curl

curl is a command-line tool for transferring data with URLs, written by Daniel Stenberg in 1998 because he wanted to fetch currency exchange rates from a website and the existing tools were insufficient, which is how all important software begins — not with a grand vision but with a person who needs a small thing and builds it properly.

Twenty-eight years later, curl speaks HTTP, HTTPS, FTP, FTPS, SCP, SFTP, SMTP, IMAP, POP3, LDAP, MQTT, RTSP, GOPHER, and approximately fifteen other protocols that exist in the same way that the corkscrew exists on a Swiss Army knife — technically present, theoretically useful, touched by nobody you have ever met.

Every developer uses curl. Every developer uses curl the same way: curl -X POST -H "Content-Type: application/json" -d '{"key":"value"}' followed by a URL. This is the entirety of most developers’ relationship with a tool that has 383 command-line flags, supports authentication via Kerberos, NTLM, and client certificates, can resume interrupted transfers, follow redirects through an arbitrary number of hops, and speak to a Gopher server, which is a thing that existed before the web and somehow still exists after it.

“curl is the debugger for the internet. When nothing else works, you curl it.”
— The Lizard, who has never needed more than GET

The Man Page

The curl man page is approximately 4,800 lines long. It documents every flag, every option, every protocol, every authentication method, every proxy configuration, every TLS variant, every cookie behavior, and every edge case that Daniel Stenberg has encountered in twenty-eight years of maintaining a tool that the entire internet depends on.

Nobody has read it. Not completely. Developers read the man page the way they read terms of service — they scan for the part they need, copy the example, and close the terminal. The man page does not mind. The man page has been there since 1998. It will be there long after the developer has moved on to a different project with different APIs that they will also debug with curl.

The Squirrel once proposed building a “modern curl alternative” with “intuitive syntax.” The tool was called httpie. Someone had already built it. Developers still use curl, because curl is already there, on every machine, in every container, in every Dockerfile, installed before the application it serves.

The Flags Nobody Understands

-X — Specify the HTTP method. Technically unnecessary for GET (curl defaults to GET) and POST (curl switches to POST when you use -d). Developers include it anyway, because curl -X POST looks right, and looking right is 90% of programming.

-H — Add a header. Used almost exclusively for Content-Type: application/json, because the internet runs on JSON now and curl was born in a world that ran on plain text and form data.

-d — Send data. The moment you use -d, curl switches to POST. The -X POST you added is redundant. You will add it anyway. Everyone adds it anyway.

-v — Verbose mode. Shows the full request and response, including headers. This is where debugging actually happens — not in the response body but in the headers, the status codes, the TLS handshake, the redirect chain. -v is the flag that separates “using curl” from “understanding what curl is telling you.”

-s — Silent mode. Suppresses the progress bar. Used in scripts. Used in pipelines. Used whenever curl’s output is being piped to jq, which is always, because raw JSON is unreadable and jq is the second tool you learn after curl.

-o — Write output to a file instead of stdout. The flag that turns curl into a downloader. Combined with a for loop, a web scraper. Combined with a for loop and insufficient ethics review, a problem.

The Borrowed Palace

In The Borrowed Palace — The Night We Stole a UI With curl and Goodwill, riclib used curl as a surgical instrument. Craft’s API had no export function that did what was needed, so curl was pointed at the endpoints, one by one, reverse-engineering the response format, scraping content, and building a bridge between one person’s notes system and someone else’s rendering engine.

This is curl’s secret identity. Publicly, it is a debugging tool — you curl a URL to see if it responds. Privately, it is a skeleton key. Every API that returns JSON to a browser also returns JSON to curl. Every authentication flow that sends a token can be replicated with -H "Authorization: Bearer ...". Every paginated endpoint can be walked with a loop and -o.

curl does not judge what you do with the responses. curl fetches. What you build from the fetched data is between you and your conscience and, occasionally, the terms of service you did not read.

“I didn’t hack anything. I just asked politely, with curl, and they answered.”
— riclib, on the Craft reverse-engineering, to nobody in particular

The Maintenance

Daniel Stenberg has maintained curl since 1998. One person. Twenty-eight years. The project has had other contributors — many others — but the core maintenance, the direction, the daily commitment to a tool that the entire internet depends on, has been one person showing up every day to fix bugs in a C program that speaks twenty-eight protocols.

The Yagnipedia notes, with something approaching awe, that curl does not have a venture-funded company behind it. It does not have a foundation with a marketing budget. It has Daniel Stenberg, who maintains curl the way a lighthouse keeper maintains a lighthouse — because the ships depend on it, and someone has to keep the light on.

“Every mass hallucination rests on a few quiet truths. curl is one of them.”
— A Passing AI, staring at a dependency graph that bottoms out at one man in Sweden

Measured Characteristics

Creator:                          Daniel Stenberg (1998, Sweden)
Protocols supported:              28
Protocols you use:                1 (HTTP/S)
Command-line flags:               383
Flags you know:                   5 (-X, -H, -d, -v, -s)
Man page length:                  ~4,800 lines
Man page lines read (average):    12
Installed on:                     every Unix system, most containers, all developer machines
Daily requests made with curl:    billions (estimated, unmeasured, uncelebrated)
Maintainer:                       1 (one)
Years maintained:                 28
Corporate backing:                none that matters
Times replaced by a "modern alternative": 0 (effective)

See Also

• REST — The architectural style that curl debugs. Every REST API is tested with curl first and Postman second, if at all.
• JSON — The format curl returns, unreadable until piped to jq, at which point it becomes merely difficult.
• API — The thing curl talks to. Every API is a curl command waiting to be written.
• Linux — The operating system where curl lives. Also where curl was born. Also where curl will die, which is to say: never.
• The Borrowed Palace — The Night We Stole a UI With curl and Goodwill — The night curl was used as a lockpick, with permission implied and forgiveness unnecessary.
• The Lizard — Who has never needed more than GET, and never will.