curl(1)

NAME ✨

okay so this is the curl(1) manual page — literally the curl Manual, bestie — and curl is the tool for transfer a URL. 💖

SYNOPSIS 🎀

the whole vibe is extremely simple:

curl [options / URLs]

DESCRIPTION 🦋

curl is a tool for transferring data from or to a server using URLs. It supports these protocols: DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMTP, SMTPS, TELNET, TFTP, WS and WSS. 🌈

curl is powered by libcurl for all transfer-related features. See libcurl(3) for details.

URL 💅

The URL syntax is protocol-dependent. You can find a detailed description in RFC 3986.

If you provide a URL without a leading protocol:// scheme, curl guesses what protocol you want. It then defaults to HTTP but assumes others based on often-used hostname prefixes. For example, for hostnames starting with "ftp.", curl assumes you want FTP. 👑

You can specify any amount of URLs on the command line. They are fetched in a sequential manner in the specified order unless you use --parallel. You can specify command line options and URLs mixed and in any order on the command line.

curl attempts to reuse connections when doing multiple transfers, so that getting many files from the same server does not use multiple connects and setup handshakes. This improves speed. Connection reuse can only be done for URLs specified for a single command line invocation and cannot be performed between separate curl runs.

curl assumes everything provided on the command line that is not a command line option or its argument is a URL and treats it as such. fr fr.

GLOBBING 🌸

You can specify multiple URLs or parts of URLs by writing lists within braces or ranges within brackets. We call this "globbing". ✨

Provide a list with three different names like this:

https://fun.example/{one,two,three}.jpg
sftp://{one,two,three}.example/README

Do sequences of alphanumeric series by using [] as in:

ftp://ftp.example.com/file[1-100].txt

With leading zeroes:

ftp://ftp.example.com/file[001-100].txt

With letters through the alphabet:

ftp://ftp.example.com/file[a-z].txt

nested sequences are not supported, bestie — but you can use several ones next to each other, and that's honestly iconic.

https://example.com/archive[1996-1999]/vol[1-4]/part{a,b,c}.html

You can specify a step counter for the ranges to get every Nth number or letter:

https://example.com/file[1-100:10].txt
https://example.com/file[a-z:2].txt

When using [] or {} sequences when invoked from a command line prompt, you probably have to put the full URL within double quotes to avoid the shell from interfering with it. This also goes for other characters treated special, like for example '&', '?' and '*'. 🫶

The separate globbing components can be referenced in the --output option to allow pieces to be reused in the target filename.

Starting in curl 8.21.0, the separate globbing parts can be named and referenced by their names. The case sensitive alphanumeric name is set enclosed within angle brackets after the opening character. Examples:

https://fun.example/{<number>one,two,three}.jpg
ftp://ftp.example.com/file[<range>1-100].txt

Setting the same glob name twice is an error.

Switch off globbing with --globoff.

VARIABLES 🧚

curl supports command line variables (added in 8.3.0). Set variables with --variable name=content or --variable name@file (where "file" can be stdin if set to a single dash (-)).

Variable contents can be expanded in option parameters using "{{name}}" if the option name is prefixed with "--expand-". This gets the contents of the variable "name" inserted, or a blank if the name does not exist as a variable. Insert "{{" verbatim in the string by prefixing it with a backslash, like "\{{". 💜

You can access and expand environment variables by importing them with "--variable %name". This imports the variable called "name" but exits with an error if that environment variable is not already set. To provide a default value in case it is not already set, use "--variable %name=content" or "--variable %name@content".

Example: get the USER environment variable and expand into the URL, fail if USER is not set:

--variable '%USER'
--expand-url = "https://example.com/api/{{USER}}/method"

When expanding variables, curl supports a set of functions that can make the variable contents more convenient to use. It can trim leading and trailing white space with "trim", output the contents as a JSON quoted string with "json", URL encode the string with "url", base64 encode it with "b64" and base64 decode it with "64dec". To apply functions to a variable expansion, add them colon separated to the right side of the variable. Variable content holding null bytes that are not encoded when expanded causes an error. 😭

Example: get the contents of a file called $HOME/.secret into a variable called "fix". Make sure that the content is trimmed and percent-encoded when sent as POST data:

--variable %HOME
--expand-variable fix@{{HOME}}/.secret
--expand-data "{{fix:trim:url}}"
https://example.com/

Command line variables and expansions were added in 8.3.0.

OUTPUT 🎀

If not told otherwise, curl writes the received data to stdout. It can be instructed to instead save that data into a local file, using the --output or --remote-name options. If curl is given multiple URLs to transfer on the command line, it similarly needs multiple options for where to save them.

curl does not parse or otherwise "understand" the content it gets or writes as output. It does no encoding or decoding, unless explicitly asked to with dedicated command line options. periodt.

PROTOCOLS 🌈

curl supports numerous protocols, or put in URL terms: schemes. Your particular build may not support them all. 👑

DICT — Lets you lookup words using online dictionaries.
FILE — Read or write local files. curl does not support accessing "file://" URL remotely, but when running on Microsoft Windows using the native UNC approach works. Only absolute paths.
FTP(S) — curl supports the File Transfer Protocol with a lot of tweaks and levers. With or without using TLS.
GOPHER(S) — Retrieve files.
HTTP(S) — curl supports HTTP with numerous options and variations. It can speak HTTP version 0.9, 1.0, 1.1, 2 and 3 depending on build options and the correct command line options.
IMAP(S) — Using the mail reading protocol, curl can download emails for you. With or without using TLS.
LDAP(S) — curl can do directory lookups for you, with or without TLS.
MQTT — curl supports MQTT version 3. Downloading over MQTT equals subscribing to a topic while uploading/posting equals publishing on a topic. MQTT over TLS is not supported (yet).
POP3(S) — Downloading from a pop3 server means getting an email. With or without using TLS.
RTSP — curl supports RTSP 1.0 downloads.
SCP — curl supports SSH version 2 scp transfers.
SFTP — curl supports SFTP (draft 5) done over SSH version 2.
SMTP(S) — Uploading contents to an SMTP server means sending an email. With or without TLS.
TELNET — Fetching a telnet URL starts an interactive session where it sends what it reads on stdin and outputs what the server sends it.
TFTP — curl can do TFTP downloads and uploads.
WS(S) — WebSocket done over HTTP/1. WSS implies that it works over HTTPS.

PROGRESS METER ⭐

curl normally displays a progress meter during operations, indicating the amount of transferred data, transfer speeds and estimated time left, etc. The progress meter displays the transfer rate in bytes per second. The used suffixes ("k" for kilo, "M" for mega, "G" for giga, "T" for tera, "P" for peta and "E" for exa) are 1024 based. For example 1k is 1024 bytes. 1M is 1048576 bytes. Strictly speaking this makes the units kibibyte and mebibyte etc.

curl displays this data to the terminal by default, so if you invoke curl to do an operation and it is about to write data to the terminal, it disables the progress meter as otherwise it would mess up the output mixing progress meter and response data.

If you want a progress meter for HTTP POST or PUT requests, you need to redirect the response output to a file, using shell redirect (>), --output or similar.

This does not apply to FTP upload as that operation does not spit out any response data to the terminal.

If you prefer a progress bar instead of the regular meter, --progress-bar is your friend. You can also disable the progress meter completely with the --silent option. 💅

VERSION 💖

This man page describes curl 8.23.0. If you use a later version, chances are this man page does not fully document it. If you use an earlier version, this document tries to include version information about which specific version that introduced changes.

You can always learn which the latest curl version is by running

curl https://curl.se/info

The online version of this man page is always showing the latest incarnation: https://curl.se/docs/manpage.html

💅 OPTIONS 💅

okay bestie so here's the whole deal with how options work in curl, and honestly it's giving "simple but with lore" ✨

Options start with one or two dashes. Many of them need an extra value right next to them.
If the text you provide does not start with a dash, curl presumes it's a URL and treats it as one. (rude? no, just how it is 🫶)

The short "single-dash" form — like -d — can be used with or without a space between it and its value, though a space is the recommended separator. The long double-dash form, like --data, requires a space between it and its value. no cap, it will not figure it out for you 💀

Short version options that don't need any extra values can be stacked immediately next to each other. Like, you can specify all the options -O, -L and -v at once as -OLv. so efficient, we love a multitasking icon 👑

In general, all boolean options are enabled with --option and then disabled again with --no-option. Same option name, you just prefix it with no-. In this list we mostly show the --option version of them.

When --next is used, it resets the parser state and you start again with a clean option state — except for the options that are global. Global options retain their values and meaning even after --next.

If the long option name ends with an equals sign ("="), the argument is the text following on its right side. (Added in 8.16.0)

The first argument that is exactly two dashes ("--") marks the end of options. Any argument after the end of options is interpreted as a URL argument, even if it starts with a dash. periodt 💅

⚠️ real talk: curl does little to no verification of the contents of command line arguments. Passing in "creative octets" like newlines might trigger unexpected results. so maybe don't get too creative, bestie 😭

The following options are global — these babies keep their vibe across --next:

--fail-early
--libcurl
--parallel-immediate
--parallel-max-host
--parallel-max
--parallel
--progress-bar
--rate
--show-error
--stderr
--styled-output
--trace-ascii
--trace-config
--trace-ids
--trace-time
--trace
--verbose

✨ ALL OPTIONS ✨

--abstract-unix-socket <path> — (HTTP) Connect to the server through an abstract Unix domain socket instead of using the network. Note: netstat shows the path of an abstract socket prefixed with "@", however the <path> argument should not have this leading character.
- If --abstract-unix-socket is provided several times, the last set value is used.
- Example: curl --abstract-unix-socket socketpath https://example.com
- See also --unix-socket.
--alt-svc <filename> — (HTTPS) Enable the alt-svc parser. If the filename points to an existing alt-svc cache file, that gets used. After a completed transfer, the cache is saved to the filename again if it has been modified.
- Specify a "" filename (zero length) to avoid loading/saving and make curl handle the cache in memory. ✨
- You may want to restrict your umask to prevent other users on the same system from accessing the created file. (protect your stuff, bestie 🫶)
- If this option is used several times, curl loads contents from all the files but the last one is used for saving.
- --alt-svc can be used several times in a command line.
- Example: curl --alt-svc svc.txt https://example.com
- See also --resolve and --connect-to.
--anyauth — (HTTP) Figure out the authentication method automatically, and use the most secure one the remote site claims to support. This is done by first doing a request and checking the response-headers, thus possibly inducing an extra network round-trip. This option is used instead of setting a specific authentication method, which you can do with --basic, --digest, --ntlm, and --negotiate.
- Using --anyauth is not recommended if you do uploads from stdin, since it may require data to be sent twice and then the client must be able to rewind. If the need should arise when uploading from stdin, the upload operation fails. 😭
- Used together with --user.
- Example: curl --anyauth --user me:pwd https://example.com
- See also --proxy-anyauth, --basic and --digest.
-a, --append — (FTP SFTP) When used in an upload, this option makes curl append to the target file instead of overwriting it. If the remote file does not exist, it is created. Note that this flag is ignored by some SFTP servers (including OpenSSH). 💀
- Providing --append multiple times has no extra effect. Disable it again with --no-append.
- Example: curl --upload-file local --append ftp://example.com/
- See also --range and --continue-at.
--aws-sigv4 <provider1[:prvdr2[:reg[:srv]]]> — (HTTP) Use AWS V4 signature authentication in the transfer.
- The provider argument is a string that is used by the algorithm when creating outgoing authentication headers.
- The region argument is a string that points to a geographic area of a resources collection (region-code) when the region name is omitted from the endpoint.
- The service argument is a string that points to a function provided by a cloud (service-code) when the service name is omitted from the endpoint.
- If --aws-sigv4 is provided several times, the last set value is used.
- Example: curl --aws-sigv4 "aws:amz:us-east-2:es" --user "key:secret" https://example.com
- Added in 7.75.0. See also --basic and --user.
--basic — (HTTP) Use HTTP Basic authentication with the remote host. This method is the default and this option is usually pointless, unless you use it to override a previously set option that sets a different authentication method (such as --ntlm, --digest, or --negotiate). lowkey just a vibe reset button 🌸
- Used together with --user.
- Providing --basic multiple times has no extra effect. Disable it again with --no-basic.
- Example: curl -u name:password --basic https://example.com
- See also --proxy-basic.
--ca-native — (TLS) Use the operating system's native CA store for certificate verification.
- This option is independent of other CA certificate locations set at run time or build time. Those locations are searched in addition to the native CA store.
- This option works with OpenSSL and its forks (BoringSSL, LibreSSL, etc) on Windows (Added in 7.71.0) and on Apple OS when libcurl is built with Apple SecTrust enabled. (Added in 8.17.0)
- This option works with wolfSSL on Windows, Linux (Debian, Ubuntu, Gentoo, Fedora, RHEL), macOS, Android and iOS. (Added in 8.3.0) 👑
- This option works with GnuTLS (Added in 8.5.0) and also uses Apple SecTrust when libcurl is built with it. (Added in 8.17.0)
- This option works with Rustls on Windows, macOS, Android and iOS. On Linux it is equivalent to using the Mozilla CA certificate bundle. When used with Rustls only the native CA store is consulted, not other locations set at run time or build time. (Added in 8.13.0)
- This option currently has no effect for Schannel. This is the native TLS library from Microsoft, that by default uses the native CA store for verification unless overridden by a CA certificate location setting.
- Providing --ca-native multiple times has no extra effect. Disable it again with --no-ca-native.
- Example: curl --ca-native https://example.com
- Added in 8.2.0. See also --cacert, --capath, --dump-ca-embed, --insecure and --proxy-ca-native.
--cacert <file> — (TLS) Use the specified certificate file to verify the peer. The file may contain multiple CA certificates. The certificate(s) must be in PEM format. Normally curl is built to use a default file for this, so this option is typically used to alter that default file.
- curl recognizes the environment variable named 'CURL_CA_BUNDLE' if it is set and the TLS backend is not Schannel, and uses the given path as a path to a CA cert bundle. This option overrides that variable.
- (Windows) curl automatically looks for a CA certs file named 'curl-ca-bundle.crt', either in the same directory as curl.exe, or in the Current Working Directory, or in any folder along your PATH.
- curl 8.11.0 added a build-time option to disable this search behavior, and another option to restrict search to the application's directory.
- (Schannel) This option is supported for Schannel in Windows 7 or later (added in 7.60.0). This option is supported for backward compatibility with other SSL engines; instead it is recommended to use Windows' store of root certificates (the default for Schannel).
- If --cacert is provided several times, the last set value is used.
- Example: curl --cacert CA-file.txt https://example.com
- See also --capath, --dump-ca-embed and --insecure.
--capath <dir> — (TLS) Use the specified certificate directory to verify the peer. If curl is built against OpenSSL, multiple paths can be provided by separating them with the appropriate platform-specific separator (e.g. "path1:path2:path3" on Unix-style platforms for "path1;path2;path3" on Windows).
- The certificates must be in PEM format, and if curl is built against OpenSSL, the directory must have been processed using the c_rehash utility supplied with OpenSSL. Using --capath can allow OpenSSL-powered curl to make SSL-connections much more efficiently than using --cacert if the --cacert file contains many CA certificates. efficiency slay ⚡
- If this option is set, the default capath value is ignored.
- If --capath is provided several times, the last set value is used.
- Example: curl --capath /local/directory https://example.com
- See also --cacert, --dump-ca-embed and --insecure.
-E, --cert <certificate[:password]> — (TLS) Use the specified client certificate file when getting a file with HTTPS, FTPS or another SSL-based protocol. The certificate must be PEM format. If the optional password is not specified, it is queried for on the terminal. Note that this option assumes a certificate file that is the private key and the client certificate concatenated. See --cert and --key to specify them independently. 🔐

In the <certificate> part of the argument, bestie, you have to escape the : character as \: so curl doesn't think it's the password delimiter. Same energy with the double quote — write it as \" so it doesn't get mistaken for an escape character. 💅

If curl is built against OpenSSL and the engine pkcs11 or pkcs11 provider is available, then a PKCS#11 URI (RFC 7512) can be used to specify a certificate living on a PKCS#11 device. Any string starting with pkcs11: gets read as a PKCS#11 URI. And if you do hand over a PKCS#11 URI, then --engine gets set to pkcs11 if none was provided, and --cert-type gets set to ENG or PROV if none was provided (depends on your OpenSSL version, iykyk).

