cURL Command Parser

Break an HTTP(S) cURL command into method, URL, headers, cookies, body data, and supported transfer flags.

cURL Command

Paste a cURL command copied from browser DevTools, API docs, terminal history, Postman, Insomnia, logs, or a debugging note.

Parsing Options

Output Format

Mask recognized secretsMask recognized sensitive headers, cookies, query keys, URL credentials, and --user passwords in copied output. Body text is left unchanged.Decode query valuesPercent-decode query names and values. A literal + stays + because URI queries do not universally treat it as a space.Pretty print JSON bodyFormat valid JSON for the on-page preview only; copied raw HTTP keeps the original body text.

cURL Command Builder

Parsed Output

Parsed cURL output will appear here.

Parsing runs in your browser and does not send the command to the target URL. Masking is intended for copied output; body text is not automatically scrubbed for secrets.

Reading the Request Hidden Inside a cURL Command

A copied cURL command mixes shell quoting with curl options and HTTP details. Separating those layers matters: -H adds a header, -d contributes request data, -L changes redirect behavior, and -k changes TLS verification rather than the HTTP message itself.

The parser handles one HTTP or HTTPS transfer written with ordinary POSIX-style shell quoting. It deliberately stops on options whose request semantics cannot be reconstructed safely, instead of silently inventing a request.

What Is Parsed Exactly

Method selection from -X, body options, -G, and -I.
HTTP(S) URL, raw path, query pairs, request headers, Cookie values, user agent, redirect and TLS flags.
--data, --data-raw, --data-binary, simple --data-urlencode, --json, and multipart form expressions.
Separate connect and total timeout values when those options are present.

Where Text Parsing Has to Stop

curl can read request data from files, expand its own variables, perform several transfers in one command, negotiate authentication, and build multipart MIME bodies at runtime. A browser parser cannot reproduce those effects from command text alone. File-backed bodies, multiple URLs, --next, and unsupported transfer-changing options therefore produce an error rather than a plausible-looking but wrong result.

Shell variables, command substitution, globbing, PowerShell escaping, and Windows CMD quoting are not executed. If a command depends on them, the parsed text is not necessarily the request that a shell would eventually give curl.

Data Flags Are Not Interchangeable

curl joins repeated ordinary data options with an ampersand. --data-raw differs from --data because a leading @ is literal instead of a file reference. Repeated --json pieces are different: curl concatenates them directly and also supplies JSON Accept and Content-Type headers when you have not overridden them. Multipart --form is different again because curl generates a MIME boundary while sending the request.

Credentials Need Context

An explicit Authorization header can be shown as a header. --user user:password is different: it supplies credentials to curl's authentication machinery, so this page does not fabricate a Basic Authorization header from the plain user:password text.

Masking covers recognized header names, cookies, credential fields, URL user information, and sensitive-looking query keys. It cannot reliably discover secrets hidden in arbitrary request-body text. Replace real credentials before sharing the original command.

Empty and Suppressed Headers Are Different in curl

curl gives -H "Name:" and -H "Name;" different meanings. The colon form suppresses an internal header; the semicolon form sends that header with an empty value. The parsed header table keeps that distinction because collapsing both to an empty string would change the request model.

Primary References

curl's current option behavior is documented in the official curl man page. HTTP method and field semantics are defined by RFC 9110.