Build a correct curl command from a form: method, headers, auth, JSON or multipart body, and options. Quoting handled for Bash, PowerShell and CMD.
This cURL command builder turns a form into a correct, copy-ready curl command. Choose an HTTP method, add headers and authentication, attach a JSON body or a multipart upload, set the options you need, and the command is generated live — correctly quoted and line-wrapped for Bash, PowerShell or Windows CMD, each of which escapes strings differently. It also generates the install command for curl on Windows, macOS and Linux if you do not have it yet. Everything runs in the browser; nothing you type is transmitted anywhere and no request is ever sent from this page.
The reason to use a builder rather than typing from memory is quoting. A JSON body containing double quotes works one way in Bash, another in PowerShell (where curl may also be an alias for Invoke-WebRequest unless you call curl.exe), and a third in CMD. Most “curl doesn’t work on Windows” problems are shell quoting, not curl.
\, backtick, or ^).Content-Type: application/json, Accept: application/json and User-Agent.| Flag | Long form | What it does |
|---|---|---|
-X | --request | Sets the HTTP method. Often unnecessary: -d already implies POST. |
-H | --header | Adds a request header. Repeat for each one. |
-d | --data | Sends a request body and implies POST. Defaults to application/x-www-form-urlencoded unless you set Content-Type. |
--data-raw | — | Like -d but does not treat a leading @ as a filename. Safer for arbitrary strings. |
--data-urlencode | — | Percent-encodes each field before sending. The right choice for form values containing spaces or symbols. |
-F | --form | Sends multipart/form-data. Use -F "file=@/path/to/file" to attach a file. |
-u | --user | HTTP Basic authentication as user:password. |
-o | --output | Writes the response body to a named file. |
-O | --remote-name | Saves using the filename from the URL. |
-L | --location | Follows redirects. Without it curl prints the 301 and stops. |
-i | --include | Includes response headers in the output. |
-I | --head | Sends a HEAD request — headers only, no body. |
-v | --verbose | Prints the full request and response exchange, including the TLS handshake. The first thing to reach for when debugging. |
-s | --silent | Suppresses the progress meter. Standard in scripts. |
-k | --insecure | Disables TLS certificate verification. See the warning below. |
--compressed | — | Requests a compressed response and decompresses it transparently. |
-C - | --continue-at | Resumes an interrupted download from where it stopped. |
--max-time | — | Hard ceiling in seconds on the whole operation. |
--retry | — | Retries transient failures the given number of times. |
-x | --proxy | Routes the request through a proxy. |
-k tells curl to accept any TLS certificate without verifying it — expired, self-signed, wrong hostname, or issued by an attacker. It does not fix a certificate problem; it hides one, and it removes the protection that makes HTTPS meaningful, leaving the connection open to interception.
Use it only as a deliberate, temporary diagnostic on a controlled system: confirming that a service is reachable at all before you deal with its certificate, or testing a host whose certificate you know is self-signed. Never put it in a script, a deployment, a container image, a CI job or anything that runs unattended. If you need curl to trust a private CA, do that properly with --cacert /path/to/ca.pem, which keeps verification switched on. The builder flags -k with a warning whenever you enable it, for exactly this reason.
POST JSON with a bearer token (Bash):
curl -X POST "https://api.example.com/v1/users" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9..." \
-d '{"name":"Ada Lovelace","role":"admin"}' \
-iThe same request in PowerShell, where single quotes do not interpolate and the continuation character is a backtick. Note curl.exe rather than curl, so PowerShell does not route the call to Invoke-WebRequest:
curl.exe -X POST "https://api.example.com/v1/users" `
-H "Content-Type: application/json" `
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9..." `
-d '{\"name\":\"Ada Lovelace\",\"role\":\"admin\"}' `
-iMultipart file upload:
curl -X POST "https://api.example.com/v1/documents" \
-H "X-API-Key: abc123" \
-F "file=@/home/me/report.pdf" \
-F "title=Q3 Report"Do not set Content-Type: multipart/form-data by hand when using -F. curl generates the header along with the boundary string; overriding it produces a body the server cannot parse, which is one of the more baffling upload failures to debug.
Resumable download through a proxy, with a timeout and retries:
curl -L -O -C - \
--max-time 600 \
--retry 3 \
-x http://proxy.internal:3128 \
"https://releases.example.com/app-2.4.1.tar.gz"Add -v first. It shows DNS resolution, the TLS handshake including the certificate chain, every request header curl actually sent, and the full response status line and headers. Most failures identify themselves immediately: a 401 means the auth header is wrong or missing, a 415 means the Content-Type does not match the body, a 301 with no -L means you are reading the redirect rather than the target, and a TLS error before any HTTP exchange means a certificate or protocol problem rather than an application one.
Two more habits worth adopting. Use -w "\n%{http_code} %{time_total}s\n" to print the status code and timing without parsing the body. And in scripts, combine -sS so the progress meter is suppressed but errors still print, and add -f so an HTTP error status makes curl exit non-zero — without it, a script will happily treat a 500 response body as success.
Once you have a response, the JSON formatter makes it readable, the JWT decoder unpacks the bearer token you are sending, and the Base64 encoder and decoder handles the Basic auth string. If a request is failing at the network layer rather than the application layer, start with the DNS lookup tool and the SSL certificate checker.
No. It only generates command text. Nothing is executed and nothing you type — including tokens, passwords and URLs — leaves your browser.