If curl is built against GnuTLS, a PKCS#11 URI can be used to point at a certificate on a PKCS#11 device. String starts with pkcs11: → it's a PKCS#11 URI. Simple as that. ✨

(Schannel girlies listen up 👑) Client certificates must be specified by a path expression to a certificate store. Loading PFX is not supported (you can import it to a store first, no biggie). You can use <store location>\<store name>\<thumbprint> to refer to a certificate in the system certificates store, like for example CurrentUser\MY\934a7ac6f8a5d579285a74fa61e19f23ddfe8d7a. Thumbprint is usually a SHA-1 hex string which you can see in certificate details. These store locations are supported: CurrentUser, LocalMachine, CurrentService, Services, CurrentUserGroupPolicy, LocalMachineGroupPolicy and LocalMachineEnterprise. Slay.

If --cert is provided several times, the last set value is used. (Last one wins, always. 🙈)

Example:

curl --cert certfile --key keyfile https://example.com

See also --cert-type, --key and --key-type.

--cert-status — (TLS) Verify the status of the server certificate by using the Certificate Status Request (aka. OCSP stapling) TLS extension. 💖

If this option is enabled and the server sends an invalid (e.g. expired) response, if the response suggests that the server certificate has been revoked, or no response at all is received, the verification fails. Like, it's over at that point. 😭

This support is currently only implemented in the OpenSSL and GnuTLS backends.

Providing --cert-status multiple times has no extra effect. Disable it again with --no-cert-status.

Example:

curl --cert-status https://example.com

`-C`, `--continue-at <offset>`

okay so bestie, this one picks up a transfer right where it left off ✨ You give it a byte offset, and that offset is literally the exact number of bytes curl skips, counting from the top of the source file before anything gets moved to the destination. No vibes-based guessing, just math 💅

One lil caveat for uploads: if you use this with uploads, the FTP server command SIZE is not used by curl. Noted, moving on 🫶

Now the iconic part: write -C - and curl will automatically figure out where/how to resume the transfer all on its own. It uses the given output/input files to work that out. main character energy fr fr 👑

Heads up: HTTP uploads using POST or PUT cannot be resumed. curl returns an error if you combine this option with such an upload 😭

This command line option is mutually exclusive with --range — you can only use one of them for a single transfer.
The --no-clobber and --remove-on-error options cannot be used together with --continue-at.
If --continue-at is provided several times, the last set value is used.

Examples, because we love a demo:

curl -C - https://example.com
curl -C 400 https://example.com

`-b`, `--cookie <data|filename>`

(HTTP) bestie this option is lowkey doing two jobs 💅 It has two slightly separate cookie sending functions, and which one you get depends on what you hand it.

Option one — you pass the actual data: curl sends exactly that data to the HTTP server in the Cookie header. It is supposedly data you previously got from the server in a Set-Cookie: line. Format it like "NAME1=VALUE1; NAME2=VALUE2". When you give a set of specific cookies like this, curl populates its cookie header with this content explicitly in all outgoing request(s). And if multiple requests happen because of authentication, followed redirects or similar — every single one of them gets this cookie header passed on 🌸

Option two — no = symbol in the argument: then it's treated as a filename to read previously stored cookies from. This option also activates the cookie engine, which makes curl record incoming cookies — super handy if you're using it together with the --location option or doing multiple URL transfers on the same invoke 🍓

If the filename is a single minus (-), curl reads the contents from stdin.
If the filename is an empty string ("") and is the only cookie input, curl activates the cookie engine without any cookies.

About that file 🔍 The file format of the file to read cookies from should be plain HTTP headers (Set-Cookie style) or the Netscape/Mozilla cookie file format. We discourage the use of the HTTP header style. (ngl, respect the classic but don't do it.)

Reminder: the file specified with --cookie is only used as input. No cookies are written to that file. To store cookies, use the --cookie-jar option 💖

Another thing — if you read cookies from a plain HTTP headers file, make sure each Set-Cookie line specifies a Domain attribute. Without an explicit domain, the cookie cannot be reliably matched to a target host and may be applied in unexpected ways 😭 We suggest using the Netscape file format instead. Learn from our chaos.

Users often want to both read cookies from a file and write updated cookies back to a file, so using both --cookie and --cookie-jar in the same command line is common. curl ignores filenames specified with --cookie which do not exist or point to a directory.

If curl is built with PSL (Public Suffix List) support, it detects and discards cookies that are specified for such suffix domains that should not be allowed to have cookies. If curl is not built with PSL support, it has no ability to stop super cookies 💀 yikes but true.

--cookie can be used several times in a command line.

Examples:

curl -b "" https://example.com
curl -b cookiefile https://example.com
curl -b cookiefile -c cookiefile https://example.com
curl -b name=Jane https://example.com

See also --cookie-jar and --junk-session-cookies.

`-c`, `--cookie-jar <filename>`

(HTTP) this is the output half of the cookie story, bestie 🎀 You specify which file you want curl to write all cookies to after a completed operation. curl writes all cookies from its in-memory cookie storage to the given file at the end of operations. And even if no cookies are known, a file is created — so it removes any formerly existing cookies from the file 🧹 The file uses the Netscape cookie file format. If you set the filename to a single minus, -, the cookies are written to stdout ✨

Nope, the file specified with --cookie-jar is only used for output. No cookies are read from the file. To read cookies, use the --cookie option. Both options can specify the same file though 👀

This command line option activates the cookie engine that makes curl record and use cookies. The --cookie option also activates it.

And now the scary part 😭 If the cookie jar cannot be created or written to, the whole curl operation does not fail or even report an error clearly. Using --verbose gets a warning displayed, but that is the only visible feedback you get about this possibly lethal situation. Like, the silence is the warning. terrifying.

You may want to restrict your umask to prevent other users on the same system to access the created file 💅

If --cookie-jar is provided several times, the last set value is used.

Examples:

curl -c store-here.txt https://example.com
curl -c store-here.txt -b read-these https://example.com

See also --cookie and --junk-session-cookies.

`--create-dirs`

When used in conjunction with the --output option, curl creates the necessary local directory hierarchy as needed 🏗️ It creates the directories mentioned with the --output option combined with the path possibly set with --output-dir. If the combined output filename uses no directory, or if the directories it mentions already exist, no directories are created. Respect the lazy genius of it.

Created directories are made with mode 0750 on Unix-style file systems 🔐

To create remote directories when using FTP or SFTP, try --ftp-create-dirs.
Providing --create-dirs multiple times has no extra effect. Disable it again with --no-create-dirs.

Example:

curl --create-dirs --output local/dir/file https://example.com

See also --ftp-create-dirs and --output-dir.

`--create-file-mode <mode>`

(SFTP SCP FILE) so when curl is used to create files remotely using one of the supported protocols, this option lets you set which 'mode' to set on the file at creation time, instead of the default 0644 🌈 Very "I choose my own permissions" of you.

This option takes an octal number as argument 🔢

If --create-file-mode is provided several times, the last set value is used.

Example:

curl --create-file-mode 0777 -T localfile sftp://example.com/new

Added in 7.75.0. See also --ftp-create-dirs.

`--crlf`

(FTP SMTP) Convert line feeds to carriage return plus line feeds in upload 💫 Useful for MVS (OS/390). That's it, that's the whole vibe. Vintage but iconic.

Providing --crlf multiple times has no extra effect. Disable it again with --no-crlf.

Example:

curl --crlf -T file ftp://example.com/

`--crlfile <file>`

(TLS) Provide a file using PEM format with a Certificate Revocation List that may specify peer certificates that are to be considered revoked 🚫🎀 Like a block list but make it certificate authority.

If --crlfile is provided several times, the last set value is used.

Example:

curl --crlfile rejects.txt https://example.com

`--curves <list>`

(TLS) Set specific curves to use during SSL session establishment according to RFC 8422, 5.1 🌸 Multiple algorithms can be provided by separating them with : (e.g. "X25519:P-521"). The parameter is available identically in the OpenSSL s_client and s_server utilities. Look at us, speaking OpenSSL fluently 💅

--curves allows a OpenSSL powered curl to make SSL-connections with exactly the (EC) curve requested by the client, avoiding nontransparent client/server negotiations. No sneaky side convos, we said what we said ✨

If this option is set, the default curves list built into OpenSSL are ignored 👀

If --curves is provided several times, the last set value is used.

Example:

curl --curves X25519 https://example.com

Added in 7.73.0. See also --ciphers.

`-d`, `--data <data>`

(HTTP MQTT) Send the specified data to a server 🚀 the classic, the blueprint, the moment.

For HTTP(S), this is done with the POST method in the same way that a browser does when a user has filled in an HTML form and presses the submit button. This option makes curl pass the data to the server using the content-type application/x-www-form-urlencoded.
For MQTT, the data is sent as a PUBLISH.

okay so a few siblings you should know about 🫶 --data-raw is almost the same but does not have a special interpretation of the @ character. To post data purely binary, you should instead use the --data-binary option. To URL-encode the value of a form field you may use --data-urlencode.

If any of these options is used more than once on the same command line, the data pieces specified are merged with a separating &-symbol. So using -d name=daniel -d skill=lousy would generate a post chunk that looks like name=daniel&skill=lousy — look at them, holding hands 🥰

If you start the data with the letter @, the rest should be a filename to read the data from, or - if you want curl to read the data from stdin. Posting data from a file named foobar would thus be done with --data @foobar. When --data is told to read from a file like that, carriage returns, newlines and null bytes are stripped out 🧽 If you do not want the @ character to have a special interpretation use --data-raw instead.

Real talk: the data for this option is passed on to the server exactly as provided on the command line. curl does not convert, change or improve it. It is up to you to provide the data in the correct form 😭 no glow-ups happening here, you're on your own bestie.

--data can be used several times in a command line.

Examples:

curl -d "name=curl" https://example.com
curl -d "name=curl" -d "tool=cmdline" https://example.com
curl -d @filename https://example.com

This option is mutually exclusive with --form, --head and --upload-file. See also --data-binary, --data-urlencode, --data-raw and --form.

`--data-ascii <data>`

(HTTP) This option is an alias for --data. That's it, that's the whole entry 💖 short and slay.

--data-ascii can be used several times in a command line — stack 'em up, bestie 💅

Example:

curl --data-ascii @file https://example.com

See also --data-binary, --data-raw and --data-urlencode 🫶

--data-binary <data> — (HTTP) Posts data exactly as you typed it, zero extra processing, no notes, no edits, no nothing. It's giving "raw and unfiltered" ✨

If you start the data with the letter @, everything after it should be a filename. And "@-" makes curl read the data from stdin 👀. Data gets posted in a similar manner as --data does, except that newlines and carriage returns are preserved and conversions are never done — so your precious formatting survives, periodt.

Like --data, the default content-type sent to the server is application/x-www-form-urlencoded. But if you want the server to treat the data as arbitrary binary data, then set the content-type to octet-stream:

-H "Content-Type: application/octet-stream"

If this option is used several times, the ones following the first append data as described in --data 🌸

--data-binary can be used several times in a command line.

Example:

curl --data-binary @filename https://example.com

See also --proxy.

-I, --head — (HTTP FTP FILE) fetch the headers only 🎀 HTTP servers feature the command HEAD which this uses to get nothing but the header of a document. When used on an FTP or FILE URL, curl displays the file size and last modification time only.

Heads up bestie: it's headers only — no body, no tea, no goss. Just the metadata 💅

Giving --head more than once? literally zero extra effect 💅 turn it back off again with --no-head.

Example, bestie:

curl -I https://example.com

See also --get, --verbose and --trace-ascii 🫶

-H, --header <header/@file> — ok this one's the moment ✨ (HTTP IMAP SMTP) extra header to include in the info being sent. When you use it inside an HTTP request, it gets added to the regular request headers. No cap.

For an IMAP or SMTP MIME uploaded mail built with --form options, it's prepended to the resulting MIME document — effectively including it at the mail global level 🌸 it does not affect raw uploaded mails, so don't @ me.

You can specify any number of extra headers, literally as many as you want. But listen: if you add a custom header that has the same name as one of the internal ones curl would use, your externally set header wins instead of the internal one. That's what lets you do even trickier stuff than curl would normally do 🔥 Just… you should not replace internally set headers without knowing perfectly well what you're doing, bestie, i'm serious. Wanna remove an internal header? Give a replacement with no content on the right side of the colon, like: -H "Host:". And if you send the custom header with no-value, then its header must be terminated with a semicolon — like -H "X-Custom-Header;" — to send X-Custom-Header: 👑

curl makes sure that each header you add/replace is sent with the proper end-of-line marker, so you should not add that as part of the header content: do not add newlines or carriage returns, they only mess things up for you 😭 curl passes on the verbatim string you give it without any filter or other safe guards. That includes white space and control characters. fr fr.

This option can take an argument in @filename style, which then adds a header for each line in the input file 📄 using @- makes curl read the header file from stdin.

Please note that most anti-spam utilities check the presence and value of several MIME mail headers 🧚 these are "From:", "To:", "Date:" and "Subject:" among others, and they should be added with this option.

You need --proxy-header to send custom headers intended for an HTTP proxy, iykyk.

Passing on a "Transfer-Encoding: chunked" header when doing an HTTP request with a request body, makes curl send the data using chunked encoding 💫

WARNING: headers set with this option are set in all HTTP requests — even after redirects are followed, like when told with --location. This can lead to the header being sent to other hosts than the original host, so sensitive headers should be used with caution combined with following redirects. bestie pls be careful with this one 🙈

"Authorization:" and "Cookie:" headers are explicitly not passed on in HTTP requests when following redirects to other origins, unless --location-trusted is used 💜

--header can be used several times in a command line. slay.

Examples, because we love a demo:

curl -H "X-First-Name: Joe" https://example.com
curl -H "User-Agent: yes-please/2000" https://example.com
curl -H "Host:" https://example.com
curl -H @headers.txt https://example.com

See also --user-agent, --referer and --proxy-header 🦋

-h, --help <subject> — usage help, the wholesome one 🎀 provide help for the subject given as an optional argument.

No argument at all? curl displays the most important command line arguments 🌈

The argument can either be a category or a command line option. When a category is provided, curl shows all command line options within the given category. Specify category all to list all available options 👑 (yes, all of them, grab a snack)

If category is specified, curl displays all available help categories 🗂️

If the provided subject is instead an existing command line option — specified either in its short form with a single dash and a single letter, or in the long form with two dashes and a longer name — curl displays a help text for that option in the terminal 💻

The help output is extensive for some options. like, extensive.

If the provided command line option is not known, curl says so 💀

Examples:

curl --help all
curl --help --insecure
curl --help -f

✨ `--http3-only` ✨

(HTTP) Okay so this one tells curl to use HTTP/3 to the host in the URL, with no fallback to earlier HTTP versions. HTTP/3 can only be used for HTTPS and not for HTTP URLs — try it on a plain HTTP URL and the option triggers an error. Not her fault, that's just how it is 😭

The whole point of this one is letting you skip the Alt-Svc upgrade dance when you already know the target speaks HTTP/3 on that host and port. Main character energy: you already know.

