cURL Command Builder
Build cURL commands for Bash, PowerShell or Windows Command Prompt with method, URL, query parameters, headers, JSON, form or raw bodies and authentication. Includes an HTTP request preview — nothing is ever sent.
Loading cURL Command Builder…
About the cURL Command Builder
cURL Command Builder turns a request description into a ready-to-review curl command. Choose the method, enter an http or https URL, add query parameters and headers, pick a JSON, form URL-encoded or raw text body, and set Basic, Bearer token or API-key header authentication, plus optional redirects and a timeout. The command is quoted for Bash, PowerShell (using curl.exe) or Windows Command Prompt, and an equivalent HTTP request preview shows what would be sent.
The builder only writes text: it never sends the request, runs the command or contacts the URL. JSON bodies are validated, form fields are URL-encoded, and header names, values and URLs are checked so line breaks and control characters cannot inject extra headers. Passwords, tokens and keys are marked as secrets, hidden by default, and replaced with placeholders in the command unless you choose to include them — remember that commands containing credentials can end up in shell history and process lists.
How to use
- Choose the method and enter the URL.
- Add query parameters and headers.
- Choose a body type and authentication if needed.
- Choose your shell and any options.
- Review the command and preview, then copy or download it.
Key features
- GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS.
- Query parameter, header and form field rows.
- JSON (validated), form URL-encoded and raw bodies.
- Basic, Bearer and API-key header authentication.
- Quoting for Bash, PowerShell and Command Prompt.
- Secrets hidden and replaced by placeholders by default.
- HTTP request preview, Copy Command and Download .txt.
Best practices
- Keep the placeholder version for sharing and documentation.
- Use environment variables or a config file for real credentials.
- Use Bash or PowerShell for multi-line bodies.
- Check the HTTP preview matches what the API expects.
- Review every generated command before running it.
Benefits
- Avoids quoting mistakes across different shells.
- Prevents header injection from pasted values.
- Keeps secrets out of shared commands by default.
- Private: no request is sent and nothing is stored.
Frequently asked questions
Does the tool send my request?
No. It only generates text. No request is made to the URL and the command is never run.
How are secrets handled?
Password, token and API-key fields are masked, with a Show/Hide button. Unless you tick “Include secret values”, the command and preview use placeholders such as <TOKEN>. Secrets are never written to browser storage or the console.
Why does the PowerShell version use curl.exe?
In Windows PowerShell, curl can be an alias for Invoke-WebRequest. curl.exe runs the real curl program. The output targets PowerShell 7.3 or later; Windows PowerShell 5.1 can strip double quotes from arguments, so pass JSON from a file there.
What are the Command Prompt limitations?
Command Prompt cannot pass values containing line breaks, and it may expand %NAME% sequences that match environment variables. The builder escapes quotes and special characters, but check commands containing % before running them.
How is form data encoded?
Fields are encoded as application/x-www-form-urlencoded, with spaces as + and special characters percent-encoded, and sent with --data-raw.
Which values are rejected?
URLs that are not http or https or that contain spaces, header names with invalid characters, header values with line breaks or control characters, invalid JSON bodies, and bodies on HEAD requests.
Is the generated command guaranteed to work?
No. It reflects what you entered. Servers differ, and you should review and test commands yourself, preferably without real credentials first.
Is anything I paste uploaded or saved?
No. Everything is processed in your browser on your device. Nothing is uploaded, no request is sent, and inputs and results are not saved in browser storage. Reset clears them from the page.