Curl Generator: what it does and how to use it

curl is the fastest way to describe an HTTP request precisely, and the easiest thing in the world to get subtly wrong. This generator builds the command from a form - method, URL, query parameters, headers, authentication, and a JSON, form-data or URL-encoded body - and updates the output on every keystroke so you can see exactly which flag each option adds. The part it takes seriously is quoting: values are escaped for the shell you actually use, so a token containing a dollar sign, a password with a space, or a JSON body with an apostrophe are passed through literally instead of being mangled or expanded by the shell. It also leaves out redundant flags, so you get the command an experienced user would have written rather than a noisy one.

You should not have to open an IDE to format a snippet from Slack, tidy a JSON blob, or check a hash. Paste it here, copy the result, move on.

Curl Generator is a good fit when turning an API doc example into a command you can actually run.

The useful part

Curl Generator is built around a few practical wins, not a long feature list:

• Quotes every value for the shell you selected, so tokens and passwords with special characters survive intact.
• Uses the correct line-continuation character per shell - the wrong one silently runs only the first line.
• Leaves out redundant flags such as -X POST alongside -d, so the command teaches good habits.
• Validates a JSON body as you type, before you paste a broken request into a terminal.
• Never overrides a Content-Type you set yourself.
• Runs entirely in your browser - your URLs, tokens and request bodies are never sent anywhere.

Do this, in order

1. Pick a method and enter the URL. GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS.
2. Add query parameters. Entered as name and value pairs and URL-encoded for you, so spaces and ampersands are safe.
3. Add headers or authentication. Bearer tokens become an Authorization header; basic auth uses curl -u so curl does the encoding.
4. Choose a body type. JSON is validated as you type. Form data supports file uploads with the @ prefix.
5. Pick your shell and copy. bash/zsh, PowerShell or cmd.exe. The quoting and the line-continuation character change to match.

Who it is for

• Turning an API doc example into a command you can actually run.
• Sharing a reproducible request in a bug report or with a teammate.
• Building a request for a CI script or a cron job.
• Learning which curl flag corresponds to which part of an HTTP request.
• Testing an endpoint quickly without opening a heavier API client.

If you want a clean result

• Pick the right shell before copying. PowerShell and cmd need different quoting and continuations from bash, and a command copied from one into the other often fails in confusing ways.
• Use -i while debugging so you can see status codes and response headers, not just the body.
• Prefix a form value with @ to upload a file: @/path/to/photo.png.
• Only use -k when testing against a self-signed certificate. It disables TLS verification entirely, so never leave it in a script that touches production.

Common mix-ups

• Copying a bash command into PowerShell. The backslash continuations and single quotes do not carry over.
• Writing your own base64 Authorization header instead of using -u, which breaks with non-ASCII passwords.
• Adding -X POST alongside -d, which is redundant and can cause surprising behaviour after a redirect.
• Leaving a real API token in a command pasted into a public issue or chat.

Private by default

Curl Generator runs in your browser. The file or text you paste stays on your device. There is no account, and nothing is stored on a ToolBox server for this job.

Related tools worth opening next

If this is one step in a longer job, these usually come after it:

• API Tester - Send HTTP requests to any REST API and inspect the response - works with public endpoints and your localhost dev server
• HTTP Header Viewer - Fetch a URL and inspect its response headers
• JSON Formatter - Format and validate JSON data

Before you ask

Does this send my request anywhere?

No. It only builds the text of a command. Nothing is executed and nothing is transmitted - the URL, headers, tokens and body you type never leave your browser. Running the command is entirely up to you, in your own terminal.

Why does it not add -X POST when I choose POST?

Because curl already switches to POST as soon as a body is present with -d. Adding -X POST as well is redundant, and it can change behaviour after a redirect in ways people do not expect. The flag is only emitted when it actually changes the request.

Which shell should I choose?

Whichever you will paste into. bash/zsh covers Linux, macOS and WSL. PowerShell and cmd.exe are different enough that a bash command usually fails in them - the quoting rules and the line-continuation character are both different.

How do I upload a file?

Choose the Form data body type and prefix the value with an @, for example @/tmp/photo.png. That is curl syntax for reading the field value from a file.

Is basic auth safe here?

The command uses curl -u, which lets curl do the encoding correctly, including for non-ASCII passwords. Remember that basic auth only protects credentials in transit if the URL is https, and be careful about pasting real credentials anywhere public.

What is the difference between form data and URL encoded?

Form data (-F) sends multipart/form-data and is what you need for file uploads. URL encoded (--data-urlencode) sends application/x-www-form-urlencoded, which suits simple key and value pairs and is what most HTML forms post.

Can I paste an existing curl command in to edit it?

Not currently - this builds a command from the form rather than parsing one. If you need to modify an existing command, fill in the fields to match and copy the fresh output.

Open the Curl Generator when you are ready. It is free, and you do not need an account.