — fetch is the one exception, see below.
-G / --get — data gets appended to the URL as a query string instead of a body, method forced to GET, matching curl's behavior.
// what doesn't
Multipart form data (-F/--form) isn't auto-converted in any language — building a multipart body correctly means constructing a real MultipartFormDataContent/FormData/equivalent by hand, so the tool lists the original -F arguments as a comment instead of guessing. Flags that don't affect the request itself (-v, -s, -L, --compressed, output/timeout/proxy options) are silently ignored, since most HTTP clients either have no equivalent or handle the underlying behavior differently by default.
// the fetch exception
Every other language gets a faithful -k/--insecure translation because each has a per-request or per-client way to disable TLS verification. Browser fetch has no such option at all — TLS trust is the browser's job, not the page's — and Node's fetch only offers a process-wide environment variable (NODE_TLS_REJECT_UNAUTHORIZED=0), not a per-request flag. The generated code notes this rather than pretending an equivalent exists.
Method — explicit
-X/--request, or inferred:POSTif a body is present, otherwiseGET.