cURL Command Builder

Back

1. Request

Never sent

Method

URL

Query parameters

Headers

Body

Authentication

2. Command

Text only — not executed

Shell

Bash PowerShell Command Prompt

Include secret values (tokens, passwords, keys)

Enter a URL to start.

curl command (copied and downloaded exactly as shown)

HTTP request preview

About this tool

About cURL Command Builder

cURL Command Builder turns a request — URL, method, query parameters, headers, body and authentication — into a curl command for Bash, PowerShell or Windows Command Prompt, with quoting designed for each shell. It also shows a plain HTTP request preview. Secret values are replaced by placeholders unless you choose to include them.

Hand-written curl commands often break on quotes, ampersands, percent signs or line breaks, and differ between shells. Building them from fields avoids those mistakes and keeps credentials out of shared snippets.

How to use

Step by step

Enter the URL and choose the method.
Add query parameters and headers as needed.
Choose a body type and fill it in.
Choose an authentication type and enter credentials.
Pick the shell, decide whether to include secrets, then copy or download the command.

Key features

What it offers

Bash, PowerShell (curl.exe) and Command Prompt output
Shell-specific quoting for quotes, %, &, | and more
JSON, multipart form, URL-encoded and raw text bodies
Bearer, Basic and API-key authentication
Secrets masked by default; explicit option to include them
Header-injection and malformed-URL checks

Best practices

Tips for best results

Share commands with secrets hidden, and add them only when you run it.
Prefer environment variables for tokens in scripts you keep.
Use Bash or PowerShell for multi-line bodies.
Check the HTTP preview to confirm headers and body.

Benefits

Why people use it

Correct quoting

Built for each shell.

Safer sharing

Secrets hidden by default.

Clear

See the HTTP request too.

Private

Nothing is sent or stored.

FAQ

Common questions

No. It only writes the command text. Nothing is executed, no request is made and nothing you type is stored or sent.

Secret values — bearer tokens, Basic-auth passwords, API keys and headers, parameters or form fields with names such as token, secret, password or cookie — are replaced by placeholders such as <TOKEN> so the command is safe to share. Tick “Include secret values” to put the real values in the command and downloads.

Bash uses single quotes with '\'' for embedded quotes. PowerShell uses single quotes with doubled quotes and runs curl.exe. Command Prompt uses double quotes, writes each embedded quote as \^" outside the quotes so the shell can never be broken out of, and writes % as ^% outside the quotes so it is never treated as a variable.

In Windows PowerShell, “curl” is an alias for Invoke-WebRequest, which takes different options. curl.exe runs the real curl. The command is written for PowerShell 7.3 or later; Windows PowerShell 5.1 can strip double quotes inside arguments, which affects JSON bodies.

Command Prompt cannot pass line breaks inside an argument. JSON bodies are compacted to one line automatically; for multi-line raw text, use Bash or PowerShell or put the body in a file.

Line breaks and other control characters in header values, query parameters and credentials, because they could inject extra headers. Header names must be valid HTTP tokens, and the URL must be a full http:// or https:// address without embedded credentials.

Multipart form fields use --form-string, so values starting with @ or < are sent as text instead of being read as files. URL-encoded fields are encoded and sent with --data-raw.

Related tools

HTTP Header Parser

Paste raw HTTP headers to parse them into name/value pairs with duplicate and invalid-line detection.

Launch tool

URL Encoder

Percent-encode text for safe use in URLs and query strings, in real time.

Launch tool

URL Parser

Break a URL into protocol, host, port, path, query, hash, and parameters.

Launch tool

Private by design

This runs entirely in your browser

No file or text you enter here is uploaded. Encoding and decoding happen on your device using native browser APIs — close the tab and nothing remains on a server.

How privacy works