CURL Command Builder
Build POSIX-shell-safe curl commands from an HTTP method, URL, headers, and optional request body.
HTTP Method
Enter one HTTP field per line as Name: value. Header names are checked before output is generated.
Body text is passed with --data-raw. Add the intended Content-Type header yourself when the server expects one.
Generated POSIX-shell command
Enter a valid HTTP or HTTPS URL to build the command.
What the quoting protects
URL, header, method, and body arguments are single-quoted for POSIX shells. Embedded apostrophes are escaped so spaces, dollar signs, backticks, quotes, and shell metacharacters stay inside the argument instead of becoming shell syntax.
What it does not execute
The browser only builds text. It does not send the request, contact the endpoint, verify credentials, or confirm that the server accepts the method, headers, or body.
A curl command is also a shell command
A request can be perfectly valid HTTP and still become unsafe or broken when pasted into a shell. Characters such as spaces, apostrophes, dollar signs, backticks, semicolons, and command substitutions have meaning to the shell before curl receives them. The generated command therefore quotes every user-controlled argument rather than interpolating raw text into double quotes.
The output targets POSIX-style shells such as sh, bash, and zsh. PowerShell and Windows Command Prompt use different quoting rules, so the same text should not be assumed to behave identically there.
Method selection changes curl behavior
A plain GET needs no explicit --request GET. HEAD is generated with --head because curl documents that --request HEAD changes only the verb and does not enable the normal HEAD response handling.
When a body is present, the builder uses --data-raw so a leading @ stays literal instead of being treated as a filename. curl does not infer JSON from the body; if the endpoint expects JSON, include an appropriate Content-Type header.
Credentials deserve a separate check before sharing
Authorization headers, cookies, API keys, and credentials embedded in URLs can end up in terminal history, ticket systems, screenshots, logs, or chat messages. The builder warns when it sees several common credential-bearing header names, but it cannot recognize every proprietary secret format. Redact sensitive values before sharing a generated command.
Request limits worth knowing
- GET request bodies are unusual and may be ignored or rejected by intermediaries or servers.
- HEAD bodies are not generated because this builder uses curl's dedicated
--headbehavior. - The browser does not test DNS, TLS, redirects, CORS, authentication, or the endpoint response.
- Multiline text can be represented in a POSIX single-quoted argument, but binary data containing NUL bytes cannot be passed as a normal shell argument.
Authoritative references
curl's own manual defines --request, --head, --header, and --data-raw, including the important differences between them. HTTP field-name syntax and request semantics are defined by the HTTP specifications.