curl command parser

DevTools “Copy as cURL” → readable table · query parameters split out · fetch() equivalent

"Copy as cURL" produces one enormous line with thirty -H flags and a URL buried in the middle. Paste it here to read it: method, host, path, every query parameter decoded, every header in a table, the body, and what each flag does. The shell quoting is parsed properly, so single quotes, escapes and line continuations all survive.

How to use

1. Paste the command. A leading $ or > prompt is stripped, and backslash, caret and backtick line continuations are all handled — so pasting from a shell, from cmd.exe or from PowerShell works.
2. Request gives you the method and the URL broken into parts. The method is inferred as POST when body data is present and no -X was given, which is what curl itself does.
3. Headers lists each -H as a row. Credential headers are outlined, because a curl command from DevTools almost always contains a live session.
4. Query parameters shows each parameter decoded — usually the thing you were actually looking for.
5. Flags explains the switches that change behaviour, and lists anything the parser did not recognise rather than silently dropping it.
6. Copy the URL on its own, or take the fetch() equivalent into a browser console or a Node script.

Flags that change what the request means

-X sets the method explicitly. -d, --data-raw and --data-binary all supply a body and imply POST; --data-urlencode additionally encodes the value, so the body you see here is the pre-encoding form. -G flips the meaning entirely — the data goes onto the query string and the request becomes a GET.

-u user:pass is Basic auth, which curl turns into an Authorization header; the generated fetch() does the same conversion so it behaves identically. -b supplies cookies. -A and -e are shorthands for User-Agent and Referer.

-L follows redirects, which matters when reproducing a request: without it, curl stops at the 301 and you see a different response from the one the browser got. -k disables certificate verification — worth noticing in a command someone sent you, because it means the request was working around a TLS problem rather than solving it.

A word about pasted credentials

A curl command copied from DevTools carries whatever authenticated the original request: session cookies, a bearer token, an API key. The status line warns when it sees one. Everything here runs in your tab and nothing is transmitted — but the command in your clipboard is still a live credential, so do not paste it into a ticket, a chat or a pull request without removing those headers first. If you need to share the request, share the URL and the shape of the headers, not their values.

FAQ

Related URL tools