Quoting and escaping differ. PowerShell handles single and double quotes differently from Bash, uses a backtick for line continuation, and may alias curl to Invoke-WebRequest. Select PowerShell as the shell in the builder, and call curl.exe explicitly.
-d sends a raw body, defaulting to URL-encoded form content, and is what you use for JSON APIs. -F sends multipart/form-data, which is what you need for file uploads.
No. -d already switches the method to POST. Adding -X POST is harmless but redundant — and adding -X alongside -L can cause surprises, because it forces the original method to be reused on the redirect.
Only as a deliberate one-off diagnostic on a system you control. It switches off TLS certificate verification entirely, so the connection can be intercepted without any warning. To trust a private CA properly, use --cacert instead and keep verification enabled.
Use -F "field=@/path/to/file". The @ tells curl to read the file’s contents. Let curl set the Content-Type header itself.
As a header: -H "Authorization: Bearer <token>". Select Bearer in the auth section and the builder adds it for you. Avoid putting tokens directly in shell history — read them from an environment variable in real scripts.
Usually a redirect that you are not following — add -L. Failing that, the server may be varying on User-Agent, or requiring a cookie or header the browser sends automatically. Run with -v to see exactly what came back.
Yes, with -C -, provided the server supports range requests. Combine it with -L -O for the usual download pattern.
Probably not. curl ships with Windows 10 build 1803 and later, with macOS, and with nearly every Linux distribution. The Install mode covers winget, Chocolatey, Scoop, Homebrew, apt, dnf, yum and apk if you need a newer build than the one you have.
curl is the de facto standard command-line tool for making HTTP requests — testing APIs, downloading files, debugging webhooks, and scripting integrations. It ships with Windows 10 (1803+), macOS, and virtually every Linux distribution, but its dozens of flags and shell-specific quoting rules make commands fiddly to write by hand.
This tool builds complete curl commands from a simple form: choose a method, add headers and authentication, attach a body, and copy a command formatted correctly for your shell. It also generates the install commands for platforms where curl is missing.
PowerShell aliases curl to Invoke-WebRequest. In Windows PowerShell 5.1, typing curl does not run curl at all — it runs a different cmdlet with incompatible flags. Generated PowerShell commands use curl.exe explicitly to bypass the alias.
Quoting rules differ by shell. Bash and zsh use single quotes for literal strings; PowerShell treats single quotes literally but uses backticks for line continuation; cmd.exe only supports double quotes and uses ^ for continuation. JSON request bodies are the most common casualty — a body that works in bash will silently mangle in cmd.exe without re-quoting.
Never use -k (insecure) outside of local development. Disabling certificate verification removes the protection TLS provides. If a certificate fails validation, fix the certificate or trust chain instead.
Prefer --data-urlencode for form data with special characters. Manually URL-encoding values is error-prone; let curl do it.
Use -sS in scripts. Silent mode (-s) suppresses the progress bar that pollutes logs, while -S keeps real errors visible.
Set explicit timeouts in automation. Without --max-time, a hung server can stall a script indefinitely. Pair it with --retry for resilient health checks.
Keep credentials out of shell history. Tokens passed with -H "Authorization: Bearer ..." end up in your shell history file. For sensitive workflows, read tokens from environment variables or use --netrc.
Usually not. Windows 10 build 1803 (April 2018) and later ship curl.exe in C:\Windows\System32, so it works out of the box in Command Prompt and PowerShell. Run curl --version to confirm. If you want the newest release, install it with winget (winget install cURL.cURL), Chocolatey, or Scoop.
In Windows PowerShell 5.1, curl is an alias for the Invoke-WebRequest cmdlet, which uses completely different parameters than real curl. That is why curl commands copied from tutorials often fail. Call curl.exe explicitly to run the actual curl binary. This tool always emits curl.exe for the PowerShell target. PowerShell 7+ removed the alias.
Set the method to POST, add a Content-Type: application/json header, and pass the body with -d. For example: curl -X POST -H "Content-Type: application/json" -d '{"name":"Ada"}' https://api.example.com/users. On Windows cmd.exe, escaping JSON is painful, so consider saving the body to a file and using -d @body.json instead.
For a Bearer token, send an Authorization header: -H "Authorization: Bearer YOUR_TOKEN". For an API key, most APIs expect a custom header such as -H "X-API-Key: YOUR_KEY". Basic authentication uses -u username:password instead. This builder generates all three from the Authentication section.
Use curl -L -O https://example.com/file.zip. The -O flag saves the file using its remote name, and -L follows any redirects to the real download URL. To save under a different name use -o myname.zip. To resume an interrupted download, add -C - so curl continues where it left off.
The -k or --insecure flag tells curl to skip TLS certificate validation, so it will connect even if the certificate is self-signed, expired, or mismatched. This removes the protection against man-in-the-middle attacks, so only use it for local development against test servers. Never use -k against production endpoints or when transmitting secrets.
bash and zsh use single quotes around values, which preserve everything literally. PowerShell also uses single quotes but doubles any inner single quote. cmd.exe has no single-quote support, so values are wrapped in double quotes with inner double quotes doubled. Line continuations differ too: bash uses a trailing backslash, PowerShell a backtick, and cmd.exe a caret (^). Select your shell in the builder and it generates the correct syntax.
Add -L to follow HTTP 3xx redirects to the final URL, and -i to include the response headers in the output along with the body. Use -I (capital i) to fetch only the headers with a HEAD request. Combine with -v for full verbose output that shows the request and TLS handshake, which is invaluable for debugging.