This option makes curl fail if a QUIC connection cannot be established. It does not attempt any other HTTP versions on its own. Use --http3 for similar functionality with a fallback.

Providing --http3-only multiple times has no extra effect.

Example:

curl --http3-only https://example.com

For --http3-only to work, the underlying libcurl must be built to support HTTP/3. This option is mutually exclusive with --http1.1, --http1.0, --http2, --http2-prior-knowledge and --http3. Added in 7.88.0. See also --http1.1, --http2 and --http3.

💜 `--httpsig-algo <algorithm>` 💜

(HTTP) WARNING: this option is experimental. Do not use in production. (Like, fr fr, she's telling you for your own good 🙈)

Signs outgoing HTTP requests using RFC 9421 HTTP Message Signatures.

This option specifies which signing algorithm to use. Supported values are ed25519 and hmac-sha256. If you don't specify one, ed25519 is used. Any other value makes curl exit with an error — no vibes, just error.

HTTP Message Signatures turn on when any of --httpsig-algo, --httpsig-key, --httpsig-keyid or --httpsig-headers is given. Once enabled, --httpsig-key and --httpsig-keyid are required. Without any of these options, no signing is performed at all.

By default, the signed components are "method", "authority", "path", and "query" (when a query string is present). Use --httpsig-headers to override the set of components included in the signature.

If --httpsig-algo is provided several times, the last set value is used.

Examples:

curl --httpsig-key key.hex --httpsig-keyid "my-key" https://example.com
curl --httpsig-algo hmac-sha256 --httpsig-key secret.hex --httpsig-keyid "shared" https://example.com

Added in 8.22.0. See also --httpsig-key, --httpsig-keyid and --httpsig-headers.

🌸 `--httpsig-headers <components>` 🌸

(HTTP) WARNING: this option is experimental. Do not use in production.

Space-separated list of components to include in the RFC 9421 HTTP Message Signature. Derived components are given as bare names: "method", "authority", "path", and "query". HTTP header fields are given with a trailing colon, for example "content-type:" and "content-digest:". Yes, the colon matters. She's picky like that 💅

If not specified, the default set is "method authority path" (plus "query" when a query string is present in the URL).

Signing request headers

Header components are taken from -H / --header options only. Headers curl adds by default (such as "User-Agent") are not signed unless you set them explicitly, for example:

curl --httpsig-algo ed25519 \
  --httpsig-key k.hex \
  --httpsig-keyid mykey \
  -H "User-Agent: MyApp/1.0" \
  --httpsig-headers \
  "method authority path user-agent:" \
  $URL

Each component may appear only once. Duplicate identifiers in --httpsig-headers cause curl to exit with an error.

If --httpsig-headers is provided several times, the last set value is used.

Example:

curl --httpsig-algo ed25519 --httpsig-key key.hex --httpsig-keyid "my-key" --httpsig-headers "method authority content-type:" https://example.com

Added in 8.22.0. See also --httpsig-algo, --httpsig-key and --httpsig-keyid.

🎀 `--httpsig-key <key/file>` 🎀

(HTTP) WARNING: this option is experimental. Do not use in production.

The key to use for RFC 9421 HTTP Message Signatures. Provide it as-is, or as @filename. If the argument starts with an @, the rest is treated as a file name for the key.

The key is formatted as a series of hexadecimal digits in a single line. For ed25519, this is the 32-byte private seed (64 hex characters). For hmac-sha256, this is the shared secret. PEM files are not supported — sorry bestie, wrong format 😭

Generating Ed25519 keys

With OpenSSL 3:

openssl genpkey -algorithm ED25519 -out k.pem
openssl pkey -in k.pem -text -noout | \
  grep -A3 ^priv: | \
  tr -cd '[:xdigit:]' > k.hex

Use "@k.hex" with --httpsig-key.

If --httpsig-key is provided several times, the last set value is used.

Examples:

curl --httpsig-algo ed25519 --httpsig-key @key.hex --httpsig-keyid "my-key" https://example.com
curl --httpsig-key 123a56fb72197633bc --httpsig-keyid "my-key" https://example.com

Added in 8.22.0. See also --httpsig-algo and --httpsig-keyid.

⭐ `--httpsig-keyid <id>` ⭐

(HTTP) WARNING: this option is experimental. Do not use in production.

The key identifier to include in the "Signature-Input" header when using RFC 9421 HTTP Message Signatures. This value shows up as the "keyid" parameter and lets the server look up the correct verification key. It's giving ✨name tag at the function✨

If --httpsig-keyid is provided several times, the last set value is used.

Example:

curl --httpsig-algo ed25519 --httpsig-key key.hex --httpsig-keyid "my-key" https://example.com

Added in 8.22.0. See also --httpsig-algo and --httpsig-key.

🦋 `--ignore-content-length` 🦋

(FTP HTTP) For HTTP, ignore the Content-Length header. This is especially handy for servers running Apache 1.x, which reports an incorrect Content-Length for files larger than 2 gigabytes. (Those numbers are so unserious 😭)

For FTP, this makes curl skip the SIZE command that it would otherwise run to figure out the size before downloading a file.

Providing --ignore-content-length multiple times has no extra effect. Disable it again with --no-ignore-content-length.

Example:

curl --ignore-content-length https://example.com

🔥 `-k`, `--insecure` 🔥

(TLS SFTP SCP) By default, every secure connection curl makes is verified to be secure before the transfer takes place. This option makes curl skip that verification step and proceed without checking. She's just gonna... trust you. And that's the problem 👀

When this option is not used for protocols using TLS, curl verifies the server's TLS certificate before it continues: that the certificate contains the right name matching the hostname used in the URL, and that the certificate has been signed by a CA certificate present in the cert store. See this online resource for further details: https://curl.se/docs/sslcerts.html

For SFTP and SCP, this option makes curl skip the known_hosts verification. known_hosts is a file normally stored in the user's home directory in the .ssh subdirectory, which contains hostnames and their public keys.

WARNING: using this option makes the transfer insecure. Like, actually. Not a drill 💀

When curl uses secure protocols it trusts responses and allows, for example, HSTS and Alt-Svc information to be stored and used subsequently. Using --insecure can make curl trust and use such information from malicious servers. So yeah — the consequences aren't just this one transfer.

Providing --insecure multiple times has no extra effect. Disable it again with --no-insecure.

Example:

curl --insecure https://example.com

See also --proxy-insecure, --cacert and --capath.

🌈 `--interface <name>` 🌈

Perform the operation using a specified interface. You can enter an interface name, IP address or hostname. If you want to be specific specific, you can use the following special syntax:

if!<name> — Interface name. If the provided name does not match an existing interface, curl returns with error 45.
host!<name> — IP address or hostname.
ifhost!<interface>!<host> — Interface name and IP address or hostname. This syntax requires libcurl 8.9.0 or later. If the provided name does not match an existing interface, curl returns with error 45.

curl does not support using network interface names for this option on Windows. Sorry Windows girlies 🫶

That name resolve operation, if a hostname is provided, does not use DNS-over-HTTPS even if --doh-url is set. Sneaky detail, keep it in mind.

On Linux this option can be used to specify a VRF (Virtual Routing and Forwarding) device, but the binary then needs to either have the CAP_NET_RAW capability set or to be run as root. Root energy only 👑

If --interface is provided several times, the last set value is used.

Examples:

curl --interface eth0 https://example.com
curl --interface "host!10.0.0.1" https://example.com
curl --interface "if!enp3s0" https://example.com

🍓 `--ip-tos <string>` 🍓

Set Type of Service (TOS) for IPv4 or Traffic Class for IPv6.

The values allowed for <string> can be a numeric value between 1 and 255 or one of the following:

CS0, CS1, CS2, CS3, CS4, CS5, CS6, CS7, AF11, AF12, AF13, AF21, AF22, AF23, AF31, AF32, AF33, AF41, AF42, AF43, EF, VOICE-ADMIT, ECT1, ECT0, CE, LE, LOWCOST, LOWDELAY, THROUGHPUT, RELIABILITY, MINCOST

If --ip-tos is provided several times, the last set value is used.

Example:

curl --ip-tos CS5 https://example.com

Added in 8.9.0. See also --tcp-nodelay and --vlan-priority.

`--ipfs-gateway <URL>`

(IPFS) bestie, this is where you say which gateway to use for ipfs:// and ipns:// URLs. If you don't specify one, curl goes looking: first it checks whether the IPFS_GATEWAY environment variable is set, and if not, whether there's a ~/.ipfs/gateway file chilling there holding the gateway URL ✨

If you run a local IPFS node, that gateway is by default available under http://localhost:8080. A full example URL would look like:

curl --ipfs-gateway http://localhost:8080 \
   ipfs://bafybeigagd5nmnn2iys2f3

There are so many public IPFS gateways out there. See for example: https://ipfs.github.io/public-gateway-checker/

🚨 okay this part matters: if you opt to go for a remote gateway you need to be aware that you completely trust the gateway. That might be fine for local gateways that you host yourself. But with remote gateways there could potentially be malicious actors returning you data that does not match the request you made, inspect or even interfere with the request. You may not notice this when using curl. A mitigation could be to go for a "trustless" gateway — that means you locally verify the data. Consult the docs page on trusted vs trustless: https://docs.ipfs.tech/reference/http/gateway/#trusted-vs-trustless

If --ipfs-gateway is provided several times, the last set value is used. iykyk 💅

Example:

curl --ipfs-gateway https://example.com ipfs://

Added in 8.4.0. See also --help and --manual.

`-4`, `--ipv4`

Request only IPv4 addresses when resolving hostnames — and not, for example, any IPv6. That's it, that's the whole vibe 🦋

Providing --ipv4 multiple times has no extra effect. Slay, but like, redundantly.

Example:

curl --ipv4 https://example.com

This option is mutually exclusive with --ipv6. See also --http1.1 and --http2.

`-6`, `--ipv6`

The mirror image, bestie: request only IPv6 addresses when resolving hostnames, and not for example any IPv4 💜

Heads up though — your resolver may still respond to an IPv6-only resolve request by returning IPv6 addresses that contain "mapped" IPv4 addresses for compatibility purposes. macOS is known to do this. Not me calling out macOS but 👀

Providing --ipv6 multiple times has no extra effect.

Example:

curl --ipv6 https://example.com

This option is mutually exclusive with --ipv4. See also --http1.1 and --http2.

`--json <data>`

(HTTP) Send the specified JSON data in a POST request to the HTTP server. --json is basically a shortcut for passing on these three options, and the way it bundles them is lowkey iconic:

--data-binary [arg]
--header "Content-Type: application/json"
--header "Accept: application/json"

There is no verification that the passed in data is actual JSON or that the syntax is correct. curl is not your linter, she is simply delivering the vibes 📦

If you start the data with the letter @, the rest should be a filename to read the data from — or a single dash (-) if you want curl to read the data from stdin. Posting data from a file named 'foobar' would thus be done with --json @foobar and to instead read the data from stdin, use --json @-.

If this option is used more than once on the same command line, the additional data pieces are concatenated to the previous before sending. String them together, bestie 🧵

The headers this option sets can be overridden with --header as usual. Your house, your rules.

--json can be used several times in a command line.

Examples:

curl --json '{ "drink": "coffee" }' https://example.com
curl --json '{ "drink":' --json ' "coffee" }' https://example.com
curl --json @prepared https://example.com
curl --json @- https://example.com < json.txt

This option is mutually exclusive with --form, --head and --upload-file. Added in 7.82.0. See also --data-binary and --data-raw.

`-j`, `--junk-session-cookies`

(HTTP) When curl is told to read cookies from a given file, this option makes it discard all session cookies. This has the same effect as if a new session is started — and typical browsers discard session cookies when they are closed down, so you're just matching their energy 🍪

Session cookies are cookies without a set expiry time. They are meant to only last for "a session". That's the whole deal with them.

Providing --junk-session-cookies multiple times has no extra effect. Disable it again with --no-junk-session-cookies.

Example:

curl --junk-session-cookies -b cookies.txt https://example.com

`--keepalive-cnt <integer>`

Set the maximum number of keepalive probes TCP should send but get no response before dropping the connection. This option is usually used in conjunction with --keepalive-time. They're a duo, fr fr 🫶

This option is supported on Linux, *BSD/macOS, Windows >=10.0.16299, Solaris 11.4, and recent AIX, HP-UX and more. This option has no effect if --no-keepalive is used.

If unspecified, the option defaults to 9.

If --keepalive-cnt is provided several times, the last set value is used.

Example:

curl --keepalive-cnt 3 https://example.com

Added in 8.9.0. See also --keepalive-time and --no-keepalive.

`--keepalive-time <seconds>`

Set the time a connection needs to remain idle before sending keepalive probes — and the time between individual keepalive probes. It is currently effective on operating systems offering the TCP_KEEPIDLE and TCP_KEEPINTVL socket options (meaning Linux, *BSD/macOS, Windows, Solaris, and recent AIX, HP-UX and more) 🌈

Keepalive is used by the TCP stack to detect broken networks on idle connections. The number of missed keepalive probes before declaring the connection down is OS dependent and is commonly 8 (*BSD/macOS/AIX), 9 (Linux/AIX) or 5/10 (Windows), and this number can be changed by specifying the curl option keepalive-cnt. Note that this option has no effect if --no-keepalive is used.

If unspecified, the option defaults to 60 seconds.

If --keepalive-time is provided several times, the last set value is used.

Example:

curl --keepalive-time 20 https://example.com

See also --no-keepalive, --keepalive-cnt and --max-time.

`--key <key>`

(TLS SCP SFTP) Private key filename 🔑 This lets you provide your private key in this separate file. For SSH, if not specified, curl tries the following candidates in order: ~/.ssh/id_rsa, ~/.ssh/id_dsa, ./id_rsa, ./id_dsa.

If curl is built against OpenSSL library, and the engine pkcs11 or pkcs11 provider is available, then a PKCS#11 URI (RFC 7512) can be used to specify a private key located in a PKCS#11 device. A string beginning with pkcs11: is interpreted as a PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine option is set as pkcs11 if none was provided and the --key-type option is set as ENG or PROV if none was provided (depending on OpenSSL version). curl really said "I got you, I'll fill in the blanks" 💅

If curl is built against Schannel then this option is ignored for TLS protocols (HTTPS, etc). That backend expects the private key to be already present in the keychain or PKCS#12 file containing the certificate. Different backend, different rules, no cap.

If --key is provided several times, the last set value is used.

Example:

curl --cert certificate --key here https://example.com

`--key-type <type>`

(TLS) Private key file type. Specify which type your --key provided private key is. DER, PEM, and ENG are supported. If not specified, PEM is assumed 🎀

If --key-type is provided several times, the last set value is used.

Example:

curl --key-type DER --key here https://example.com

`--knownhosts <file>`

(SCP SFTP) When doing SCP and SFTP transfers, curl automatically checks a database containing identification for all hosts it has ever been used with, to verify that the host it connects to is the same as previously. Host keys are stored in such a known hosts file. curl uses the ~/.ssh/known_hosts in the user's home directory by default. She remembers everyone she's ever met, basically 📖

This option lets a user specify a specific file to check the host against.

The known hosts check can be disabled with --insecure, but that makes the transfer insecure and is strongly discouraged. Like, don't. Genuinely don't. 🙈

If --knownhosts is provided several times, the last set value is used.

Example:

curl --knownhosts filename --key here https://example.com

Added in 8.17.0. See also --hostpubsha256, --hostpubmd5, --insecure and --key.

`--krb <level>`

(FTP) Ugh, okay — this is a deprecated option (added in 8.17.0). It has no function anymore. It's giving retired icon, still on the guest list 💀

For the historical record: it enabled Kerberos authentication and use. The level must be entered and should be one of "clear", "safe", "confidential", or "private". Should you use a level that is not one of these, "private" is used.

