cURL to Fetch

Convert cURL commands to JavaScript fetch() or axios calls instantly.

Output Target

Premium Formatting Panel

cURL command · stays on your device, never in the shared link

Looks like this contains credentials. They are converted in this tab only — not uploaded, and not included in the link that Share or Copy link produces.

JavaScript (fetch)

Convert cURL to JavaScript fetch or axios

Paste any cURL command — with headers, request body, and HTTP method flags — and get the equivalent JavaScript fetch() or axios call. Supports -X, -H, -d, and multiline commands with backslash continuation. To encode URL parameters, try URL Encoder or parse query strings with URL Parser.

Built and maintained by Meet Shah · Last updated 2 August 2026

What this tool is used for

Converting a curl example into a browser fetch call.
Reproducing a captured request in a front-end codebase.
Getting the headers and body shape right for a POST.
Producing a snippet to paste into a console for testing.
Comparing the fetch and Axios forms of the same request.

How it works in practice

A worked example

A colleague sent a curl command that reproduces a bug, and you need the same request running inside a browser console.

Input

curl -X POST https://api.example.com/v1/orders \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sk_live_51H8xQ2" \
  -d "{\"sku\":\"A-1\",\"qty\":2}"

Output

tokens the parser sees:
  curl · -X · POST · https://api.example.com/v1/orders
  -H · Content-Type: application/json
  -H · Authorization: Bearer sk_live_51H8xQ2
  -d · {"sku":"A-1","qty":2}

The escaped body is where these conversions usually fall apart, so it is worth seeing the tokens before the code. A pasted command is split the way a POSIX shell would split it, which means the surrounding quotes are consumed rather than kept, a backslash-escaped quote inside them becomes a plain quote, and the whole JSON object survives as one argument. Six different tokenizers used to do this across eighteen tools and each broke somewhere; one of them split that body at the first escaped quote, producing a request nobody could send.

The edge case that catches people

This input is deliberately not in the page address, and it is the only tool here that does that. Everything else on the site encodes its state into the URL fragment so that a link reproduces the result — which is normally safe, because a fragment is never sent to a server. It is not safe when the field routinely holds a live bearer token: the Share action reads the whole address and the X intent link percent-encodes it into a query parameter, which really would transmit it. So this box is plain local state, and a header that looks like a credential gets flagged rather than shared.

When not to use this tool

For anything you intend to run outside a browser, translate the intent rather than the syntax. curl ignores the same-origin policy entirely and browser code cannot, so a command that works in a terminal may be refused before it is even sent, and no amount of correct conversion fixes that — the answer is a server-side proxy or a CORS header at the far end. Client certificates, arbitrary proxies and unsafe headers have no browser equivalent at all, so a command using them wants a Node script rather than a snippet for the console.

Frequently Asked Questions

Why doesn't fetch throw on a 404 or 500?: By design, fetch only rejects on network failure — a 404 or 500 resolves normally with response.ok === false. curl's exit code and --fail flag behave differently. You must check response.ok yourself, or every failed request will silently flow into your success path.
How do curl's cookies (-b / --cookie) translate?: They do not map directly. Browser fetch uses credentials: 'include' to send cookies cross-origin, or 'same-origin' (the default). You cannot set the Cookie header manually — it is a forbidden header name and the browser silently strips it.
Why does my request work in curl but fail in the browser?: Almost always CORS. curl is not a browser and ignores the same-origin policy entirely; fetch is subject to it. The server must return Access-Control-Allow-Origin, and for non-simple requests the browser sends a preflight OPTIONS first. No client-side change can bypass this.
Does fetch follow redirects like curl -L?: Yes — redirect: 'follow' is the default, so plain fetch already behaves like curl -L. curl WITHOUT -L does not follow redirects, so if you are porting a bare curl command you may want redirect: 'manual' to match.
How do I send a request body correctly?: Pass body as a string, FormData, URLSearchParams or Blob. Use URLSearchParams for curl's form-encoded -d, and JSON.stringify plus an explicit Content-Type: application/json header for a JSON payload — fetch will not serialise a plain object for you.

Common errors and gotchas

Assuming fetch rejects on a 4xx or 5xx, which it does not — only a network failure rejects.
Forgetting `credentials: 'include'`, without which cookies are not sent cross-origin.
Setting a content-type on a FormData body, which breaks the boundary fetch would have set.
Expecting curl's success to mean the browser will succeed, when CORS applies only in the browser.
Reading the body twice, since a response body is a stream that can only be consumed once.