Paste a cURL command (the one every API's docs show) and get the equivalent code in fetch JavaScript, PHP cURL, Python requests or Node. The tool reads method (-X), headers (-H), body (-d/--data/--json), basic auth (-u), cookies (-b) and multipart form (-F), and generates ready-to-paste code. Fully client-side: the command never leaves your browser.
From an API's documentation (Stripe, GitHub, OpenAI, Twilio all show cURL examples), from a client like Postman or Insomnia ('Copy as cURL'), or from the browser DevTools (Network, right-click the request, 'Copy as cURL'). Paste it into the field, even across multiple lines with backslash continuations: the parser handles them.
fetch for JavaScript in the browser or Node 18+, PHP cURL for a PHP backend, Python requests for scripts and automation, Node for a server-side HTTP client. Each target emits idiomatic code for that language, not a literal transliteration.
The parser tokenizes the command honouring shell quoting, reads method, headers, body, authentication, cookies and form, then generates the equivalent code. The method is inferred the way cURL does it: if there is a -d without -X, the method is POST.
Copy the code and paste it into your project. Always replace sensitive values (bearer tokens, passwords, API keys) with environment variables: a secret committed in cleartext into the repository must be considered compromised and rotated.
cURL is the lingua franca of APIs. Open the docs of Stripe, GitHub, OpenAI, Twilio or any serious REST API: the request examples are almost always curl commands. It is the most concise, language-neutral way to describe an HTTP call: method, URL, headers, body. The friction appears when you have to go from that command-line example to the code that actually runs inside your application: a fetch in the frontend, a requests client in a Python script, a cURL call in a PHP backend. This tool does exactly that translation, keeping the HTTP semantics intact.
What the parser reads. The command is tokenized honouring shell quoting rules (single quotes, double quotes, backslash escapes), then each option is mapped to the corresponding HTTP concept:
-X, --request sets the method (GET, POST, PUT, PATCH, DELETE). If it is missing but a body is present, the method becomes POST, exactly as cURL does.-H, --header adds a request header. It is repeatable: -H "Authorization: Bearer ..." -H "Content-Type: application/json".-d, --data / --data-raw / --data-binary defines the body. Multiple -d are joined with &. With no explicit Content-Type, cURL uses application/x-www-form-urlencoded.--json (cURL 7.82+) is a shortcut for body plus Content-Type: application/json plus Accept: application/json.-u, --user user:password produces the Authorization: Basic header with the pair base64-encoded.-b, --cookie sets the Cookie header.-F, --form builds a multipart/form-data body: -F "field=value" for a field, -F "file=@path" for an upload.fetch, requests, PHP cURL, Node: four different philosophies. The same command produces very different code depending on the target, and the differences matter.
fetch (JavaScript) is async and Promise-based, available natively in the browser and in Node from version 18. It does not serialize JSON for you: the body must be passed as a string via JSON.stringify(...), and you set the Content-Type by hand in the headers. In the browser it is subject to the target server's CORS policy.
requests (Python) is synchronous and high-level. The json= parameter serializes the dictionary and sets Content-Type: application/json automatically; data= with a dictionary produces a form-urlencoded body; files= handles multipart; auth=(user, password) does basic auth. It is the most compact target.
PHP's cURL (the libcurl extension) is imperative and verbose: curl_init(), a sequence of curl_setopt() calls (CURLOPT_CUSTOMREQUEST, CURLOPT_HTTPHEADER, CURLOPT_POSTFIELDS, CURLOPT_USERPWD), then curl_exec(). In exchange for the verbosity it gives full control over TLS, timeouts and redirects.
The Node target uses the global fetch (Node 18+), the modern idiomatic approach for a server-side HTTP client, avoiding the low-level stream-and-callback https module.
Headers, authentication and body: where sloppy converters get it wrong. A bearer token is just an Authorization: Bearer <token> header, so it passes straight through as a header in every language. Basic auth instead has to be translated: cURL uses -u user:pass, but in code it becomes btoa() in JavaScript, base64_encode() in PHP, the auth= tuple in requests. A JSON body must be serialized with the language's proper function, not pasted as a raw string. Multipart is not a simple header: it needs FormData in JS, the files= argument in requests, an associative array with CURLFile in PHP.
Privacy: everything in the browser. The command you paste often contains tokens, API keys or passwords (the -H "Authorization: ...", the -u user:pass). That is why the tool works entirely client-side: parsing and code generation happen in JavaScript in your browser, nothing is sent to a server. You can convert commands with real secrets without them leaving the machine, though the golden rule remains to replace them with environment variables in the final code.
Technical terms used on this page, briefly explained.
-H. Authorization: Bearer <token> header. It is the OAuth 2.0 standard for modern REST APIs. : and base64-encoded in the Authorization: Basic header. It is not encryption: use it only over HTTPS. -d, --data or --json. multipart/form-data format for sending fields and files in a single request, used for uploads. Each part has its own headers and a boundary separates the parts. In cURL it is built with -F. curl command (method, URL, headers, body, authentication, cookies, form) and generates the equivalent code in the language you pick: fetch JavaScript, PHP with the cURL extension, Python with the requests library, or Node with fetch. It turns the cURL examples in API documentation into ready-to-integrate code, without hand-translating headers and options.-u, API keys in headers) without them leaving your machine. It is still good practice to replace secrets with environment variables in the final code.fetch for JavaScript (browser and Node), fetch for server-side Node.js, PHP's cURL (libcurl with curl_setopt), and requests for Python. These are the most widely used HTTP libraries in their respective ecosystems. If you need a different target (Go, Ruby, Java, C#) the abstract HTTP request is the same: only the client's syntax changes.-H "Authorization: Bearer ..." stays a header and is carried over verbatim in every language. Basic auth passed with -u user:password is translated idiomatically: btoa('user:pass') in fetch, base64_encode() or CURLOPT_USERPWD in PHP, the auth=(user, password) tuple in requests. Basic auth always goes over HTTPS because it is only base64, not encryption.-d '{...}' with -H "Content-Type: application/json", or the --json '{...}' shortcut, is translated using the language's proper serialization: JSON.stringify() in fetch, the json= parameter in requests (which also sets the header), json_encode() with CURLOPT_POSTFIELDS in PHP. The body is never pasted as a raw string where the language expects an object.-F options become FormData in JavaScript, the files= or data= argument in requests, an associative array (with CURLFile for uploads) in PHP. Watch out for file references like -F "file=@/path": in the generated code they become a reference to a file you must wire up yourself (a file input in the browser, a real path on the server), because the file content is not in the cURL command.-b, --cookie "name=value" is translated into the corresponding Cookie header. Note however that real session handling (a login that sets a cookie, later requests that reuse it) needs a cookie jar: requests.Session() in Python, the credentials: 'include' option in fetch, CURLOPT_COOKIEJAR/CURLOPT_COOKIEFILE in PHP. A single Cookie header covers the static case, not the session lifecycle.Maurizio Fonte, senior IT consultant with 20+ years in PHP, Laravel, unmanaged Linux infrastructure, applied cybersecurity and AI/LLM integration. Production backends, legacy code modernization, security audits, custom AI agents and MCP servers: the work behind every tool published here.
About Maurizio Fonte