Tool
curl to Python and JavaScript converter
Paste a curl command and get ready-to-run Python requests or JavaScript fetch code — headers, body, auth and timeouts translated, sensitive values can be redacted to env vars, all in your browser.
Convert
Processing: conversion runs entirely in this browser tab — your command is never sent or stored. Do not paste real keys or credentials.
What the converter covers
The parser understands the common curl syntax: -X/--request, repeated -H headers, -d/--data-raw/--data-binary/--data-urlencode bodies (multiple flags join with &, exactly like curl), -F multipart fields, -u basic auth, -A/-e/-b convenience headers, -G (move the body into the query string), -I (HEAD), -m/--connect-timeout and -k. Quoting survives the paste too — single quotes, double quotes, $'...' ANSI-C strings and backslash line continuations are all tokenized the way a shell would.
Bodies that parse as JSON become json= in Python and JSON.stringify() in fetch; everything else stays a raw string. Flags that bind to your local machine — -x proxies, --resolve, client certs, -K config files — are listed as ignored rather than silently producing wrong code. Checking "redact" rewrites sensitive header values and basic-auth credentials as os.environ/process.env lookups. Browser fetch has no equivalent of -k (TLS bypass), so that flag produces a note instead of fake code.
FAQ
Is my pasted command sent anywhere?
No. Tokenizing, parsing and code generation all run inside this browser tab — nothing is uploaded, stored or written into a URL. Closing the tab discards it.
Which curl flags are supported?
The common request syntax: -X/--request, -H headers, -d/--data-raw/--data-binary/--data-urlencode bodies, -F multipart fields, -u basic auth, -A/-e/-b shortcut headers, -G, -I, timeouts and -k. Flags bound to your machine (proxies, --resolve, client certs, -K config files) are listed as ignored instead of producing wrong code.
Why does my JSON body sometimes stay a raw string?
json=/JSON.stringify is only emitted when the body actually parses as JSON and the Content-Type is either missing or JSON. If you send JSON-shaped text under a different content type, the body is preserved verbatim so the request behaves identically.
What does the redact option change?
Headers that look sensitive (Authorization, Cookie, API keys, tokens) and -u credentials are rewritten as environment variable lookups — os.environ in Python, process.env in fetch — with a name derived from the header. The real value never appears in the output, so the snippet is safe to paste into issues or docs.