cURL to fetch() Converter

How to Use This Tool

Paste a cURL command — the kind you get from your browser's “Copy as cURL” — and you get working fetch() code, plus a list of the parts that will not survive the trip into a browser.

The problem with copy-as-cURL

A cURL command copied from DevTools carries everything the browser sent, including Cookie, Referer, Origin, sec-ch-ua and friends. In a terminal that is exactly what you want. Converted back into browser JavaScript, most of it is forbidden.

The Fetch standard lists headers that a script may not set, so that the user agent stays in control of them. Setting one is not an error — the header is removed from the request and everything continues. Your code runs, the server sees an unauthenticated request, and there is nothing in the console to tell you why.

The full forbidden list: Accept-Charset, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method, Connection, Content-Length, Cookie, Date, DNT, Expect, Host, Keep-Alive, Origin, Referer, Set-Cookie, TE, Trailer, Transfer-Encoding, Upgrade, Via, plus anything beginning Proxy- or Sec-.

The User-Agent trap

User-Agent deserves its own note, because the answer changed. It used to be forbidden and no longer is — the spec permits setting it. Chrome still silently drops it anyway, which has been an open Chromium bug since 2016. So a page that sets it works in Firefox and does not in Chrome, with no error either way. This tool flags it separately rather than lumping it in with the genuinely forbidden headers, because the reason is different and so is the workaround.

Sending cookies properly

You cannot set the Cookie header, but you can ask the browser to attach the cookies it already holds: add credentials: 'include' to the fetch options. The conversion does that automatically when it sees -b or a Cookie header. Note that this only sends cookies the browser already has for that origin — it cannot invent the session token that was sitting in your curl command.

Any header value or JSON body containing a space breaks a naive parser, which is most of them.

What is not converted

-L is dropped because fetch follows redirects by default. -k / --insecure has no equivalent and no workaround — a browser will not skip certificate validation for you. --compressed is unnecessary, since the browser negotiates encoding itself and Accept-Encoding is forbidden anyway. Each of these is reported rather than silently ignored.

Frequently Asked Questions

Why does my converted fetch code get a 401 when the curl command works?

Almost always because the Cookie or Authorization-adjacent headers were dropped. The Fetch standard forbids scripts from setting Cookie, Host, Origin, Referer and about fifteen others so that the user agent stays in control of them. The browser removes them without throwing an error, so the request goes out unauthenticated and there is nothing in the console explaining it.

How do I send cookies with fetch?

Not by setting the Cookie header — that is forbidden. Add credentials: 'include' to the fetch options and the browser attaches the cookies it already holds for that origin. It cannot send a session token that only existed inside your curl command; the browser has to have that cookie already.

Can I set User-Agent in fetch?

According to the spec, yes — it was removed from the forbidden list. In practice Chrome still silently drops it, which has been an open Chromium bug since 2016. So the same code works in Firefox and does not in Chrome, with no error in either. If you need a specific User-Agent, it has to be set server-side.

Why do other converters split my JSON body in half?

Because they split the command on whitespace. The moment a header value or a JSON body contains a space — which is most of the time — the token boundary lands in the wrong place. This parser tracks single quotes, double quotes, backslash escapes and line continuations the way a shell does.

What happens to -L, -k and --compressed?

They are reported rather than converted. fetch follows redirects by default, so -L is redundant. --compressed is unnecessary because the browser negotiates encoding itself and Accept-Encoding is a forbidden header anyway. -k has no equivalent at all: a browser will not skip certificate validation, and no option exists to ask it to.

Is my command sent anywhere?

No. The parsing and code generation run entirely in your browser. That matters here more than usual, because curl commands routinely contain API keys and session tokens.

cURL to fetch Converter That Warns When the Browser Will Ignore Your Headers

How the calculation works