Convert HTTP requests between 6 formats - Raw HTTP ↔ curl ↔ fetch() ↔ HAR ↔ JSON spec ↔ form/query string. Auto-detects the input.
HTTP Request Converter is the missing translator between every format a bug-bounty / pentest workflow throws around. Paste a curl one-liner from a write-up - get the raw HTTP request you can drop in Burp Repeater. Copy a fetch() call out of Chrome DevTools - get curl. Export a HAR from the Network panel - get a single-request curl or JSON spec. Capture a request in Burp - get fetch() to drop into a XSS PoC or browser console.
Six input formats, six output formats, 30 useful conversions (excluding identity). Auto-detect spots the input format from the first few characters (curl / fetch( / METHOD path HTTP/1.x / valid JSON / form-string), so most of the time you just paste and click. Every conversion runs through a shared normalised Request object - method, url, headers (order & duplicates preserved), body - so semantics survive every translation.
A real shell-aware tokenizer parses curl: handles single quotes, double quotes with backslash escapes, multi-line continuations (\), and all the common flags (-X / -H / -d / --data / --data-raw / --data-urlencode / --form / -u / -A / -e / -b / --url). 100% client-side - nothing leaves your browser.
curl → raw → curl reproduces the original.JSON.stringify(...) when Content-Type is application/json.roles[0]=admin&roles[1]=editor). Useful for Content-Type confusion testing: take a JSON body, post the same data as form-encoded, see if the server cares.{method, url, headers, body}. Useful for storing as fixtures, diffing requests, or sending to an LLM.fetch() call from a JS bundle (XSS reflected from view-source) → get a curl one-liner to verify outside the browser.fetch() + paste into the browser console of an XSS PoC for credentialed cross-origin testing.This one is free in your browser. Sign up for server-side recon, scan history, and projects.
Create free account Sign inA shell-aware tokenizer (not regex) handles single quotes (literal), double quotes (with backslash escapes for \n, \r, \t, \\, \", \$, \`), multi-line continuations with \, and all common curl flags. -u user:pass is converted into a properly base64-encoded Authorization: Basic header. Unknown flags are skipped safely.
Multipart (--form / -F) is partially supported - the form fields are captured but the multipart-encoded body is approximated as k=v&k=v. For full multipart fidelity (boundaries, file contents), use Burp or the original curl directly.
Yes for the common loop curl → raw → curl. Tested: identical reproduction of method, URL, headers and body. The fetch → curl direction also round-trips cleanly. Some edge cases (header capitalisation case, header-order with duplicates) are preserved but the exact byte-for-byte original is not always guaranteed.
No. 100% client-side. The converter is a static page that runs entirely in your browser. No network calls.