HTTP Request Builder
Composes and sends a GET/POST/PUT/PATCH/DELETE/HEAD request with custom headers and a body, and shows the status, headers, body and timing — without ever forwarding cookies or Authorization.
Composes an HTTP request — method, headers, body — sends it from our server, and shows the whole response: status, headers, body and the curl command that would reproduce it. Useful for an API you are reading about, and for a response you want to see without CORS deciding whether you may.
Our server makes this request for you. Only the URL, method, headers and body you enter is sent to it — none of your cookies or login state goes along. The server will only connect to public addresses and refuses private and internal ones.
How to use it
Choose the method and the URL
Ports 80, 443 and anything above 1024 are allowed. A body field appears for the methods that take one.
Add headers one per line
Name: value. Malformed lines are reported rather than silently dropped, and a Content-Type has to be set by hand for a JSON body.
Decide about redirects before sending
Following is on by default and stops after five. Turn it off when the 3xx itself is what you are testing — the Location header is what you came for.
Take the curl line
The exact equivalent of what was sent, ready to paste into a terminal or a bug report. It is the fastest way to hand someone else a reproducible request.
Common questions
Why were my Cookie and Authorization headers dropped?
Our server refuses to forward credential headers, and says which it dropped. A tool that relays arbitrary credentials to arbitrary hosts is a tool for laundering them. For an API that needs a token, use whatever other header that service defines, such as X-Api-Key.
Can I call an API on my own machine?
No. The request goes out from our server and the outbound lane refuses private, loopback and link-local destinations — including a public hostname that resolves to one. For localhost, curl is the right tool.
Does this get around CORS?
It sidesteps it for looking, not for building. The request is server-to-server so no preflight applies, which is why you can read a response your own page cannot. Your application still needs the server to send the right headers.
The body is cut off
Responses are read up to 1 MiB and the panel says when that happened. A binary body is shown as Base64, first 48 KB only — this is a request tester, not a downloader.
Feed it from
HTTP Status Reference
Explains every status code with its spec meaning, cacheability and the mistakes people make with it.
User-Agent Parser
Breaks a user-agent string into browser, engine, OS and device, and shows your own for comparison.
curl to Code
Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.
GraphQL Formatter
Formats queries and SDL, validates a document against a schema and prints the type it resolves to.
Next
These accept what this tool produces, so the result can go straight in.
curl to Code
Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.
HTTP Header Inspector
Fetches a URL and shows the full response headers, redirect chain, timings and compression used.
JSON Formatter & Validator
Pretty-prints, minifies and validates JSON, pointing at the exact line and column of a syntax error.
JWT Decoder
Decodes header and payload, shows claim expiry in local time, and checks the signature against a supplied key.
DNS Lookup
Queries A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA and PTR records over DoH, with TTL and the DNSSEC bit shown, from Cloudflare or Google.
IP Address Info
Shows your public IP or any address with its reverse name, ASN, announcing network, prefix and registry country from Team Cymru’s DNS data — no city-level geolocation.