If --krb is provided several times, the last set value is used.

Example:

curl --krb clear ftp://example.com/

For --krb to work, it requires that the underlying libcurl is built to support Kerberos. See also --delegation and --ssl.

`--libcurl <file>`

Append this option to any ordinary curl command line, and you get libcurl-using C source code written to the file that does the equivalent of what your command-line operation does. Yes bestie, curl will literally write the C for you, main character behavior ✨

The source code output should be considered example code and is not production ready. You must double-check that the code actually does what you want it do. Do not just ship it, I'm begging 🫶

This option is global and does not need to be specified for each use of --next.

If --libcurl is provided several times, the last set value is used.

Example:

curl --libcurl client.c https://example.com

`--limit-rate <speed>`

Specify the maximum transfer rate you want curl to use — for both downloads and uploads 🚦 This feature is useful if you have a limited pipe and you would like your transfer not to use your entire bandwidth. To make it slower than it otherwise would be. Considerate queen behavior, honestly 💖

okay so the number you give is measured in bytes/second, unless you tack a suffix on the end. Slap a k or K after it and it counts as kilobytes, m or M makes it megabytes, etc. The supported suffixes are k, M, G, T, P and they're all 1024-based. So like, 1k is literally 1024. Examples: 200K, 3m and 1G. 🫶

The rate-limiting logic works by averaging the transfer speed so it stays no more than your set threshold over a period of multiple seconds. It's giving chill vibes, not a hard clamp.

If you also use the --speed-limit option, that option takes precedence and might cripple the rate-limiting slightly, all to help keep the speed-limit logic working. iykyk. 💅

Starting in curl 8.19.0, you can specify the rate using a fraction, like "2.5M" for two and a half megabytes per second. It only works with a period (.) delimiter, independent of what your locale might prefer — so don't come at it with commas, bestie. 🙈

If --limit-rate is provided several times, the last set value is used.

Examples:

curl --limit-rate 123.45K https://example.com
curl --limit-rate 1000 https://example.com
curl --limit-rate 10M https://example.com
curl --limit-rate 200K --max-time 60 https://example.com

See also --rate, --speed-limit and --speed-time.

-l, --list-only — (FTP POP3 SFTP FILE) When you're listing an FTP directory, this forces a name-only view. Maybe particularly useful if you want to machine-parse the contents of an FTP directory, since the normal directory view does not use a standard look or format. When used like this, the option causes an NLST command to be sent to the server instead of LIST. 🗂️

Note: some FTP servers list only files in their response to NLST — they do not include subdirectories and symbolic links. 😭

When listing an SFTP directory, this switch forces a name-only view, one per line. This is especially useful if you want to machine-parse the contents of an SFTP directory, since the normal directory view provides more information than filenames.

When retrieving a specific email from POP3, this switch forces a LIST command to be performed instead of RETR. Particularly useful if you wanna see if a specific message-id exists on the server and what size it is. 📬

For FILE, this option has no effect yet, as directories are always listed in this mode.

Note: when combined with --request, this option can be used to send a UIDL command instead, so you can use the email's unique identifier rather than its message-id to make the request.

Providing --list-only multiple times has no extra effect. Disable it again with --no-list-only.

Example:

curl --list-only ftp://example.com/dir/

See also --proxy.

--ntlm — (HTTP) use NTLM authentication. the NTLM auth method was designed by Microsoft and is used by IIS web servers. it's a proprietary protocol, reverse-engineered by clever people and implemented in curl based on their efforts 👑

and ok, real talk: this kind of behavior should not be endorsed — you should encourage everyone who uses NTLM to switch to a public and documented authentication method instead, such as Digest. periodt.

if you want NTLM for your proxy authentication, use --proxy-ntlm instead.

providing --ntlm multiple times has no extra effect. disable it again with --no-ntlm.

Example:

curl --ntlm -u user:password https://example.com

for --ntlm to work, it requires that the underlying libcurl is built to support TLS. See also --proxy-ntlm.

--ntlm-wb — (HTTP) deprecated option (added in 8.8.0). it's giving "we don't do this anymore" 💀

it enabled NTLM much in the style --ntlm does, but handed the authentication over to a separate executable that got executed when needed.

providing --ntlm-wb multiple times has no extra effect.

Example:

curl --ntlm-wb -u user:password https://example.com

`--proxy-tlsv1` 🎀

Okay so when you're negotiating with an HTTPS proxy, this one says "bestie, use at least TLS version 1.x, mmkay?" — and by 1.x we mean TLS version 1.0 or higher, no exceptions. 💅

It's literally the proxy-context twin of --tlsv1, just aimed at your HTTPS proxy instead of the main connection.

Passing --proxy-tlsv1 more than once? Zero extra effect, it's not a "more is more" situation. 🙅‍♀️

Example:
curl --proxy-tlsv1 -x https://proxy.example https://example.com

See also --proxy.

`-U`, `--proxy-user` `<user:password>` 🔐

This is where you hand curl the username and password for proxy authentication. Slay.

Now, if you're on a Windows SSPI-enabled curl binary and you're doing either Negotiate or NTLM authentication, you can tell curl to grab the username and password straight from your environment by passing a single colon with this option, like this: -U :.

On systems where it works, curl hides the given option argument from process listings. But listen — that is not enough to protect credentials from possibly getting seen by other users on the same system, because they're still visible for a moment before being cleared. 😭 Such sensitive data should be retrieved from a file instead or similar, and never used in clear text in a command line. Fr fr.

If --proxy-user is provided several times, the last set value is used.

Example:
curl --proxy-user smith:secret -x proxy https://example.com

`--proxy1.0` `<host[:port]>` 🕰️

Use the specified HTTP 1.0 proxy. If the port number is not specified, it is assumed at port 1080. Periodt.

The only difference between this and the HTTP proxy option --proxy is that attempts to use CONNECT through the proxy specify an HTTP 1.0 protocol instead of the default HTTP 1.1. That's it, that's the whole flex. ✨

Providing --proxy1.0 multiple times has no extra effect.

Example:
curl --proxy1.0 http://proxy https://example.com

See also --proxy, --socks5 and --preproxy.

`-p`, `--proxytunnel` 🚇

When an HTTP proxy is used with --proxy, this option makes curl tunnel the traffic through the proxy. Iconic behavior, honestly.

The tunnel approach is made with the HTTP proxy CONNECT request, and it requires that the proxy allows direct connection to the remote port number curl wants to tunnel through to. If the proxy says no, that's a whole vibe check failed. 💀

To suppress proxy CONNECT response headers when curl is set to output headers, use --suppress-connect-headers.

Providing --proxytunnel multiple times has no extra effect. Disable it again with --no-proxytunnel.

Example:
curl --proxytunnel -x http://proxy https://example.com

See also --proxy.

`--pubkey` `<key>` 🗝️

(SFTP SCP) Public key filename. Lets you provide your public key in this separate file.

Real talk though: curl attempts to automatically extract the public key from the private key file, so passing this option is generally not required. Note that this public key extraction requires libcurl to be linked against a copy of libssh2 1.2.8 or higher that is itself linked against OpenSSL. Very specific, very demure. 🎀

If --pubkey is provided several times, the last set value is used.

Example:
curl --pubkey file.pub sftp://example.com/

`-Q`, `--quote` `<command>` 💌

(FTP SFTP) Send an arbitrary command to the remote FTP or SFTP server. So extra, so useful.

Quote commands are sent BEFORE the transfer takes place — immediately after the initial PWD command in an FTP transfer, to be exact. To make commands take place after a successful transfer, prefix them with a dash -.

(FTP only) To make commands be sent after curl has changed the working directory, immediately before the file transfer command(s), prefix the command with a +.

You may specify any number of commands. No cap. 🫶

By default curl stops at first failure. To make curl continue even if the command fails, prefix the command with an asterisk (*). Otherwise, if the server returns failure for one of the commands, the entire operation is aborted. 😭

You must send syntactically correct FTP commands as RFC 959 defines to FTP servers, or one of the commands listed below to SFTP servers.

SFTP is a binary protocol. Unlike for FTP, curl interprets SFTP quote commands itself before sending them to the server. Filenames must be provided within double quotes to embed spaces, backslashes, quotes or double quotes. Within double quotes the following escape sequences are available for that purpose: \\, \", and \'.

Following is the list of all supported SFTP quote commands:

atime date file — The atime command sets the last access time of the file named by the file operand. The date expression can be all sorts of date strings, see the curl_getdate(3) man page for date expression details. (Added in 7.73.0)
chgrp group file — The chgrp command sets the group ID of the file named by the file operand to the group ID specified by the group operand. The group operand is a decimal integer group ID.
chmod mode file — The chmod command modifies the file mode bits of the specified file. The mode operand is an octal integer mode number.
chown user file — The chown command sets the owner of the file named by the file operand to the user ID specified by the user operand. The user operand is a decimal integer user ID.
ln source_file target_file — The ln and symlink commands create a symbolic link at the target_file location pointing to the source_file location.
mkdir directory_name — The mkdir command creates the directory named by the directory_name operand.
mtime date file — The mtime command sets the last modification time of the file named by the file operand. The date expression can be all sorts of date strings, see the curl_getdate(3) man page for date expression details. (Added in 7.73.0)
pwd — The pwd command returns the absolute path name of the current working directory.
rename source target — The rename command renames the file or directory named by the source operand to the destination path named by the target operand.
rm file — The rm command removes the file specified by the file operand.
rmdir directory — The rmdir command removes the directory entry specified by the directory operand, provided it is empty.
symlink source_file target_file — See ln.

--quote can be used several times in a command line.

Example:
curl --quote "DELE file" ftp://example.com/foo

`--random-file` `<file>` 🗑️

Deprecated option. This option is ignored (added in 7.84.0). Prior to that it only had an effect on curl if built to use old versions of OpenSSL.

Specify the path name to file containing random data. The data may be used to seed the random engine for SSL connections. Very "back in my day" energy, ngl. 🕰️

If --random-file is provided several times, the last set value is used.

Example:
curl --random-file rubbish https://example.com

`-r`, `--range` `<range>` ✂️

(HTTP FTP SFTP FILE) Retrieve a byte range (i.e. a partial document) from an HTTP/1.1, FTP or SFTP server or a local FILE. Ranges can be specified in a number of ways:

0-499 — specifies the first 500 bytes
500-999 — specifies the second 500 bytes
-500 — specifies the last 500 bytes
9500- — specifies the bytes from offset 9500 and forward
0-0,-1 — specifies the first and last byte only(*)(HTTP)
100-199,500-599 — specifies two separate 100-byte ranges(*) (HTTP)

(*) = NOTE that if specifying multiple ranges and the server supports it, then it replies with a multiple part response that curl returns as-is. It contains meta information in addition to the requested bytes. Parsing or otherwise transforming this response is the responsibility of the caller. So like, that's on you, bestie. 🙈

Only digit characters (0-9) are valid in the 'start' and 'stop' fields of the 'start-stop' range syntax. If a non-digit character is given in the range, the server's response is unspecified, depending on the server's configuration. Unspecified! Do not do this.

Many HTTP/1.1 servers do not have this feature enabled, so that when you attempt to get a range, curl instead gets the whole document. Surprise! 🎁

FTP and SFTP range downloads only support the simple 'start-stop' syntax (optionally with one of the numbers omitted). FTP use depends on the extended FTP command SIZE.

When using this option for HTTP uploads using POST or PUT, functionality is not guaranteed. The HTTP protocol has no standard interoperable resume upload and curl uses a set of headers for this purpose that once proved working for some servers and have been left for those who find that useful. It's giving legacy, but make it work. 💅

This command line option is mutually exclusive with --continue-at: you can only use one of them for a single transfer.

If --range is provided several times, the last set value is used.

Example:
curl --range 22-44 https://example.com

See also --continue-at and --append.

`--rate` `<max request rate>` 🎚️

Specify the maximum transfer frequency you allow curl to use — in number of transfer starts per time unit (sometimes called request rate). Without this option, curl starts the next transfer as fast as possible. Literally main character energy, zero chill. 🌈

If given several URLs and a transfer completes faster than the allowed rate, curl waits until the next transfer is started to maintain the requested rate. This option has no effect when --parallel is used. (Parallel said "I do what I want." 👑)

The request rate is provided as "N/U" where N is an integer number and U is a time unit. Supported units are 's' (second), 'm' (minute), 'h' (hour) and 'd' (day, as in a 24 hour unit). The default time unit, if no "/U" is provided, is number of transfers per hour.

That 10-per-minute cap means curl literally waits 6 seconds after starting the previous transfer before it even thinks about the next one. Patient queen behavior. 💅

The timing math runs on millisecond resolution, but plot twist: if you set the frequency above 1000 per second, curl just goes "lol k" and runs unrestricted. 🏃‍♀️💨

When you're retrying transfers (that's --retry), the separate retry delay logic kicks in instead — this setting does not apply there.

Starting in version 8.10.0 you can drop time units right into the rate expression, so "5/15s" means no more than 5 transfers per 15 seconds, and "3/4h" means 3 transfers per 4 hours. No spaces allowed, bestie. 🚫

This option is global and does not need to be specified for each use of --next.

If --rate is provided several times, the last set value is used.

Examples:

curl --rate 2/s https://example.com ...
curl --rate 3/h https://example.com ...
curl --rate 14/m https://example.com ...

Added in 7.84.0. See also --limit-rate and --retry-delay.

--raw — (HTTP) When used, it disables all internal HTTP decoding of content or transfer encodings, and instead makes them passed on unaltered, raw. 🍣

Providing --raw multiple times has no extra effect. Disable it again with --no-raw.

Example:

curl --raw https://example.com

See also --socks5.

--socks5-gssapi — (GSS/kerberos) Use GSS-API authentication when connecting to a SOCKS5 proxy. The GSS-API authentication is enabled by default (if curl is compiled with GSS-API support). Use --socks5-basic to force username/password authentication to SOCKS5 proxies.

Providing --socks5-gssapi multiple times has no extra effect. Disable it again with --no-socks5-gssapi.

Example:

curl --socks5-gssapi --socks5 hostname:4096 https://example.com

See also --socks5.

--socks5-gssapi-nec — (GSS/kerberos) As part of the GSS-API negotiation a protection mode is negotiated. RFC 1961 says in section 4.3/4.4 it should be protected, but the NEC reference implementation does not 😬 The option --socks5-gssapi-nec allows the unprotected exchange of the protection mode negotiation. (Yes, this is a compatibility hack. She's doing her best.)

Providing --socks5-gssapi-nec multiple times has no extra effect. Disable it again with --no-socks5-gssapi-nec.

Example:

curl --socks5-gssapi-nec --socks5 hostname:4096 https://example.com

See also --socks5.

--socks5-gssapi-service <name> — Set the service name for a socks server. Default is rcmd/server-fqdn ✨

If --socks5-gssapi-service is provided several times, the last set value is used.

Example:

curl --socks5-gssapi-service sockd --socks5 hostname:4096 https://example.com

See also --socks5.

--socks5-hostname <host[:port]> — Use the specified SOCKS5 proxy (and let the proxy resolve the hostname — handing off the detective work 🕵️‍♀️). If the port number is not specified, it is assumed at port 1080.

To specify the proxy on a Unix domain socket, use localhost for host and append the absolute path to the domain socket. For example: socks5h://localhost/path/to/socket.sock (the scheme may be omitted).

This option overrides any previous use of --proxy, as they are mutually exclusive.

This option is superfluous since you can specify a socks5 hostname proxy with --proxy using a socks5h:// protocol prefix.

If --socks5-hostname is provided several times, the last set value is used.

