Translating curl to javascript fetch by hand is tedious and easy to get subtly wrong. A forgotten content type header turns a JSON post into a form post, a -d flag quietly implies a POST even with no method given, and copying a bearer token by hand is how tokens end up in the wrong file.
Everything is parsed in your browser. That matters more here than for most tools, because the command you paste usually contains a live credential. A cookie header, an API key or an authorization token pasted into this page never crosses the network.
Which curl flags are supported
This curl to fetch converter handles the flags that appear in real commands rather than the entire curl manual. Long and short forms are both accepted, and line continuations with a trailing backslash are unwrapped first, so a multi line command pasted from documentation works unchanged.
Quoting is handled properly. Single quotes, double quotes and escaped characters inside a body are respected, which is what makes a JSON payload survive the trip intact instead of breaking at the first apostrophe.
- Method: -X and --request, plus the POST that a data flag implies on its own.
- Headers: -H and --header, repeated as many times as you like.
- Body: -d, --data, --data-raw, --data-binary and --data-urlencode.
- Authentication: -u and --user, encoded into an Authorization header.
- Behaviour: -L for redirect following, --compressed, -I for a HEAD request.
What fetch cannot do that curl can
Some flags describe things a browser will not let JavaScript control. The -k flag disables certificate verification, which no browser API exposes, and a proxy or client certificate is equally out of reach. Those flags are reported in a warnings list rather than dropped.
Other headers are forbidden by the Fetch specification even though the syntax is accepted. A browser sets Host, Origin, Referer, Connection and several others itself, and assigning them from script is ignored by design. If your request depends on one of those, it needs to run on a server rather than in a page.
Cookies behave differently too. A cookie header written by curl becomes a header in the generated code, but a browser normally attaches cookies from its own store based on the credentials option instead, so the output includes that option when a cookie is present.
How the request body is translated
A body given with -d is passed through as a string, exactly as curl would send it. When several data flags appear, curl joins them with an ampersand, and the converter does the same so the generated call sends identical bytes.
The content type is where most hand written conversions go wrong. curl defaults to application/x-www-form-urlencoded when you use -d without a header, while fetch sends no content type at all unless you set one. The generated code therefore includes that header explicitly whenever the original command relied on the curl default.
A JSON body is left as a string literal rather than being reformatted into an object. JSON.stringify on a parsed object would reorder nothing but could change number formatting, and the point of an http request converter is to reproduce the original request byte for byte.
Reading the output of this curl to fetch converter
You can choose between async and await style, which reads better inside an existing async function, and a promise chain, which drops into older code or a console with no wrapper. Both produce the same request.
The generated code declares the URL, an options object and the call itself on separate lines rather than as one nested expression. That makes the output easy to edit: change a header, swap the token for an environment variable, or add a signal for cancellation without untangling anything.
Response handling is included as a short block that checks the ok property before parsing. That check is the single most common omission when people convert curl command to javascript by hand, because fetch does not reject on a 404 or a 500 the way most people expect.
Testing the result and CORS
A request that works in curl can still fail in a browser, and the reason is almost always CORS. curl has no origin and no same origin policy, so it never asks permission. A page does, and the server has to answer with access control headers before the browser hands your script the response.
No curl to fetch converter can fix that, because it is a server side decision. If the generated call fails with a CORS error the request itself is usually fine, and the fix is either a server that allows your origin or a proxy that makes the call for you.
Keeping credentials out of your code
Almost every command worth converting carries a secret, and the generated code contains it as a literal. That is correct for a quick test and wrong for anything committed to a repository.
Replace the literal with an environment variable or a value fetched at runtime before the code goes anywhere near version control. If the token was already pasted into a shared document or a ticket, rotate it, because a leaked bearer token is the most common cause of an unexplained API bill.
| curl flag | fetch equivalent | Note |
|---|---|---|
| -X POST | method: "POST" | Direct mapping |
| -H "Accept: application/json" | headers object entry | Repeatable |
| -d '{...}' | body string plus content type | Implies POST when no method is given |
| -u user:pass | Authorization: Basic header | Encoded with btoa |
| -L | redirect: "follow" | This is already the fetch default |
| -k | no equivalent | Browsers cannot skip certificate checks |
How to convert a curl command to fetch
- 1
Copy the curl command
Take it from your terminal, from API documentation, or from Copy as cURL in your browser network panel.
- 2
Paste it into the tool
Multi line commands with trailing backslashes are accepted as they are. Nothing is sent anywhere.
- 3
Pick the code style
Choose async and await for use inside an async function, or a promise chain for older code and console testing.
- 4
Convert and review the warnings
Press convert, then read any warnings about flags a browser cannot honour, such as certificate or proxy options.
- 5
Copy the code and replace secrets
Paste the fetch call into your project and swap any hard coded token for an environment variable before committing.
Related tools worth bookmarking
Sources and further reading
- MDN: fetchReference for the API the generated code targets, including every option in the init object.developer.mozilla.org
- WHATWG: Fetch StandardThe specification that defines forbidden request headers and how CORS preflight works.fetch.spec.whatwg.org
- RFC 9110: HTTP SemanticsThe authority on methods, header fields and authentication schemes shared by both curl and fetch.rfc-editor.org
Frequently asked questions
Common questions about the curl to fetch converter.
No. The command is parsed as text in your browser and the code is generated locally. No request is executed and nothing is transmitted, which is why it is safe to paste a command containing a live API key or session cookie.
Because curl ignores the same origin policy and a browser does not. The server has to return access control headers permitting your origin before script can read the response. The generated code is correct, the permission is missing.
It is reported as a warning and left out of the code. Browsers deliberately give JavaScript no way to disable certificate verification, so a request that only works with -k has to run from a server rather than from a page.
Multipart form uploads are flagged rather than converted, because building a FormData object needs a real File from an input element. The warning tells you which field names were present so you can assemble the FormData yourself.
Yes, and it is the most common input. Copy as cURL produces a long command with many headers and a cookie, all of which are parsed. Remember that several of those headers are set by the browser itself and will be ignored when the code runs.