cURL Generator

Runs in browser Web

Compose a cURL command with correct escaping for bash, PowerShell or cmd, including -X, -H, -d, --data-urlencode, -u, --compressed and timeout flags.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use cURL Generator

  1. Fill in method, URL, headers, body and authentication.
  2. Select the shell you will paste into and toggle the options you need.
  3. Copy the command; read the flag explanations if you are new to curl.

cURL Generator features

  • Correct quoting for bash/zsh, PowerShell (curl.exe with backticks) and Windows cmd (^ continuations, escaped quotes, doubled %)
  • Bearer, Basic and API key authentication as headers or query parameters
  • --data-raw bodies, -L, --compressed, -k, -i, -v, -sS, --max-time and -o options
  • Omits redundant -X POST when a body is present, exactly like curl behaves
  • Every flag explained in plain language below the command

cURL Generator example

POST JSON with a token (bash)

Input:

POST https://api.example.com/v1/issues · Bearer ghp_… · Body {"title":"Fix login"} · --compressed

Output:

curl https://api.example.com/v1/issues \
  -H 'Authorization: Bearer ghp_…' \
  -H 'Content-Type: application/json' \
  --data-raw '{"title":"Fix login"}' \
  --compressed

Frequently asked questions about cURL Generator

Why is there no -X POST in the generated command?

curl switches to POST automatically when a body (-d / --data-raw) is present, so -X POST is redundant. -X is emitted only for other methods (PUT, PATCH, DELETE) or for POST without a body.

What differs between bash, PowerShell and cmd output?

bash uses single quotes and backslash line continuations. PowerShell uses curl.exe (because "curl" is an alias of Invoke-WebRequest) with backtick continuations and doubled single quotes. cmd has no single quotes, so inner double quotes are escaped as \" and lines continue with ^.

Should I use -d or --data-raw?

--data-raw sends the text exactly as given. With -d, a value starting with @ is treated as a file name — surprising for JSON bodies. The generator therefore uses --data-raw.

What does --compressed do?

It adds Accept-Encoding for gzip/brotli and decompresses the response automatically, matching browser behaviour and reducing transfer size.

Technical notes

Header names must match the RFC 9110 token grammar; CR/LF in values is rejected. A body without a Content-Type is sniffed: a JSON object or array becomes application/json, a=1&b=2 shapes application/x-www-form-urlencoded, a leading < application/xml, anything else text/plain. Bearer and Basic auth prepend an Authorization header unless one was typed, with Basic credentials UTF-8 encoded before Base64. A query-string API key is appended via encodeURIComponent; the URL itself is never re-encoded.

Quoting per shell: bash leaves values matching [A-Za-z0-9_-./:@=+%,] bare and otherwise single-quotes them, writing embedded quotes as '\''; PowerShell always single-quotes and doubles inner quotes; cmd double-quotes, escapes \" and doubles % and ^. Multi-line bodies stay literal. HEAD becomes -I, -X appears only for methods other than GET, HEAD and POST-with-body, and --max-time is capped at 3600. The method is upper-cased and stripped to letters, so custom verbs like PURGE pass through.