Example:

curl --socks5-hostname proxy.example:7000 https://example.com

Still on that option's fine print, bestie — same flag, last little detail:

This option is mutually exclusive with --proxy, --socks4, --socks4a and --socks5. See also --socks5 and --socks4a. 💅

`-Y`, `--speed-limit <speed>` 🐢

If a transfer is slower than this set speed (in bytes per second) for a given number of seconds, it gets aborted. The time period is set with --speed-time and is 30 seconds by default. So like… if your download is Being Slow for long enough, curl just says "nope, we're done here" 😭

If --speed-limit is provided several times, the last set value is used.

Example:

curl --speed-limit 300 --speed-time 10 https://example.com

See also --speed-time, --limit-rate and --max-time.

`-y`, `--speed-time <seconds>` ⏱️

If a transfer runs slower than speed-limit bytes per second during a speed-time period, the transfer is aborted. If speed-time is used, the default speed-limit is 1 unless set with --speed-limit. (yes, one whole byte per second — very patient of curl honestly 🫶)

This option controls transfers (in both directions) but does not affect slow connects etc. If this is a concern for you, try the --connect-timeout option.

If --speed-time is provided several times, the last set value is used.

Example:

curl --speed-limit 300 --speed-time 10 https://example.com

See also --speed-limit and --limit-rate.

`--ssl` (FTP IMAP POP3 SMTP LDAP) 🔐

Warning: this is considered an insecure option. Consider using --ssl-reqd instead to be sure curl upgrades to a secure connection. Like, genuinely, the upgrade is not guaranteed here bestie 💀

Try to use SSL/TLS for the connection — often referred to as STARTTLS or STLS because of the involved commands. Reverts to a non-secure connection if the server does not support SSL/TLS. See also --ftp-ssl-control and --ssl-reqd for different levels of encryption required.

This option is handled in LDAP (added in 7.81.0). It is fully supported by the OpenLDAP backend and ignored by the generic ldap backend.

Please note that a server may close the connection if the negotiation fails.

If set, this option overrides --ftp-ssl-control.

This option was formerly known as --ftp-ssl. That option name can still be used but might be removed in a future version.

Providing --ssl multiple times has no extra effect. Disable it again with --no-ssl.

Example:

curl --ssl pop3://example.com/

See also --ssl-reqd, --insecure and --ciphers.

`--ssl-allow-beast` 🦁

(TLS) Do not work around a security flaw in the TLS1.0 protocol known as BEAST. If this option is not used, the TLS layer may use workarounds known to cause interoperability problems with some older server implementations.

This option only changes how curl does TLS 1.0 and has no effect on later TLS versions.

WARNING: this option loosens the TLS security, and by using this flag you ask for exactly that. You're literally requesting less security, no cap 😬

Providing --ssl-allow-beast multiple times has no extra effect. Disable it again with --no-ssl-allow-beast.

Example:

curl --ssl-allow-beast https://example.com

See also --proxy-ssl-allow-beast and --insecure.

`--ssl-auto-client-cert` 🪪

(TLS) (Schannel) Automatically locate and use a client certificate for authentication, when requested by the server. Since the server can request any certificate that supports client authentication in the OS certificate store it could be a privacy violation and unexpected. Like, it might pick one you did not expect — lowkey a yikes 🙈

Providing --ssl-auto-client-cert multiple times has no extra effect. Disable it again with --no-ssl-auto-client-cert.

Example:

curl --ssl-auto-client-cert https://example.com

Added in 7.77.0. See also --proxy-ssl-auto-client-cert.

`--ssl-no-revoke` 🚫

(TLS) (Schannel) Disable certificate revocation checks.

WARNING: this option loosens the SSL security, and by using this flag you ask for exactly that. Same energy as --ssl-allow-beast — you're opting into the chill version of security, deliberately 💅

Providing --ssl-no-revoke multiple times has no extra effect. Disable it again with --no-ssl-no-revoke.

Example:

curl --ssl-no-revoke https://example.com

`--ssl-reqd` ✅🔐

(FTP IMAP POP3 SMTP LDAP) Require SSL/TLS for the connection — often referred to as STARTTLS or STLS because of the involved commands. Terminates the connection if the transfer cannot be upgraded to use SSL/TLS. It's giving "secure or nothing" and honestly? iconic.

This option is handled in LDAP (added in 7.81.0). It is fully supported by the OpenLDAP backend and rejected by the generic ldap backend if explicit TLS is required.

This option is unnecessary if you use a URL scheme that in itself implies immediate and implicit use of TLS, like for FTPS, IMAPS, POP3S, SMTPS and LDAPS. Such a transfer always fails if the TLS handshake does not work.

This option was formerly known as --ftp-ssl-reqd.

Providing --ssl-reqd multiple times has no extra effect. Disable it again with --no-ssl-reqd.

Example:

curl --ssl-reqd ftp://example.com

`--ssl-revoke-best-effort` 🌸

(TLS) (Schannel) Ignore certificate revocation checks when they failed due to missing/offline distribution points for the revocation check lists. It's the "the list wasn't reachable so we're letting it slide" option 🫶

Providing --ssl-revoke-best-effort multiple times has no extra effect. Disable it again with --no-ssl-revoke-best-effort.

Example:

curl --ssl-revoke-best-effort https://example.com

Added in 7.70.0. See also --crlfile and --insecure.

`--ssl-sessions <filename>` 🎟️✨

(TLS) WARNING: this option is experimental. Do not use in production. Seriously, it's literally in the "do not use in production" bin 🧪

Use the given file to load SSL session tickets into curl's cache before starting any transfers. At the end of a successful curl run, the cached SSL sessions tickets are saved to the file, replacing any previous content.

The file does not have to exist, but curl reports an error if it is unable to create it. Unused loaded tickets are saved again, unless they get replaced or purged from the cache for space reasons.

Using a session file allows --tls-earlydata to send the first request in "0-RTT" mode, should an SSL session with the feature be found. Note that a server may not support early data. Also note that early data does not provide forward secrecy, e.g. is not as secure. So like… faster but slightly less safe, your call bestie 😬

The SSL session tickets are stored as base64 encoded text, each ticket on its own line. The hostnames are cryptographically salted and hashed. While this prevents someone from easily seeing the hosts you contacted, they could still check if a specific hostname matches one of the values. (privacy-adjacent, but not privacy-perfect, iykyk)

This feature requires that the underlying libcurl was built with the experimental SSL session import/export feature (SSLS-EXPORT) enabled.

The sessions in the file identify origin and used TLS configurations. Configuration parameters identified by a file path are only matched to the path, not the file's content. Updates to CA, CRL or key file contents do not invalidate previously saved sessions.

Most TLS sessions handed out by servers have a short lifetime, which limits the risk. Also, curl does not persist TLS session in this file that are tied to authentication, e.g. a client certificate. If that all is not acceptable, ssl session files should be cleared when older than the CA/CRL file used or not used at all.

If --ssl-sessions is provided several times, the last set value is used.

Example:

curl --ssl-sessions sessions.txt https://example.com

Added in 8.12.0. See also --tls-earlydata.

`-2`, `--sslv2` 🕰️

(SSL) This option previously asked curl to use SSLv2, but is now ignored (added in 7.77.0). SSLv2 is widely considered insecure (see RFC 6176). It's retired, girl, let her rest 💀

Providing --sslv2 multiple times has no extra effect.

Example:

curl --sslv2 https://example.com

For --sslv2 to work, it requires that the underlying libcurl is built to support TLS. This option is mutually exclusive with --sslv3, --tlsv1, --tlsv1.1 and --tlsv1.2. See also --http1.1 and --http2.

`-3`, `--sslv3` 🕰️🕰️

(SSL) This option previously asked curl to use SSLv3, but is now ignored (added in 7.77.0). SSLv3 is widely considered insecure (see RFC 7568). Same deal as its older sibling — a museum piece 🏛️

Providing --sslv3 multiple times has no extra effect.

Example:

curl --sslv3 https://example.com

For --sslv3 to work, it requires that the underlying libcurl is built to support TLS. This option is mutually exclusive with --sslv2, --tlsv1, --tlsv1.1 and --tlsv1.2. See also --http1.1 and --http2.

`--stderr <file>` 📝

Redirect all writes to stderr to the specified file instead. If the filename is a plain -, it is instead written to stdout.

This option is global and does not need to be specified for each use of --next.

If --stderr is provided several times, the last set value is used.

Example:

curl --stderr output.txt https://example.com

`--styled-output` 💖

Enable automatic use of bold font styles when writing HTTP headers to the terminal. Use --no-styled-output to switch them off. Yes, curl can be cute about your headers, we love a little aesthetic ✨

Styled output requires a terminal that supports bold fonts. This feature is not present on curl for Windows due to lack of this capability. (Windows besties, you're not getting the bold headers, sorry 😭)

This option is global and does not need to be specified for each use of --next.

Providing --styled-output multiple times has no extra effect. Disable it again with --no-styled-output.

Example:

curl --styled-output -I https://example.com

`--suppress-connect-headers` 🤫

When --proxytunnel is used and a CONNECT request is made, do not output proxy CONNECT response headers. This option is meant to be used with --dump-header or --show-headers which are used to show protocol headers in the output. It has no effect on debug options such as --verbose or --trace, or any statistics.

Providing --suppress-connect-headers multiple times has no extra effect. Disable it again with --no-suppress-connect-headers.

Example:

curl --suppress-connect-headers --show-headers -x proxy https://example.com

more options coming, don't go anywhere bestie 🦋

See also --dump-header, --show-headers and --proxytunnel.

--tcp-fastopen — turns on TCP Fast Open (RFC 7413) 🌈. It's this cute little TCP extension that lets data get sent earlier over the connection (like, before the final handshake ACK) as long as the client and server have been connected before. Basically speedrunning the vibes.

Passing --tcp-fastopen multiple times has no extra effect (it's not a "more is more" situation, bestie). Turn it back off with --no-tcp-fastopen.

Example:

curl --tcp-fastopen https://example.com

💅 `--tlsv1.1`

Example:

curl --tlsv1.1 https://example.com

See also --tlsv1.3 and --tls-max. 🫶

✨ `--tlsv1.2`

(TLS) Bestie, this forces curl to use TLS version 1.2 or later when it's connecting to a remote TLS server.

Okay so tea ☕ — in old versions of curl this option was documented as allowing __only__ TLS 1.2. That behavior was inconsistent depending on the TLS library. So if you wanna set a maximum TLS version, use --tls-max instead, kk?

Providing --tlsv1.2 multiple times has no extra effect (like, it's not gonna try harder, bestie 💀).

Example:

curl --tlsv1.2 https://example.com

See also --tlsv1.3 and --tls-max. 🦋

🔥 `--tlsv1.3`

(TLS) Same vibe, newer protocol: forces curl to use TLS version 1.3 or later when connecting to a remote TLS server. Slay.

If the connection is done without TLS, this option has no effect at all. That includes QUIC-using (HTTP/3) transfers, iykyk.

Heads up bestie 🙈 — TLS 1.3 is not supported by all TLS backends.

Providing --tlsv1.3 multiple times has no extra effect.

Example:

curl --tlsv1.3 https://example.com

See also --tlsv1.2 and --tls-max. 💜

🎀 `--tr-encoding`

(HTTP) Requests a compressed Transfer-Encoding response using one of the algorithms curl supports, and uncompresses the data while it's receiving it. Fancy.

Okay so the lore 📖: this method was once intended to be the way to do automatic data compression for HTTP, but for all practical purposes using Content-Encoding as done with --compressed has superseded transfer encoding. So the --tr-encoding option is therefore often not one you want, ngl. It's giving deprecated-in-spirit.

Providing --tr-encoding multiple times has no extra effect. Disable it again with --no-tr-encoding.

Example:

curl --tr-encoding https://example.com

🦋 `--trace <file>`

Saves a full trace dump of all incoming and outgoing data — including descriptive information — in the given output file. Use - as filename to have the output sent to stdout. Use % as filename to have the output sent to stderr. Iconic little trio.

⚠️ Bestie, real talk: verbose output of curl activities and network traffic might contain sensitive data, including usernames, credentials or secret data content. Be aware and be careful when sharing trace logs with others. Do not be posting those in the group chat 😭

This option is global and does not need to be specified for each use of --next.

If --trace is provided several times, the last set value is used.

Example:

curl --trace log.txt https://example.com

This option is mutually exclusive with --verbose and --trace-ascii. See also --trace-ascii, --trace-config, --trace-ids and --trace-time. 💖

🧚 `--trace-ascii <file>`

Saves a full trace dump of all incoming and outgoing data, including descriptive information, in the given output file. Use - as filename to have the output sent to stdout. Use % as filename to send the output to stderr.

This is similar to --trace, but it leaves out the hex part and only shows the ASCII part of the dump. It makes smaller output that might be easier to read for untrained humans 🫶 (no shade, we were all untrained humans once).

⚠️ Same warning, same energy: verbose output of curl activities and network traffic might contain sensitive data, including usernames, credentials or secret data content. Be aware and be careful when sharing trace logs with others.

This option is global and does not need to be specified for each use of --next.

If --trace-ascii is provided several times, the last set value is used.

Example:

curl --trace-ascii log.txt https://example.com

This option is mutually exclusive with --trace and --verbose. See also --verbose and --trace. ⭐

🌈 `--trace-config <string>`

Sets configuration for trace output. It's a comma-separated list of components where detailed output can be made available from. Names are case-insensitive. Specify 'all' to enable all trace components. Go off, king.

In addition to trace component names, specify "ids" and "time" to avoid extra --trace-ids or --trace-time parameters. Efficient 💅

See the curl_global_trace(3) man page for more details.

This option is global and does not need to be specified for each use of --next.

--trace-config can be used several times in a command line.

Example:

curl --trace-config ids,http/2 https://example.com

Added in 8.3.0. See also --verbose and --trace. 🍓

👑 `--trace-ids`

Prepends the transfer and connection identifiers to each trace or verbose line that curl displays.

The identifiers are unique numbers assigned to each connection and transfer to allow a user to better understand which transfer and connection each verbose output line refers to. It's literally giving main character energy to every single line so you know who's who 🎀

This option is global and does not need to be specified for each use of --next.

Providing --trace-ids multiple times has no extra effect. Disable it again with --no-trace-ids.

Example:

curl --trace-ids --trace-ascii output https://example.com

Added in 8.2.0. See also --trace and --verbose. 💫

⏰ `--trace-time`

Prepends a time stamp to each trace or verbose line that curl displays. So you can be like "when did this happen" and curl is like "here bestie, I gotchu" 🫶

This option is global and does not need to be specified for each use of --next.

Providing --trace-time multiple times has no extra effect. Disable it again with --no-trace-time.

Example:

curl --trace-time --trace-ascii output https://example.com

See also --trace and --verbose. 🦋

🔌 `--unix-socket <path>`

(HTTP) Connects to the server through this Unix domain socket, instead of using the network. Local vibes only ✨

To connect to a proxy over Unix domain socket, see --proxy.

If --unix-socket is provided several times, the last set value is used.

Example:

curl --unix-socket socket-path https://example.com

📤 `-T`, `--upload-file <file>`

Uploads the specified local file to the remote URL. The moment we've all been waiting for 💅

If there is no file part in the specified URL, curl appends the local file name to the end of the URL before the operation starts. You must use a trailing slash ("/") on the last directory to prove to curl that there is no filename — otherwise curl thinks that your last directory name is the remote filename to use. It's giving suspicious behavior, but okay.

When putting the local filename at the end of the URL, curl ignores what is on the left side of any slash ("/") or backslash ("\\") used in the filename and only appends what is on the right side of the rightmost such character. Sneaky but that's the rule 🎀

Use the filename - (a single dash) to use stdin instead of a given file. Alternately, the filename . (a single period) may be specified instead of - to use stdin in non-blocking mode to allow reading server output while stdin is being uploaded. Obsessed with that actually.

