How to parse a curl command
Paste a curl command into the input pane on the left — copied straight from a terminal, browser devtools "Copy as cURL", or API documentation. The tool tokenises it and shows two things: a structured breakdown of every part (method, URL, host, path, query parameters, each header, each cookie and the body) and a ready-to-run JavaScript fetch() snippet on the right. Copy the snippet with one click. Everything runs in your browser; nothing is uploaded.
Why parse a curl command at all?
A real-world curl command is dense and easy to misread: a single line might carry a dozen -H headers, a long bearer token, a cookie jar, query parameters and a JSON body, all wrapped in a mix of single and double quotes. When you need to understand what a request actually sends — to debug a failing API call, to document an endpoint, or to reproduce a request in code — eyeballing that line is slow and error-prone. Breaking it into a labelled table makes the request legible in seconds: you can see exactly which headers are set, what the content type is, and what the payload contains.
Converting to fetch() closes the most common loop of all. Browser devtools and tools like Postman export requests as curl, but you usually want them back as code. This tool turns the command into a JavaScript call you can paste into a script or a console, with the method, headers and body already filled in. Because the conversion is deterministic, the same command always produces the same snippet.
Flags and method rules
The parser understands the curl flags people actually use: -X/--request for the method, -H/--header for headers, -d/--data (and --data-raw, --data-binary, --data-urlencode) for the body, -F/--form for multipart fields, -u/--user for basic auth, -b/--cookie for cookies, -G/--get to move data into the query string, -A for user-agent, -e for referer, -I/--head for HEAD requests and --url for the target. Transfer-only flags such as -L, -k, -s, -v and --compressed are recognised and skipped because they do not change the request that gets sent.
The HTTP method follows curl's own logic: an explicit -X always wins; otherwise it is HEAD when -I is given, POST when a body or form is present, and GET when there is none. A basic-auth -u user:pass is turned into an Authorization: Basic header, and when you send raw data without setting a content type, the conventional application/x-www-form-urlencoded is assumed — exactly what curl does.
Quotes and line continuations handled
The hard part of reading curl is the shell quoting, and this tool ships its own tokenizer for it. Single quotes are treated literally; double quotes allow backslash escapes for ", \\, $ and backtick; and a backslash before a newline joins lines, so the multi-line commands you copy from documentation parse exactly as the shell would interpret them. Flags written as --header=value are accepted alongside the spaced form, and an unrecognised flag is skipped rather than breaking the parse.
Why a local curl parser matters
curl commands are among the most secret-laden text a developer handles. A typical one contains a live Authorization: Bearer token, an API key in a header, session cookies, or basic-auth credentials in plain sight. Pasting that into an online converter ships working credentials to a third-party server, where they may be logged or cached — a credential leak in the most literal sense. This is exactly the kind of data you should never hand to a remote service or a chatbot.
This tool removes the risk entirely. The tokenizer and converter are plain JavaScript that run inside your own browser tab — no network request, no logging, no account. Close the tab and the command, with its tokens, is gone. That is the gitime.dev approach across the board: deterministic, dependency-light developer tools that keep your data on your machine, because reading a request never needs to leave your device to happen.
- Structured breakdown: method, URL, query, headers, cookies, body.
- fetch() generation with method, headers and body filled in.
- Shell-aware: quotes, escapes and line continuations handled.
- curl-faithful method inference and content-type defaults.
- Everything stays on your device — no upload, no logging.
Frequently asked questions
- Is my curl command uploaded anywhere?
- No. Parsing runs in your browser with a self-contained tokenizer. Tokens, keys and cookies never leave your device.
- Which curl flags are understood?
- -X, -H, -d and variants, --data-urlencode, -F, -u, -b, -G, -A, -e, -I and --url. Display flags like -L, -k, -s are ignored.
- How does it decide the HTTP method?
- -X wins; otherwise HEAD for -I, POST when there is a body or form, GET when there is none.
- Does it handle quotes and line continuations?
- Yes. Single and double quotes, backslash escapes and backslash-newline continuations are all supported.