COMMAND
curlTransfer data and inspect HTTP from the command line
curl transfers data to and from a server and is built into Windows 10 and 11. For diagnostics it is the fastest way to see raw HTTP: curl -I shows response headers, -L follows redirects, -v shows the TLS handshake and request, and -d sends a request body. It removes the browser from the picture when testing a URL or API.
Purpose
curl moves data over HTTP, HTTPS, FTP and many other protocols. For troubleshooting the web it is invaluable because it shows exactly what the server returns, with no cache, cookies or JavaScript in the way. When a page behaves oddly, curl tells you what is actually on the wire.
Inspect response headers and status
curl -I https://example.com/HTTP/2 200
content-type: text/html; charset=UTF-8
cache-control: max-age=3600The status line tells you 200, 404, 301 and so on directly.
Follow redirects
curl -IL http://example.com/Prints every hop, revealing redirect chains and loops between 301 and 302 responses.
See the full exchange and TLS
curl -v https://example.com/ -o NUL-v shows the DNS resolution, the TLS version and certificate (TLS vs SSL), the request headers sent and the response headers received. -o NUL discards the body so the headers are readable.
Test an API
curl -i -X POST https://api.example.com/login ^
-H "Content-Type: application/json" ^
-d "{\"user\":\"alice\",\"pass\":\"secret\"}"-i includes the response headers with the body. Use -d @file.json to avoid quote-escaping. Add -H "Authorization: Bearer TOKEN" for authenticated calls; a 401 means the token was missing or rejected.
Download a file
curl -L -o installer.zip https://example.com/download/installer.zip-O keeps the remote filename; -C - resumes a partial download.
Useful options
| Option | Effect |
|---|---|
-I | HEAD request: headers only |
-i | Include response headers with the body |
-L | Follow redirects |
-v | Verbose: handshake, request, response |
-o file / -O | Save to a named / remote-named file |
-H | Add a request header |
-d | Send a body (implies POST) |
-k | Skip TLS certificate verification (diagnostics only) |
-A | Set the User-Agent |
-x | Use a proxy |
Common mistakes
- PowerShell alias confusion. Plain
curlin PowerShell isInvoke-WebRequest; its parameters differ. Usecurl.exefor real curl. - Quote escaping on Windows. cmd and PowerShell handle quotes differently; put JSON in a file with
-d @file.jsonto avoid the problem. -kin production scripts. Skipping certificate checks defeats TLS; use it only to diagnose a certificate problem, never as a permanent workaround.- Testing HTTPS behaviour with
-Ion servers that treat HEAD differently from GET; use-iwith a GET if results look off.
Frequently asked questions
Is curl really built into Windows?
Yes. curl.exe ships with Windows 10 (from version 1803) and Windows 11. Note that in PowerShell, curl without .exe is an alias for Invoke-WebRequest, which takes different arguments; use curl.exe to get the real curl.
How do I see just the HTTP status and headers?
curl -I https://example.com/ sends a HEAD request and prints the response headers, including the status line. Add -L to follow redirects and see the final one.
How do I send JSON to an API?
curl -X POST https://api.example.com/items -H "Content-Type: application/json" -d "{\"name\":\"test\"}". On Windows the inner quotes need escaping; a file is easier: -d @body.json.