HTTP Request Tester & Curl Converter
Send HTTP requests, generate request code, convert curl
Send HTTP requests, generate request code, convert curl
Fill in a URL, method, headers, and body to send a real HTTP request and read the raw response. You can paste a curl command to load it, or copy the current request back out as curl.
Enter a URL and this line will tell you exactly where the request goes.
How this tool sends requests (details)
- Direct is the default. Pressing Send makes your browser call the target server itself. Nothing about the request passes through our servers.
- Browsers sometimes block that. If the target does not return
Access-Control-Allow-Origin(CORS), the browser refuses to let the page read the response. Most production APIs behave this way. - Only then do we offer a relay. When the direct attempt is blocked, a “Send through our server” button appears. Only when you press it does the URL, headers, and body travel through our relay (api.everytooleverywhereallatonce.com, a Cloudflare Worker) to the target. That includes Authorization, Cookie, and API-key values.
- The relay does not store the request. It forwards it, returns the response, and drops both. Nothing is logged. The only thing kept is a per-IP request counter used to stop abuse.
- The relay strips headers that could forge a client IP (
x-forwarded-*,cf-*,host). If you do not setUser-Agentyourself, it sends one that identifies this tool. - Private and localhost addresses are never relayed (this prevents internal network scanning). Those work only via direct sending.
- Limits: 512 KB request body, 2 MB response (truncated beyond that), 20-second timeout, 20 relayed requests per minute per IP.
Import / export a curl command
Turn this off to inspect the redirect response itself. When sending directly the browser still will not let you read it.
Resets when you close the tab. Every response is still labelled with the route it came through.
This request will pass through our server
From here the request will not go straight to the target — it will travel through our relay (api.everytooleverywhereallatonce.com) first. Please read this before continuing.
- The full URL, headers, and body pass through our server. That includes any Authorization, Cookie, or API-key values you entered.
- We do not store or log any of it. The relay forwards the request, returns the response, and drops both.
- The target server sees our relay's IP address as the caller, not yours.
- Prefer a test credential over a production one.
How to use it
- Pick a method, enter a URL, press Send. Add header name/value rows in the Headers tab and paste JSON or form data in the Body tab.
- Paste a command copied with “Copy as cURL” from your browser devtools and press Load — method, URL, headers, and body are filled in for you.
- Browsers block scripts from setting headers like User-Agent, Cookie, and Referer. If you enter one, the Headers tab says so.
- Sent directly, only CORS-safelisted response headers (Content-Type, Cache-Control, …) are visible. Use the relay when you need all of them.
- Nothing you type is saved anywhere — reloading the page clears it.
Where your request goes
- Default route — browser → target. Send always starts as a direct browser request. Nothing passes through our servers, and the target sees your own IP address.
- Relay route — browser → api.everytooleverywhereallatonce.com → target. Used only after a direct attempt is blocked by CORS and only when you press “Send through our server”. It never switches on its own (unless you tick “retry automatically for this visit”, and even then every response is labelled with its route).
- What the relay does. It forwards your request as-is and hands the response straight back. It does not store, log, or cache the URL, headers, body, or response. The only thing kept is a per-IP request counter that limits abuse.
- What the relay changes. Headers that could forge a caller IP (
x-forwarded-*,cf-*,forwarded,host) and connection-level headers are removed. If you do not setUser-Agent, it sends one that identifies this tool so the target's operators can see what the traffic is. - What it refuses. localhost, private ranges, and cloud metadata addresses are never relayed. Use direct sending for those.
- Limits. 512 KB request body, 2 MB response (truncated beyond), 20-second timeout, 20 relayed requests per minute per IP.
- This is one of the few tools on this site whose data can leave your browser. Section 4 of the privacy policy describes exactly when and how.
Loading…
Working…
0.0
It hasn't frozen — the result will appear when the calculation finishes.
About HTTP Request Tester & Curl Converter
This page has three modes. Request tester actually sends a request and shows the response. Request builder lets you fill in query parameters, headers and a body as tables and produces a curl command, without sending anything. curl converter turns a curl command into JavaScript fetch, Python requests, Node.js axios or PHP cURL code.
By default the tester sends the request straight from your browser with fetch. That is why an API that returns 200 from curl in a terminal so often fails here. The sections below explain why, what the browser changes about your request, and what your options are when a direct send is blocked.
Why curl works and the browser doesn't
A browser will not hand a script the response from a server on a different origin (scheme, host and port) unless that server opts in with an Access-Control-Allow-Origin header. That is CORS. curl has no notion of a page or an origin, so the rule never applies to it. Most payment, mapping and government data APIs are designed for server-to-server calls and simply do not send the header.
If a request is not a 'simple' one, the browser first sends a preflight: an OPTIONS request asking permission. Setting Content-Type: application/json, adding an Authorization header, or using PUT or DELETE all trigger it. If the server does not answer the OPTIONS request with suitable Access-Control-Allow-Methods and Access-Control-Allow-Headers, the real request is never sent. This is the usual explanation when a GET to an API works but a JSON POST to the same API fails.
To the page, a CORS block looks exactly like a DNS failure or a refused connection: both surface as a TypeError, 'Failed to fetch'. Browsers hide the difference on purpose, so this tool labels such failures 'CORS or network' rather than guessing. The real reason is printed in the developer tools console. Only two cases can be told apart reliably: an http:// URL, blocked as mixed content because this page is https, and a request you cancelled yourself.
What the browser changes when you send directly
- Forbidden headers such as Cookie, Host, Origin, Referer, Content-Length and Connection cannot be set by scripts and are silently dropped. The tool names them as soon as you type them, and flags User-Agent for the same reason.
