cURL to Fetch Converter

cURL to Fetch example

A typical JSON request uses an explicit method, a content type, an authorization header, and a request body:

curl -X POST https://api.example.com/v1/users \
  -H 'Authorization: Bearer test-token' \
  -H 'Content-Type: application/json' \
  -d '{"name":"Ada","active":true}'

The result calls fetch() with method: "POST", a JavaScript headers object, and a JSON-stringified body. It then checks response.ok because Fetch resolves its promise even when an HTTP response has a 404 or 500 status. The generated code reads the response as text so it remains correct for JSON, HTML, empty responses, and other payload types. Change response.text() to response.json() only when the API contract guarantees JSON.

Supported cURL options

The converter handles the most common request-building options: -X or --request for the method, -H or --header for headers, -d, --data, --data-raw, and literal --data-binary values for bodies, -u or --user for Basic authentication, -I for a HEAD request, and -L for redirect following. Silent and compressed-output flags are safely ignored because they control cURL output rather than the browser request.

When body data is present without an explicit method, cURL behaves like a POST request, so the generated Fetch request does the same. A body without a content type receives application/x-www-form-urlencoded, matching cURL’s default for --data. Multiple data values are joined with an ampersand. JSON is formatted inside JSON.stringify() only when the command declares an application/json content type and the body is valid JSON.

Browser differences and limitations

A command that works in a terminal may still fail in a browser. Browsers enforce Cross-Origin Resource Sharing, so the target API must allow the site origin, HTTP method, and requested headers. cURL has no equivalent browser-origin restriction. The converter cannot bypass CORS and does not add a proxy.

Browsers also control headers such as Cookie, Host, and Content-Length. Cookie files, client certificates, insecure TLS mode, multipart forms, file-backed bodies such as @payload.json, and --data-urlencode do not have a safe one-to-one translation in this first version. Cryonel reports those options instead of silently generating code with different behavior. For cookie-authenticated APIs, configure the server’s CORS and cookie policy, then deliberately add credentials: "include" after reviewing the security impact.

Security and privacy

cURL commands often contain bearer tokens, API keys, Basic authentication credentials, and private payloads. This tool parses the text entirely in the current browser tab and does not execute the URL. Generated code can still contain those secrets in plain text. Remove or replace credentials before sharing, committing, logging, or pasting the result into an issue. Prefer short-lived development credentials and environment-based secret injection in real applications.

Common conversion errors

• Unclosed quote: match each single or double quote in the original shell command.
• Unsupported option: simplify the command to its URL, method, headers, and literal body, then add browser-specific behavior manually.
• GET or HEAD body: Fetch rejects these bodies. Move the values into URL query parameters or use the API’s documented method.
• Forbidden header: let the browser manage the header, or move the request to a trusted server when browser restrictions make it impossible.
• CORS failure: update the target API’s allowed origins and headers. A client-side converter cannot grant permission on behalf of that server.