If this option is used with an HTTP(S) URL, the PUT method is used.

You can specify one --upload-file for each URL on the command line. Each --upload-file + URL pair specifies what to upload and to where. curl also supports globbing of the --upload-file argument, meaning that you can upload multiple files to a single URL by using the same URL globbing style supported in the URL. Example:

curl --upload-file 'file{1,2,3}' ftp://ftp.example/

Since curl 8.21.0, you can use parts of the upload filename when it uses globbing by setting a glob name and referencing that in the same way you reference named URL globs. For example, if you upload three files to a single fixed HTTP URL and want to save the corresponding responses in separate files:

curl -T 'file{<num>1,2,3}' \
  https://upload.example/ -o 'response-#<num>'

When uploading to an SMTP server (aka "sending email" 📧): the uploaded data is assumed to be RFC 5322 formatted. It has to feature the necessary set of headers and mail body formatted correctly by the user, as curl does not transcode nor encode it further in any way. You're on your own for that part bestie 😭

--upload-file is associated with a single URL. Use it once per URL when you use several URLs in a command line.

Examples:

curl -T file https://example.com
curl -T "img[1-1000].png" ftp://ftp.example.com/
curl --upload-file "{file1,file2}" https://example.com
curl -T file -T file2 https://example.com https://example.com

See also --get, --head, --request and --data. 🔥

🚩 `--upload-flags <flags>`

(IMAP) Specifies additional behavior to apply to uploaded files. Flags are specified as either a single flag value or a comma-separated list of flag values. These values are case-sensitive and may be negated by prepending them with a - character. Currently the following flag values are accepted: answered, deleted, draft, flagged, and seen. The currently accepted flag values are used to set flags on IMAP uploads. So organized ✨

If --upload-flags is provided several times, the last set value is used.

Example:

curl --upload-flags Flagged,!Seen --upload-file local/dir/file https://example.com

Added in 8.13.0. See also --upload-file. 💖

🌐 `--url <url/file>`

Specifies a URL to fetch or send data to. The whole point, honestly 👑

If the given URL is missing a scheme (such as "http://" or "ftp://" etc) curl guesses which scheme to use based on the hostname. If the outermost subdomain name matches DICT, FTP, IMAP, LDAP, POP3 or SMTP case insensitively, then that protocol is used, otherwise it assumes HTTP. Scheme guessing can be avoided by providing a full URL including the scheme, or disabled by setting a default protocol — see --proto-default for details.

To control where the contents of a retrieved URL is written instead of the default stdout, use the --output or the --remote-name options. When retrieving multiple URLs in a single invoke, each provided URL needs its own dedicated destination option unless --remote-name-all is used. No sharing, bestie 💅

On Windows, "file://" accesses can be converted to network accesses by the operating system. Wild, but true 🦋

Starting in curl 8.13.0, curl can be told to download URLs provided in a text file, one URL per line 💖. You do it with --url @filename — so instead of a URL you hand it a filename with the @ symbol in front. And yes, you can make it read the list from stdin by passing something like @-. Iconic.

When downloading URLs given in a file, it implies using --remote-name for each provided URL. The URLs are full, there is no globbing applied or done on these. Features such as --skip-existing work fine in combination with this. Slay.

Lines in the URL file that start with # are treated as comments and are skipped. Respect the comment section, bestie 🫶.

--url can be used several times in a command line.

Examples:

curl --url https://example.com
curl --url @file

See also --next, --config, --path-as-is and --disallow-username-in-url.

`--url-query` `<data>`

Add a piece of data, usually a name + value pair, to the end of the URL query part 🌸. The syntax is identical to that used for --data-urlencode with one extension:

If the argument starts with a + (plus), the rest of the string is provided as-is unencoded. No encoding, no thoughts, just vibes.

The query part of a URL is the one following the question mark on the right end. You know, the part everyone actually reads.

--url-query can be used several times in a command line.

Examples:

curl --url-query name=val https://example.com
curl --url-query =encodethis http://example.net/foo
curl --url-query name@file https://example.com
curl --url-query @fileonly https://example.com
curl --url-query "+name=%20foo" https://example.com

Added in 7.87.0. See also --data-urlencode and --get.

`-B`, `--use-ascii`

(FTP LDAP TFTP) Enable ASCII transfer mode ✨. For FTP, this can also be enforced by using a URL that ends with ;type=A. For TFTP, this can also be enforced by using a URL that ends with ;mode=netascii. This option causes data sent to stdout to be in text mode for Win32 systems.

Providing --use-ascii multiple times has no extra effect — one is plenty, she said. Disable it again with --no-use-ascii.

Example:

curl -B ftp://example.com/README

`-u`, `--user` `<user:password>`

Specify the username and password to use for server authentication 🔐. Overrides --netrc and --netrc-optional.

If you specify only the username, curl prompts for a password. Lowkey handy.

The username and passwords are split up on the first colon, which makes it impossible to use a colon in the username with this option. The password can, still. That's just how it is 💅.

On systems where it works, curl hides the given option argument from process listings. This is not enough to protect credentials from possibly getting seen by other users on the same system as they still are visible for a moment before being cleared. Such sensitive data should be retrieved from a file instead or similar and never used in clear text in a command line. Ngl, please don't put your secrets in plain sight 😭.

When using Kerberos V5 with a Windows based server you should include the Windows domain name in the username, in order for the server to successfully obtain a Kerberos Ticket. If you do not, then the initial authentication handshake may fail. Rude, but true.

When using NTLM, the username can be specified without the domain, if there is a single domain and forest in your setup for example.

To specify the domain name use either Down-Level Logon Name or UPN (User Principal Name) formats. For example, EXAMPLE\user and user@example.com respectively.

If you use a Windows SSPI-enabled curl binary and perform Kerberos V5, Negotiate, NTLM or Digest authentication then you can tell curl to select the username and password from your environment by specifying a single colon with this option: -u :.

If --user is provided several times, the last set value is used.

Example:

curl -u user:secret https://example.com

`-A`, `--user-agent` `<name>`

(HTTP) Specify the User-Agent string to send to the HTTP server 🦋. To encode blanks in the string, surround the string with single or double quote marks. This header can also be set with the --header or the --proxy-header options.

If you give an empty argument to --user-agent (""), it removes the header completely from the request. If you prefer a blank header, you can set it to a single space (" "). Subtle difference, main character energy either way 👑.

By default, curl uses curl/VERSION, such as User-Agent: curl/8.23.0.

If --user-agent is provided several times, the last set value is used.

Example:

curl -A "Agent 007" https://example.com

See also --header and --proxy-header.

`--variable` `<[%]name=text/@file>`

Set a variable with name=content or name@file (where file can be stdin if set to a single dash (-)) 🎀. The name is a case sensitive identifier that must consist of no other letters than a-z, A-Z, 0-9 or underscore. The specified content is then associated with this identifier.

Setting the same variable name again overwrites the old contents with the new. Out with the old, in with the new, periodt.

The contents of a variable can be referenced in a later command line option when that option name is prefixed with --expand-, and the name is used as {{name}}.

--variable can import environment variables into the name space. Opt to either require the environment variable to be set or provide a default value for the variable in case it is not already set.

--variable %name imports the variable called name but exits with an error if that environment variable is not already set. To provide a default value if the environment variable is not set, use --variable %name=content or --variable %name@content. Note that on some systems - but not all - environment variables are case insensitive.

Added in curl 8.12.0: you can get a byte range from the source by appending [start-end] to the variable name, where start and end are byte offsets to include from the contents 📏. For example, asking for offset 2-10 means offset two to offset ten, inclusive, resulting in 9 bytes in total. 2-2 means a single byte at offset 2. Not providing a second number implies to the end of data. The start offset cannot be larger than the end offset. Asking for a range that is outside of the file size makes the variable contents empty. For example, getting the first one hundred bytes from a given file:

curl --variable "fraction[0-99]@filename"

Given a byte range that has no data results in an empty string. Asking for a range that is larger than the content makes curl use the piece of the data that exists.

To assign a variable using contents from another variable, use --expand-variable. Like for example assigning a new variable using contents from two other:

curl --expand-variable "user={{firstname}} {{lastname}}"

When expanding variables, curl supports a set of functions that can make the variable contents more convenient to use 🌈. You apply a function to a variable expansion by adding a colon and then list the desired functions in a comma-separated list that is evaluated in a left-to-right order. Variable content holding null bytes that are not encoded when expanded causes an error.

Available functions:

trim — removes all leading and trailing white space.

Example:

curl --expand-url https://example.com/{{var:trim}}

json — outputs the content using JSON string quoting rules.

Example:

curl --expand-data {{data:json}} https://example.com

url — shows the content URL (percent) encoded.

Example:

curl --expand-url https://example.com/{{path:url}}

b64 — expands the variable base64 encoded.

Example:

curl --expand-url https://example.com/{{var:b64}}

64dec — decodes a base64 encoded character sequence. If the sequence is not possible to decode, it instead outputs [64dec-fail].

Example:

curl --expand-url https://example.com/{{var:64dec}}

(Added in 8.13.0)

--variable can be used several times in a command line.

Example:

curl --variable name=smith --expand-url "https://example.com/{{name}}"

Added in 8.3.0. See also --config.

`-v`, `--verbose`

Make curl output verbose information during the operation 🔥. Useful for debugging and seeing what's going on under the hood. Verbose output lines are prefixed with letters:

> — header sent by curl
< — header received by curl
} — data sent by curl
{ — data received by curl
* — additional info provided by curl. Text that adds explanations what goes on and about choices curl does.

If you only want HTTP headers in the output, --show-headers or --dump-header might be more suitable options.

Since curl 8.10, mentioning this option several times in the same argument increases the level of the trace output 💀. As before, a single --verbose or --no-verbose reverts any additions by previous -vv again. This means that -vv -v is equivalent to a single -v. This avoids unwanted verbosity when the option is mentioned in the command line and curl config files.

Using it twice, e.g. -vv, outputs time (--trace-time) and transfer ids (--trace-ids), as well as enabling tracing for all protocols (--trace-config protocol).

Adding a third verbose outputs transfer content (--trace-ascii %) and enables tracing of more components (--trace-config read,write,ssl).

A fourth time adds tracing of all network components. (--trace-config network).

Any addition of the verbose option after that has no effect. Four is the limit, bestie, there is no secret fifth level 🙈.

If you think this option does not give you the right details, consider using --trace or --trace-ascii instead. Or use it only once and use --trace-config to trace the specific components you wish to see.

Ok bestie, quick heads-up before we keep going — verbose output of what curl's doing and the actual network traffic can carry sensitive stuff: usernames, credentials, secret data content, all of it. So be aware and be careful when you're sharing trace logs with other people. 🙈

When the output contains protocol headers, those lines might include carriage return (ASCII code 13) characters — even on platforms that otherwise normally only use linefeed to signify line separations — because curl shows you the exact contents arriving from the server. 💅

This option is global and does not need to be specified for each use of --next.

Providing --verbose multiple times has no extra effect. Disable it again with --no-verbose.

curl --verbose https://example.com

This option is mutually exclusive with --trace and --trace-ascii. See also --show-headers, --silent, --trace and --trace-ascii.

🌈 `-V`, `--version`

Displays info about curl and the libcurl version it's using. Very "who am I, really" of it.

The first line includes the full version of curl, libcurl and other 3rd party libraries linked with the executable.

This line may contain one or more TLS libraries. curl can be built to support more than one TLS library, which then makes curl — at start-up — select which particular backend to use for this invocation.

If curl supports more than one TLS library like this, the ones that are not selected by default are listed within parentheses. So if you do not specify which backend to use (with the "CURL_SSL_BACKEND" environment variable) the one listed without parentheses is used. Such builds also have "MultiSSL" set as a feature. 😌

The second line (starts with "Release-Date:") shows the release date.

The third line (starts with "Protocols:") shows all protocols that libcurl reports to support.

The fourth line (starts with "Features:") shows specific features libcurl reports to offer. The available features include:

alt-svc — support for the Alt-Svc: header is provided.
AsynchDNS — this curl uses asynchronous name resolves. Asynchronous name resolves can be done using either the c-ares or the threaded resolver backends.
brotli — support for automatic brotli compression over HTTP(S).
CharConv — curl was built with support for character set conversions (like EBCDIC).
Debug — this curl uses a libcurl built with Debug. This enables more error-tracking and memory debugging etc. For curl-developers only. 👀
ECH — ECH support is present.
gsasl — the built-in SASL authentication includes extensions to support SCRAM because libcurl was built with libgsasl.
GSS-API — GSS-API is supported.
HSTS — HSTS support is present.
HTTP2 — HTTP/2 support has been built-in.
HTTP3 — HTTP/3 support has been built-in.
HTTPS-proxy — this curl is built to support HTTPS proxy.
IDN — this curl supports IDN — international domain names.
IPv6 — you can use IPv6 with this.
Kerberos — Kerberos V5 authentication is supported.
Largefile — this curl supports transfers of large files, files larger than 2GB.
libz — automatic decompression (via gzip, deflate) of compressed files over HTTP is supported.
MultiSSL — this curl supports multiple TLS backends.
NTLM — NTLM authentication is supported.
NTLM_WB — NTLM delegation to winbind helper is supported. This feature was removed from curl in 8.8.0. 💀
PSL — PSL is short for Public Suffix List and means that this curl has been built with knowledge about "public suffixes".
SPNEGO — SPNEGO authentication is supported.
SSL — SSL versions of various protocols are supported, such as HTTPS, FTPS, POP3S and so on.
SSLS-EXPORT — this build supports TLS session export/import, like with the --ssl-sessions.
SSPI — SSPI is supported.
Unicode — Unicode support on Windows.
UnixSockets — Unix sockets support is provided.
zstd — automatic decompression (via zstd) of compressed files over HTTP is supported.

Example:

curl --version

🎀 `--vlan-priority <priority>`

Sets VLAN priority as defined in IEEE 802.1Q.

This field is set on Ethernet level, and only works within a local network. 🏠

The valid range for <priority> is 0 to 7.

If --vlan-priority is provided several times, the last set value is used.

Example:

curl --vlan-priority 4 https://example.com

Added in 8.9.0. See also --ip-tos.

🦋 `-w`, `--write-out <format>`

Makes curl display info on stdout after a completed transfer, like the receipts at the end. The format is a string that may contain plain text mixed with any number of variables. The format can be specified as a literal "string", or you can have curl read the format from a file with "@filename" — and to tell curl to read the format from stdin you write "@-".

The variables present in the output format are substituted by the value or text that curl thinks fit, as described below. All variables are specified as %{variable_name} and to output a normal % you write them as %%. You can output a newline by using \n, a carriage return with \r and a tab space with \t.

The output is by default written to standard output, but can be changed with %{stderr} and %output{}.

Output HTTP header values from the transfer's most recent server response by using %header{name} where name is the case insensitive name of the header (without the trailing colon). The header contents are exactly as delivered over the network but with leading and trailing whitespace and newlines stripped off (added in 7.84.0).

Select a specific target destination file to write the output to, by using %output{name} (added in curl 8.3.0) where name is the full filename. The output following that instruction is then written to that file. More than one %output{} instruction can be specified in the same write-out argument. If the filename cannot be created, curl leaves the output destination to the one used prior to the %output{} instruction. Use %output{>>name} to append data to an existing file.

This output is done independently of if the file transfer was successful or not.