- No cookies are sent. The tool calls fetch with credentials: 'omit', so even if you are logged in to the target site, your session does not ride along.
- Only CORS-safelisted response headers are readable: Cache-Control, Content-Language, Content-Length, Content-Type, Expires, Last-Modified and Pragma. Anything else, such as X-RateLimit-Remaining, stays hidden unless the server lists it in Access-Control-Expose-Headers.
- With 'Follow redirects' off, the browser returns a 3xx as an opaque redirect with no status or Location you can read. To inspect a redirect, use the relay.
Sending through the relay
After a direct send is blocked, 'Send through our server' forwards the request via this site's relay. Server to server there is no CORS, and headers the browser would drop are passed through. The trade-off is that the full URL, headers and body pass through a third party, so before sending the tool lists the names of anything that looks like a credential, such as Authorization or api_key, and asks you to confirm. A test key is a better choice than a production one.
Limits: 512 KB request body, 2 MB response (truncated beyond that), 20-second timeout, 20 relayed requests per minute per IP. localhost, private ranges such as 10.x and 192.168.x, and cloud metadata addresses are refused, so an internal development server can only be tested with a direct send. The target sees the relay's IP address, not yours, which matters if the API has an IP allowlist.
How curl flags are translated
Paste the output of your browser's 'Copy as cURL' and the tester fills in the request using these rules.
- -d, --data-raw, --data-binary become the body. Without -X the method becomes POST, and without a Content-Type the header application/x-www-form-urlencoded is added, which is exactly what curl itself does. Several -d values are joined with &. A value starting with @, as in -d @file, makes curl read that file; the tool cannot read files, so it keeps the text literally and shows a warning. The curl commands this tool generates pass the body with --data-raw so that never happens.
- --json sets the body and adds Content-Type and Accept: application/json.
- -G moves the -d data into the query string and sends a GET. --data-urlencode values are percent-encoded.
- -u user:pass becomes an Authorization: Basic header, unless an Authorization header is also given with -H: then, as in curl, the -H value wins and -u is dropped with a warning. -I means HEAD, -b becomes a Cookie header, -A the User-Agent and -e the Referer.
- -F (multipart upload), -T, --proxy and certificate options cannot be carried over and produce a warning. -k is ignored because neither a browser nor the relay can skip certificate checks. Output options such as -L, -s and --compressed are dropped quietly.
Request builder and curl converter
The builder appends only the ticked query rows, each encoded with encodeURIComponent, and when the body type is JSON it runs JSON.parse first and refuses to build the command if the JSON is invalid. Pick JSON or form and leave Content-Type empty, and the right header is added for you. The generated command passes the body with --data-raw rather than -d, because -d treats a value starting with @ as a file name.
The converter writes the same curl command in four languages, each in its own idiom. -u becomes a Basic header for fetch and axios, auth=("user", "pass") for requests, and CURLOPT_USERPWD for PHP. -k turns into verify=False in Python, but there is no equivalent in browser fetch: a page cannot switch off certificate validation.
Worked examples
Loading a 'Copy as cURL' command
- Input
curl 'https://api.example.com/v1/items?page=2' -H 'Authorization: Bearer abc' -u admin:secret --json '{"name":"pen"}' -k -F file=@a.png- Output
POST https://api.example.com/v1/items?page=2 Authorization: Bearer abc Content-Type: application/json Accept: application/json Body: {"name":"pen"} Warnings: -k ignored, -F upload not supported, -u ignored because -H Authorization is set
When a command has both -H Authorization and -u, curl sends the -H value and discards the Basic header -u would have built. The tool does the same, keeps a single Authorization header and warns you. To use Basic auth instead, remove the -H line and import again (admin:secret becomes Basic YWRtaW46c2VjcmV0).
Building a query with -G
- Input
curl -G https://api.example.com/search -d q=hello --data-urlencode 'city=São Paulo'- Output
GET https://api.example.com/search?q=hello&city=S%C3%A3o+Paulo
ã is two UTF-8 bytes, C3 A3, and the space is written as + in a query string.
curl converter, Python requests
- Input
curl -X POST https://api.example.com/v1/items -H 'Content-Type: application/json' -u admin:secret -d '{"name":"pen"}'- Output
headers = {"Content-Type": "application/json"} data = "{\"name\":\"pen\"}" auth = ("admin", "secret") requests.request("POST", url, headers=headers, data=data, auth=auth)
The body goes in data= as a string rather than json=, so the bytes on the wire are identical to what curl sends.
How to use it
- Enter a method and URL, or paste a curl command and press Load.
- Fill in the Headers and Body tabs and press Send.
- If CORS blocks it, read the explanation and use the relay only when you need to.
- For code, copy the command from the builder or the converter tab.
Frequently asked questions
It works in Postman but gives a CORS error here.
The Postman desktop app is not a browser and performs no CORS checks. A direct send here follows browser rules, so if the server does not allow cross-origin requests you need the relay.
Can I use this to check my own API's CORS setup?
Yes, with a direct send. Success means the API allows this site's origin; failure shows the missing header in the console. A relay success says nothing about CORS.
Can I test an API on localhost?
Only with a direct send, and the local server must allow this site's origin via CORS. The relay refuses private addresses.
Why do I only see a few response headers?
When sent directly, scripts can only read CORS-safelisted headers. Send through the relay to see them all.
Does the relay keep my request?
According to the tool's own disclosure, it forwards and returns without storing or logging URLs, headers or bodies; only a per-IP rate counter is kept.
Sources
- MDN: Cross-Origin Resource Sharing (CORS)
- WHATWG Fetch Standard: forbidden request header
- WHATWG Fetch Standard: CORS-safelisted response-header name
- curl man page
- MDN: Mixed content
Last reviewed: