Free curl command builder: set URL, method, headers, auth, and body, then copy a ready-to-run command with correct quoting for bash, PowerShell, or cmd.exe. Plus install-curl steps for Windows, macOS, and Linux.
curl is the de facto standard command-line tool for making HTTP requests — testing APIs, downloading files, debugging webhooks, and scripting integrations. It ships with Windows 10 (1803+), macOS, and virtually every Linux distribution, but its dozens of flags and shell-specific quoting rules make commands fiddly to write by hand.
This tool builds complete curl commands from a simple form: choose a method, add headers and authentication, attach a body, and copy a command formatted correctly for your shell. It also generates the install commands for platforms where curl is missing.
PowerShell aliases curl to Invoke-WebRequest. In Windows PowerShell 5.1, typing curl does not run curl at all — it runs a different cmdlet with incompatible flags. Generated PowerShell commands use curl.exe explicitly to bypass the alias.
Quoting rules differ by shell. Bash and zsh use single quotes for literal strings; PowerShell treats single quotes literally but uses backticks for line continuation; cmd.exe only supports double quotes and uses ^ for continuation. JSON request bodies are the most common casualty — a body that works in bash will silently mangle in cmd.exe without re-quoting.
Never use -k (insecure) outside of local development. Disabling certificate verification removes the protection TLS provides. If a certificate fails validation, fix the certificate or trust chain instead.
Prefer --data-urlencode for form data with special characters. Manually URL-encoding values is error-prone; let curl do it.
Use -sS in scripts. Silent mode (-s) suppresses the progress bar that pollutes logs, while -S keeps real errors visible.
Set explicit timeouts in automation. Without --max-time, a hung server can stall a script indefinitely. Pair it with --retry for resilient health checks.
Keep credentials out of shell history. Tokens passed with -H "Authorization: Bearer ..." end up in your shell history file. For sensitive workflows, read tokens from environment variables or use --netrc.
Usually not. Windows 10 build 1803 (April 2018) and later ship curl.exe in C:\Windows\System32, so it works out of the box in Command Prompt and PowerShell. Run curl --version to confirm. If you want the newest release, install it with winget (winget install cURL.cURL), Chocolatey, or Scoop.
In Windows PowerShell 5.1, curl is an alias for the Invoke-WebRequest cmdlet, which uses completely different parameters than real curl. That is why curl commands copied from tutorials often fail. Call curl.exe explicitly to run the actual curl binary. This tool always emits curl.exe for the PowerShell target. PowerShell 7+ removed the alias.
Set the method to POST, add a Content-Type: application/json header, and pass the body with -d. For example: curl -X POST -H "Content-Type: application/json" -d '{"name":"Ada"}' https://api.example.com/users. On Windows cmd.exe, escaping JSON is painful, so consider saving the body to a file and using -d @body.json instead.
For a Bearer token, send an Authorization header: -H "Authorization: Bearer YOUR_TOKEN". For an API key, most APIs expect a custom header such as -H "X-API-Key: YOUR_KEY". Basic authentication uses -u username:password instead. This builder generates all three from the Authentication section.
Use curl -L -O https://example.com/file.zip. The -O flag saves the file using its remote name, and -L follows any redirects to the real download URL. To save under a different name use -o myname.zip. To resume an interrupted download, add -C - so curl continues where it left off.
The -k or --insecure flag tells curl to skip TLS certificate validation, so it will connect even if the certificate is self-signed, expired, or mismatched. This removes the protection against man-in-the-middle attacks, so only use it for local development against test servers. Never use -k against production endpoints or when transmitting secrets.
bash and zsh use single quotes around values, which preserve everything literally. PowerShell also uses single quotes but doubles any inner single quote. cmd.exe has no single-quote support, so values are wrapped in double quotes with inner double quotes doubled. Line continuations differ too: bash uses a trailing backslash, PowerShell a backtick, and cmd.exe a caret (^). Select your shell in the builder and it generates the correct syntax.
Add -L to follow HTTP 3xx redirects to the final URL, and -i to include the response headers in the output along with the body. Use -I (capital i) to fetch only the headers with a HEAD request. Combine with -v for full verbose output that shows the request and TLS handshake, which is invaluable for debugging.