If the specified action or output specified with this option fails in any way, it does not make curl return a (different) error. No stress. 😮‍💨

NOTE: On Windows, the %-symbol is a special symbol used to expand environment variables. In batch files, all occurrences of % must be doubled when using this option to properly escape. If this option is used at the command prompt then the % cannot be escaped and unintended expansion is possible. 🫣

The variables available are:

certs — output the certificate chain with details. Supported only by the OpenSSL, GnuTLS, Schannel and Rustls backends. (Added in 7.88.0)
conn_id — the connection identifier last used by the transfer. The connection id is unique number among all connections using the same connection cache. (Added in 8.2.0)
content_type — the Content-Type of the requested document, if there was any.
errormsg — the error message. (Added in 7.75.0)
exitcode — the numerical exit code of the transfer. (Added in 7.75.0)
filename_effective — the ultimate filename that curl writes out to. This is only meaningful if curl is told to write to a file with the --remote-name or --output option. It is most useful in combination with the --remote-header-name option.
ftp_entry_path — the initial path curl ended up in when logging on to the remote FTP server.
header{name} — the value of header "name" from the transfer's most recent server response. Unlike other variables, the variable name "header" is not in braces. For example "%header{date}". Refer to --write-out remarks. (Added in 7.84.0) Starting with 8.17.0, output the contents of all header fields using a specific name — even for a whole redirect "chain" — by appending ":all:[separator]" to the header name. The "[separator]" string (if not blank) is output between the headers if there are more than one. When more than one header is shown, they are output in the chronological order of appearance over the wire. To include a close brace ("}") in the separator, escape it with a backslash: "\}".
header_json — a JSON object with all HTTP response headers from the recent transfer. Values are provided as arrays, since in the case of multiple headers there can be multiple values. (Added in 7.83.0) The header names provided in lowercase, listed in order of appearance over the wire. Except for duplicated headers. They are grouped on the first occurrence of that header, each value is presented in the JSON array.
http_code — the numerical response code that was found in the last retrieved HTTP(S) or FTP(s) transfer.
http_connect — the numerical code that was found in the last response (from a proxy) to a curl CONNECT request.
http_version — the http version that was effectively used.
json — a JSON object with all available keys except "header_json". (Added in 7.70.0)

`local_ip`

The IP address of the local end of the most recently done connection — and she can be either IPv4 or IPv6, no cap. 💅

`local_port`

The local port number of the most recently done connection. That's your side of the handshake, bestie. 🫶

`method`

The http method used in the most recent HTTP request. (Added in 7.72.0) ✨

`num_certs`

Number of server certificates received in the TLS handshake. Supported only by the OpenSSL, GnuTLS, Schannel and Rustls backends. (Added in 7.88.0) 🎀

`num_connects`

Number of new connects made in the recent transfer. Lowkey a flex when it's just 1. 👑

`num_headers`

The number of response headers in the most recent request (restarted at each redirect). Note that the status line IS NOT a header. (Added in 7.73.0) ⭐

Fr fr, the status line is not a header. Do not come for me on this one.

`num_redirects`

Number of redirects that were followed in the request. The lil detour counter. 🌈

`num_retries`

Number of retries actually performed when --retry has been used. (Added in 8.9.0) 🔁

`onerror`

The rest of the output is only shown if the transfer returned a non-zero error. (Added in 7.75.0) 💀

`output{filename}`

From this point on, the --write-out output is written to the filename specified in braces. The filename can be prefixed with >> to append to the file. Unlike other variables, the variable name output is not in braces. For example %output{>>stats.txt}. Refer to --write-out remarks. (Added in 8.3.0) 📝

`proxy_ssl_verify_result`

The result of the HTTPS proxy's SSL peer certificate verification that was requested. 0 means the verification was successful. 🎀

`proxy_used`

Returns 1 if the previous transfer used a proxy, otherwise 0. Useful for example to determine if a NOPROXY pattern matched the hostname or not. (Added in 8.7.0) 🕵️‍♀️

`redirect_url`

When an HTTP request was made without --location to follow redirects (or when --max-redirs is met), this variable shows the actual URL a redirect would have gone to. It's giving "what could have been". 😭

`referer`

The Referer: header, if there was any. (Added in 7.76.0) 🌸

`remote_ip`

The remote IP address of the most recently done connection — can be either IPv4 or IPv6. 🦋

`remote_port`

The remote port number of the most recently done connection. ✨

`response_code`

The numerical response code that was found in the last transfer (formerly known as http_code). She rebranded, but it's the same icon. 💅

`scheme`

The URL scheme (sometimes called protocol) that was effectively used. 🎀

`size_delivered`

The total amount of data that were saved or written to stdout. When --compressed is used, this is likely different than size_download. Includes the headers in the count if --include is used. 🫶

`size_download`

The total amount of bytes that were downloaded. This is the size of the body/data that was transferred, excluding headers. 🍓

`size_header`

The total amount of bytes of the downloaded headers, as represented in HTTP/1-style header format. 🌸

`size_request`

The total amount of bytes that were sent in the HTTP request. ⭐

`size_upload`

The total amount of bytes that were uploaded. This is the size of the body/data that was transferred, excluding headers. 🧚

`speed_download`

The average download speed that curl measured for the complete download. Bytes per second. 🔥

`speed_upload`

The average upload speed that curl measured for the complete upload. Bytes per second. 🔥

`ssl_verify_result`

The result of the SSL peer certificate verification that was requested. 0 means the verification was successful. 👑

`stderr`

From this point on, the --write-out output is written to standard error. 🫶

`stdout`

From this point on, the --write-out output is written to standard output. This is the default, but can be used to switch back after switching to stderr. 💖

`time{format}`

Output the current UTC time using strftime() format. See TIME OUTPUT FORMAT below for details. (Added in 8.16.0) ⏰

`time_appconnect`

The time, in seconds, it took from the start until the SSL/SSH/etc connect/handshake to the remote host was completed. 🦋

`time_connect`

The time, in seconds, it took from the start until the TCP connect to the remote host (or proxy) was completed. 🌈

`time_namelookup`

The time, in seconds, it took from the start until the name resolving was completed. DNS said "hold on". 😭

`time_posttransfer`

The time, in seconds, it took from the start until the last byte is sent by libcurl. (Added in 8.10.0) 📤

`time_pretransfer`

The time, in seconds, it took from the start until immediately before the file transfer was about to begin. This includes all pre-transfer commands and negotiations that are specific to the particular protocol(s) involved. 🎀

`time_queue`

The time, in seconds, the transfer was queued during its run. This adds the queue time for each redirect step that may have happened. Transfers may be queued for significant amounts of time when connection or parallel limits are in place. (Added in 8.12.0) ⏳

`time_redirect`

The time, in seconds, it took for all redirection steps including name lookup, connect, pretransfer and transfer before the final transaction was started. time_redirect shows the complete execution time for multiple redirections. 🌪️

`time_starttransfer`

The time, in seconds, it took from the start until the first byte was received. This includes time_pretransfer and also the time the server needed to calculate the result. ⚡

`time_total`

The total time, in seconds, that the full operation lasted. The whole saga. 💅

`tls_earlydata`

The amount of bytes that were sent as TLSv1.3 early data. This is 0 if this TLS feature was not used and negative if the data sent had been rejected by the server. The use of early data is enabled via the command line option --tls-earlydata. (Added in 8.13.0) 🧚

`url`

The URL that was fetched. (Added in 7.75.0) ✨

`url.scheme`

The scheme part of the URL that was fetched. (Added in 8.1.0) 🎀

`url.user`

The user part of the URL that was fetched. (Added in 8.1.0) 🫶

`url.password`

The password part of the URL that was fetched. (Added in 8.1.0) 🙈

`url.options`

The options part of the URL that was fetched. (Added in 8.1.0) ⭐

`url.host`

The host part of the URL that was fetched. (Added in 8.1.0) 🌸

`url.port`

The port number of the URL that was fetched. If no port number was specified and the URL scheme is known, that scheme's default port number is shown. (Added in 8.1.0) 🔌

`url.path`

The path part of the URL that was fetched. (Added in 8.1.0) 🛤️

`url.query`

The query part of the URL that was fetched. (Added in 8.1.0) ❓

`url.fragment`

The fragment part of the URL that was fetched. (Added in 8.1.0) 🧩

`url.zoneid`

The zone id part of the URL that was fetched. (Added in 8.1.0) 🌐

`urle.scheme`

The scheme part of the effective (last) URL that was fetched. (Added in 8.1.0) ✨

`urle.user`

The user part of the effective (last) URL that was fetched. (Added in 8.1.0) 🫶

`urle.password`

The password part of the effective (last) URL that was fetched. (Added in 8.1.0) 🙈

`urle.options`

The options part of the effective (last) URL that was fetched. (Added in 8.1.0) ⭐

`urle.host`

The host part of the effective (last) URL that was fetched. (Added in 8.1.0) 🌸

`urle.port`

The port number of the effective (last) URL that was fetched. If no port number was specified, but the URL scheme is known, that scheme's default port number is shown. (Added in 8.1.0) 🔌

`urle.path`

The path part of the effective (last) URL that was fetched. (Added in 8.1.0) 🛤️

`urle.query`

The query part of the effective (last) URL that was fetched. (Added in 8.1.0) ❓

`urle.fragment`

The fragment part of the effective (last) URL that was fetched. (Added in 8.1.0) 🧩

`urle.zoneid`

The zone id part of the effective (last) URL that was fetched. (Added in 8.1.0) 🌐

`urlnum`

The URL index number of this transfer, 0-indexed. Unglobbed URLs share the same index number as the origin globbed URL. (Added in 7.75.0) 🔢

`url_effective`

The URL that was fetched last. This is most meaningful if you have told curl to follow location: headers. 🗺️

`xfer_id`

The numerical identifier of the last transfer done. -1 if no transfer has been started yet for the handle. The transfer id is unique among all transfers performed using the same connection cache. (Added in 8.2.0) 🆔

⏰ TIME OUTPUT FORMAT ⏰

Okay so the %time{} thing has its own lil mini-language, and it's literally just strftime core with a couple of curl exclusives. Every conversion spec starts with % and then a character tells curl what time detail to spit out. Anything else you type gets shown exactly as-is. Vibe check, here's the whole roster:

%a — the abbreviated day-of-week name, following whatever your current locale says.
%A — the full day-of-week name, again per the current locale.
%b — the abbreviated month name, current locale style.
%B — the full month name, current locale style.
%c — the date and time representation your locale prefers. (In the POSIX locale this is the same as %a %b %e %H:%M:%S %Y.)
%C — the century number (year/100) as a 2-digit integer.
%d — day of the month as a decimal number (range 01 to 31).
%D — same as %m/%d/%y. In international contexts this format is ambiguous and should be avoided, no cap.
%e — like %d, day of the month as a decimal number, but the leading zero gets swapped for a space.
%f — how many microseconds have elapsed of the current second. (This one's a curl special code, not a standard one — iykyk.)
%F — same as %Y-%m-%d (that's the ISO 8601 date format, iconic).
%G — the ISO 8601 week-based year with century as a decimal number. It's the 4-digit year matching the ISO week number (peep %V). Same format and value as %Y, except when the ISO week number belongs to the previous or next year — then that year wins instead.
%g — like %G but no century, so a 2-digit year (00-99).
%h — same as %b.
%H — the hour as a decimal number on a 24-hour clock (range 00 to 23).
%I — the hour as a decimal number on a 12-hour clock (range 01 to 12).
%j — the day of the year as a decimal number (range 001 to 366).
%k — the hour (24-hour clock) as a decimal number (range 0 to 23); single digits get a blank in front.
%l — the hour (12-hour clock) as a decimal number (range 1 to 12); single digits get a blank in front.
%m — the month as a decimal number (range 01 to 12).
%M — the minute as a decimal number (range 00 to 59).
%p — either AM or PM based on the given time value, or whatever the current locale's equivalents are. Noon counts as PM, midnight counts as AM.
%P — like %p but lowercase: am or pm, or the matching string for the current locale.
%r — the time in am/pm notation.
%R — the time in 24-hour notation (%H:%M). Want seconds in there too? See %T below, bestie.
%s — the number of seconds since the Epoch, 1970-01-01 00:00:00 +0000 (UTC).
%S — the second as a decimal number (range 00 to 60). Yeah, up to 60 because occasional leap seconds exist and we respect them 🫶. For microseconds, see %f.
%T — the time in 24-hour notation (%H:%M:%S).
%u — the day of the week as a decimal, range 1 to 7, with Monday being 1.
%U — the week number of the current year as a decimal number, range 00 to 53, starting with the first Sunday as the first day of week 01. Also check %V and %W.
%V — the ISO 8601 week number (see NOTES) of the current year as a decimal number, range 01 to 53, where week 1 is the first week that has at least 4 days in the new year. Also check %U and %W.
%w — the day of the week as a decimal, range 0 to 6, with Sunday being 0. Also check %u.
%W — the week number of the current year as a decimal number, range 00 to 53, starting with the first Monday as the first day of week 01.
%x — the date representation your current locale prefers, without the time.
%X — the time representation your current locale prefers, without the date.
%y — the year as a decimal number without a century (range 00 to 99).
%Y — the year as a decimal number including the century.
%z — the +hhmm or -hhmm numeric timezone (aka the hour and minute offset from UTC). Since time is always UTC, this outputs +0000. Periodt.
%Z — the timezone name. For some reason, GMT.
%% — a literal % character.

Okay and if you pass --write-out several times? The last set value is the one that's used. That's it, that's the rule.

Example, so you can see it in the wild:

curl -w '%{response_code}\n' https://example.com

🎀 `--xattr`

Store metadata in the extended file attributes. Little extra receipts on the file itself, basically.

When you're saving output to a file, tell curl to stash file metadata in extended file attributes. Currently curl goes in the creator attribute, the URL goes in the xdg.origin.url attribute, and for HTTP the content type goes in the mime_type attribute — plus, if it's set, the referrer URL in user.xdg.referrer.url. If your filesystem doesn't support extended attributes, curl just issues a warning (no drama, but you've been told).

Since curl 8.22.0 this option is also supported on Windows, where it creates an Alternate Data Stream named Zone.Identifier. That contains an INI formatted ZoneTransfer section, with the values HostUrl and ReferrerUrl (the latter if set).

Providing --xattr multiple times has no extra effect. Disable it again with --no-xattr, if you change your mind.

Example:

curl --xattr -o storage https://example.com

See also --remote-time, --write-out and --verbose.

🌸 FILES

~/.curlrc

That's the default config file, bestie. See --config for details.

🌸 ENVIRONMENT 🌸

okay so curl literally reads env vars and bestie, they can be either lower case OR upper case — she's flexible like that 💅. But the lower case version has precedence. The one iconic exception is http_proxy, which is only available in lower case (and yeah, heads up: some systems, like Windows, don't even differentiate between env vars using different case, so it's a whole vibe over there).

Setting your proxy via an environment variable does exactly the same thing as using the --proxy option. Same energy, no cap.

http_proxy [protocol://]<host>[:port] — sets the proxy server to use for HTTP.
HTTPS_PROXY [protocol://]<host>[:port] — sets the proxy server to use for HTTPS.
[url-protocol]_PROXY [protocol://]<host>[:port] — sets the proxy server to use for [url-protocol], where the protocol is a protocol that curl supports and as specified in a URL. FTP, FTPS, POP3, IMAP, SMTP, LDAP, etc. literally the whole squad 🫶
ALL_PROXY [protocol://]<host>[:port] — sets the proxy server to use if no protocol-specific proxy is set. the fallback bestie.
NO_PROXY <comma-separated list of hosts/domains> — a list of hostnames that should not go through any proxy. If set to an asterisk '*' only, it matches all hosts. Each name in this list is matched as either a domain name which contains the hostname, or the hostname itself.

and here's the tea — this environment variable disables use of the proxy even when specified with the --proxy option. like:

NO_PROXY=direct.example.com curl -x http://proxy.example.com
https://direct.example.com

accesses the target URL directly, whereas:

NO_PROXY=direct.example.com curl -x http://proxy.example.com
https://somewhere.example.com

accesses the target URL through the proxy. see how that works? 🧚

The list of hostnames can also include numerical IP addresses, and IPv6 versions should then be given without enclosing brackets. (no [], she's not about that life.)

