fetch to cURL
Convert a static fetch call into a redacted cURL command without evaluating JavaScript.
How it works & useful details
Local-only workspace
This tool converts or inspects pasted text in your browser. It never sends a request, opens a URL, uploads a HAR, or stores your input.
Static fetch subset
Only quoted URL/string literals and static method, headers, body, and JSON.stringify values are read. No JavaScript is evaluated.
About this tool
fetch to cURL converts a static JavaScript fetch call into a cURL command so you can reproduce a request in a terminal, bug report, or API test. It parses the call as text, which means no code is executed and no network request is made.
Because the input is treated as inert source, the tool reports what it could not understand instead of guessing. Sensitive values are redacted by default, keeping tokens and cookies out of the generated command unless you add them back deliberately.
How to use it
- Paste the fetch call, including its options object if there is one.
- Review the parsed method, URL, headers, and body.
- Generate the cURL command and read the notes about anything skipped.
- Copy the command and re-enter credentials where you need real values.
Worked example
fetch('https://api.example.com/v1/notes', {
method: 'POST',
headers: { 'Content-Type': 'application/json', Authorization: 'Bearer example-token' },
body: JSON.stringify({ title: 'Morning notes' })
})becomes
curl \
--request 'POST' \
--header 'Content-Type: application/json' \
--header 'Authorization: [redacted]' \
--data-raw '{"title":"Morning notes"}' \
'https://api.example.com/v1/notes'JSON.stringify with a literal object is serialized into the body. Long options (--request, --header) make the command self-explanatory in documentation and bug reports.
Why only static code is read
The converter reads string literals and object literals. It never runs JavaScript, so variables, template literals with expressions, and function calls other than JSON.stringify are rejected instead of evaluated. Pasting code you do not trust is therefore safe, and the output always reflects exactly what was written.
A reproducible cURL command is the most useful thing to attach to an API bug report. The person receiving it can run the request in any terminal without your front-end code. Keep the redaction on when sharing, and send the real token through a secure channel if it is needed at all.
Frequently asked questions
Is the JavaScript evaluated?
No. Expressions such as variables or function calls cannot be resolved; the tool only converts literal values it can read statically.
Does it support await, Response handling, or chained calls?
It focuses on the request itself: the URL and the init options. Response handling code is outside the scope of the conversion.
What is the limit?
Up to 40,000 characters of source. Very large embedded payloads should be converted separately.
Are single quotes in the body escaped for the shell?
Yes. Values are single-quoted for POSIX shells, with embedded single quotes escaped, so the command can be pasted into bash or zsh as it is. Windows cmd.exe uses different quoting rules.