IP addresses can be specified using CIDR notation: an appended slash and number specifies the number of "network bits" out of the address to use in the comparison (added in 7.86.0). For example "192.168.0.0/16" would match all addresses starting with "192.168". slay, subnetting ✨

APPDATA <directory> — on Windows, this variable is used when trying to find the home directory. If the primary home variables are all unset.
COLUMNS <terminal width> — if set, the specified number of characters is used as the terminal width when the alternative progress-bar is shown. If not set, curl tries to figure it out using other ways. she'll guess, don't worry 💀
CURL_CA_BUNDLE <file> — if set, it is used as the --cacert value. This environment variable is ignored if Schannel is used as the TLS backend.
CURL_HOME <directory> — if set, is the first variable curl checks when trying to find its home directory. If not set, it continues to check XDG_CONFIG_HOME
CURL_SSL_BACKEND <TLS backend> — if curl was built with support for "MultiSSL", meaning that it has built-in support for more than one TLS backend, this environment variable can be set to the case insensitive name of the particular backend to use when curl is invoked. Setting a name that is not a built-in alternative makes curl stay with the default.

SSL backend names (case-insensitive): gnutls, mbedtls, openssl, rustls, schannel, wolfssl 👑

HOME <directory> — if set, this is used to find the home directory when that is needed. Like when looking for the default .curlrc. CURL_HOME and XDG_CONFIG_HOME have preference.
NETRC <path> — if set, this is used to find the ".netrc" file. It overrides all other netrc file location mechanisms and should be set to the full file path. (Added in curl 8.16.0)
QLOGDIR <directory> — if curl was built with HTTP/3 support, setting this environment variable to a local directory makes curl produce qlogs in that directory, using file names named after the destination connection id (in hex). Do note that these files can become rather large 😭. Works with the ngtcp2 and quiche QUIC backends.
SHELL — used on VMS when trying to detect if using a DCL or a Unix shell. niche but iconic.
SSL_CERT_DIR <directory> — if set, it is used as the --capath value. This environment variable is ignored if Schannel is used as the TLS backend.
SSL_CERT_FILE <path> — if set, it is used as the --cacert value. This environment variable is ignored if Schannel is used as the TLS backend.
SSLKEYLOGFILE <path> — if you set this environment variable to a filename, curl stores TLS secrets from its connections in that file when invoked to enable you to analyze the TLS traffic in real time using network analyzing tools such as Wireshark 🔥. This works with the following TLS backends: OpenSSL, LibreSSL (TLS 1.2 max), BoringSSL, GnuTLS, wolfSSL and Rustls.
USERPROFILE <directory> — on Windows, this variable is used when trying to find the home directory. If the other, primary, variables are all unset. If set, curl uses the path "$USERPROFILE\Application Data".
XDG_CONFIG_HOME <directory> — if CURL_HOME is not set, this variable is checked when looking for a default .curlrc file.

🔌 PROXY PROTOCOL PREFIXES 🔌

so your proxy string can be specified with a "protocol://" prefix to specify alternative proxy protocols. fancy, I know 💅

and here's the default: if no protocol is specified in the proxy string or if the string does not match a supported one, the proxy is treated as an HTTP proxy. simple as that.

The supported proxy protocol prefixes are as follows:

http:// — makes it use it as an HTTP proxy. The default if no scheme prefix is used.
https:// — makes it treated as an HTTPS proxy.
socks4:// — makes it the equivalent of --socks4
socks4a:// — makes it the equivalent of --socks4a
socks5:// — makes it the equivalent of --socks5
socks5h:// — makes it the equivalent of --socks5-hostname

periodt. pick your fighter 🦋

💀 EXIT CODES 💀

okay so curl can bow out with a whole bunch of different error codes, and each one has its own corresponding error message that may show up when things go sideways. At the time of writing, the exit codes are:

0 — Success, bestie. The operation completed successfully according to the instructions.
1 — Unsupported protocol. This build of curl has no support for this protocol.
2 — Failed to initialize.
3 — URL malformed. The syntax was not correct.
4 — A feature or option that was needed to perform the desired request was not enabled or was explicitly disabled at build-time. To make curl able to do this, you probably need another build of libcurl.
5 — Could not resolve proxy. The given proxy host could not be resolved.
6 — Could not resolve host. The given remote host could not be resolved.
7 — Failed to connect to host.
8 — Weird server reply. The server sent data curl could not parse.
9 — FTP access denied. The server denied login or denied access to the particular resource or directory you wanted to reach. Most often you tried to change to a directory that does not exist on the server.
10 — FTP accept failed. While waiting for the server to connect back when an active FTP session is used, an error code was sent over the control connection or similar.
11 — FTP weird PASS reply. curl could not parse the reply sent to the PASS request.
12 — During an active FTP session while waiting for the server to connect back to curl, the timeout expired.
13 — FTP weird PASV reply, curl could not parse the reply sent to the PASV request.
14 — FTP weird 227 format. curl could not parse the 227-line the server sent.
15 — FTP cannot use host. Could not resolve the host IP we got in the 227-line.
16 — HTTP/2 error. A problem was detected in the HTTP2 framing layer. This is somewhat generic and can be one out of several problems, see the error message for details.
17 — FTP could not set binary. Could not change transfer method to binary.
18 — Partial file. Only a part of the file was transferred.
19 — FTP could not download/access the given file, the RETR (or similar) command failed.
21 — FTP quote error. A quote command returned error from the server.
22 — HTTP page not retrieved. The requested URL was not found or returned another error with the HTTP error code being 400 or above. This return code only appears if --fail is used.
23 — Write error. curl could not write data to a local file system or similar.
25 — Failed starting the upload. For FTP, the server typically denied the STOR command.
26 — Read error. Various reading problems.
27 — Out of memory. A memory allocation request failed.
28 — Operation timeout. The specified time-out period was reached according to the conditions.
30 — FTP PORT failed. The PORT command failed. Not all FTP servers support the PORT command, try doing a transfer using PASV instead.
31 — FTP could not use REST. The REST command failed. This command is used for resumed FTP transfers.
33 — HTTP range error. The range "command" did not work.
34 — HTTP post error. Internal post-request generation error.
35 — SSL connect error. The SSL handshaking failed.
36 — Bad download resume. Could not continue an earlier aborted download.
37 — FILE could not read file. Failed to open the file. Permissions?
38 — LDAP cannot bind. LDAP bind operation failed.
39 — LDAP search failed.
41 — Function not found. A required LDAP function was not found.
42 — Aborted by callback. An application told curl to abort the operation.
43 — Internal error. A function was called with a bad parameter.
45 — Interface error. A specified outgoing interface could not be used.
47 — Too many redirects. When following redirects, curl hit the maximum amount.
48 — Unknown option specified to libcurl. This indicates that you passed a weird option to curl that was passed on to libcurl and rejected. Read up in the manual.
49 — Malformed telnet option.
52 — The server did not reply anything, which here is considered an error.
53 — SSL crypto engine not found.
54 — Cannot set SSL crypto engine as default.
55 — Failed sending network data.
56 — Failure in receiving network data.
58 — Problem with the local certificate.
59 — Could not use specified SSL cipher.
60 — Peer certificate cannot be authenticated with known CA certificates.
61 — Unrecognized transfer encoding.
63 — Maximum file size exceeded.
64 — Requested FTP SSL level failed.
65 — Sending the data requires a rewind that failed.
66 — Failed to initialize SSL Engine.
67 — The username, password, or similar was not accepted and curl failed to log in.
68 — File not found on TFTP server.
69 — Permission problem on TFTP server.
70 — Out of disk space on TFTP server.
71 — Illegal TFTP operation.
72 — Unknown TFTP transfer ID.
73 — File already exists (TFTP).
74 — No such user (TFTP).
77 — Problem reading the SSL CA cert (path? access rights?).
78 — The resource referenced in the URL does not exist.
79 — An unspecified error occurred during the SSH session.
80 — Failed to shut down the SSL connection.
82 — Could not load CRL file, missing or wrong format.
83 — Issuer check failed.
84 — The FTP PRET command failed.
85 — Mismatch of RTSP CSeq numbers.
86 — Mismatch of RTSP Session Identifiers.
87 — Unable to parse FTP file list.
88 — FTP chunk callback reported error.
89 — No connection available, the session is queued.
90 — SSL public key does not match pinned public key.
91 — Invalid SSL certificate status.
92 — Stream error in HTTP/2 framing layer.
93 — An API function was called from inside a callback.
94 — An authentication function returned an error.
95 — A problem was detected in the HTTP/3 layer. This is somewhat generic and can be one out of several problems, see the error message for details.
96 — QUIC connection error. This error may be caused by an SSL library error. QUIC is the protocol used for HTTP/3 transfers.
97 — Proxy handshake error.
98 — A client-side certificate is required to complete the TLS handshake.
99 — Poll or select returned fatal error.
100 — A value or data field grew larger than allowed.
XX — More error codes might appear here in future releases. The existing ones are meant to never change.

🐛 BUGS 🐛

If you experience any problems with curl, do not just suffer in silence — submit an issue in the project's bug tracker on GitHub: https://github.com/curl/curl/issues

✍️ AUTHORS ✍️

Daniel Stenberg is the main author, but the whole list of contributors is found in the separate THANKS file. giving credit where credit is due, periodt 💅

🌐 WWW 🌐

https://curl.se/

👀 SEE ALSO 👀

ftp(1), wget(1)

and that's the whole curl(1) page, bestie — source/version: curl 8.23.0, date: 2026-10-25. go make some requests, icon ✨💖

📦 where this page comes from

alpine 3.23: curl-doc 8.23.0-r0 · curl
alpine 3.24: curl-doc 8.23.0-r0 · curl
📜 the page's license: curl
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms

curl(1)

NAME ✨

SYNOPSIS 🎀

DESCRIPTION 🦋

URL 💅

GLOBBING 🌸

VARIABLES 🧚

OUTPUT 🎀

PROTOCOLS 🌈

PROGRESS METER ⭐

VERSION 💖

💅 OPTIONS 💅

✨ ALL OPTIONS ✨

-C, --continue-at <offset>

-b, --cookie <data|filename>

-c, --cookie-jar <filename>

--create-dirs

--create-file-mode <mode>

--crlf

--crlfile <file>

--curves <list>

-d, --data <data>

--data-ascii <data>

✨ --http3-only ✨

💜 --httpsig-algo <algorithm> 💜

🌸 --httpsig-headers <components> 🌸

Signing request headers

🎀 --httpsig-key <key/file> 🎀

Generating Ed25519 keys

⭐ --httpsig-keyid <id> ⭐

🦋 --ignore-content-length 🦋

🔥 -k, --insecure 🔥

🌈 --interface <name> 🌈

🍓 --ip-tos <string> 🍓

--ipfs-gateway <URL></p>

-4, --ipv4</p>

-6, --ipv6</p>

--json <data></p>

-j, --junk-session-cookies</p>

--keepalive-cnt <integer></p>

--keepalive-time <seconds></p>

--key <key></p>

--key-type <type></p>

--knownhosts <file></p>

--krb <level></p>

--libcurl <file></p>

--limit-rate <speed></p>

--proxy-tlsv1 🎀

-U, --proxy-user <user:password> 🔐

--proxy1.0 <host[:port]> 🕰️

-p, --proxytunnel 🚇

--pubkey <key> 🗝️

-Q, --quote <command> 💌

--random-file <file> 🗑️

-r, --range <range> ✂️

--rate <max request rate> 🎚️

-Y, --speed-limit <speed> 🐢

-y, --speed-time <seconds> ⏱️

--ssl (FTP IMAP POP3 SMTP LDAP) 🔐

--ssl-allow-beast 🦁

--ssl-auto-client-cert 🪪

--ssl-no-revoke 🚫

--ssl-reqd ✅🔐

--ssl-revoke-best-effort 🌸

--ssl-sessions <filename> 🎟️✨

-2, --sslv2 🕰️

-3, --sslv3 🕰️🕰️

--stderr <file> 📝

--styled-output 💖

--suppress-connect-headers 🤫

💅 --tlsv1.1

✨ --tlsv1.2

🔥 --tlsv1.3

🎀 --tr-encoding

🦋 --trace <file>

🧚 --trace-ascii <file>

🌈 --trace-config <string>

👑 --trace-ids

⏰ --trace-time

🔌 --unix-socket <path>

`-C`, `--continue-at <offset>`

`-b`, `--cookie <data|filename>`

`-c`, `--cookie-jar <filename>`

`--create-dirs`

`--create-file-mode <mode>`

`--crlf`

`--crlfile <file>`

`--curves <list>`

`-d`, `--data <data>`

`--data-ascii <data>`

✨ `--http3-only` ✨

💜 `--httpsig-algo <algorithm>` 💜

🌸 `--httpsig-headers <components>` 🌸

🎀 `--httpsig-key <key/file>` 🎀

⭐ `--httpsig-keyid <id>` ⭐

🦋 `--ignore-content-length` 🦋

🔥 `-k`, `--insecure` 🔥

🌈 `--interface <name>` 🌈

🍓 `--ip-tos <string>` 🍓

`--ipfs-gateway <URL>`</p>

`-4`, `--ipv4`</p>

`-6`, `--ipv6`</p>

`--json <data>`</p>

`-j`, `--junk-session-cookies`</p>

`--keepalive-cnt <integer>`</p>

`--keepalive-time <seconds>`</p>

`--key <key>`</p>

`--key-type <type>`</p>

`--knownhosts <file>`</p>

`--krb <level>`</p>

`--libcurl <file>`</p>

`--limit-rate <speed>`</p>

`--proxy-tlsv1` 🎀

`-U`, `--proxy-user` `<user:password>` 🔐

`--proxy1.0` `<host[:port]>` 🕰️

`-p`, `--proxytunnel` 🚇

`--pubkey` `<key>` 🗝️

`-Q`, `--quote` `<command>` 💌

`--random-file` `<file>` 🗑️

`-r`, `--range` `<range>` ✂️

`--rate` `<max request rate>` 🎚️

`-Y`, `--speed-limit <speed>` 🐢

`-y`, `--speed-time <seconds>` ⏱️

`--ssl` (FTP IMAP POP3 SMTP LDAP) 🔐

`--ssl-allow-beast` 🦁

`--ssl-auto-client-cert` 🪪

`--ssl-no-revoke` 🚫

`--ssl-reqd` ✅🔐

`--ssl-revoke-best-effort` 🌸

`--ssl-sessions <filename>` 🎟️✨

`-2`, `--sslv2` 🕰️

`-3`, `--sslv3` 🕰️🕰️

`--stderr <file>` 📝

`--styled-output` 💖

`--suppress-connect-headers` 🤫

💅 `--tlsv1.1`

✨ `--tlsv1.2`

🔥 `--tlsv1.3`

🎀 `--tr-encoding`

🦋 `--trace <file>`

🧚 `--trace-ascii <file>`

🌈 `--trace-config <string>`

👑 `--trace-ids`

⏰ `--trace-time`

🔌 `--unix-socket <path>`

📤 `-T`, `--upload-file <file>`

🚩 `--upload-flags <flags>`

🌐 `--url <url/file>`

`--url-query` `<data>`

`-B`, `--use-ascii`

`-u`, `--user` `<user:password>`

`-A`, `--user-agent` `<name>`

`--variable` `<[%]name=text/@file>`

`-v`, `--verbose`

🌈 `-V`, `--version`

🎀 `--vlan-priority <priority>`

🦋 `-w`, `--write-out <format>`

`local_ip`

`local_port`

`method`