http.app
Zero Data Retention

HTTP REQUEST BUILDER

Build a request from a method, URL, query parameters, headers, and a body, or paste a curl command to fill the form in. Then copy it in the language you need. Nothing is ever sent: the builder only writes code.

Zero retention: your headers never leave this browser. Verify it yourself in DevTools.

Loading the workbench.

About the Request builder

How Can You Verify That Nothing Leaves This Browser?

You do not have to take our word that your request stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.

  1. Open your browser developer tools with F12, or Cmd+Option+I on a Mac, and select the Network tab.
  2. Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your request.
  3. Click the clear icon in the Network tab so that the log is empty.
  4. Build a request with a test API key, switch languages, and import a curl command.
  5. Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.

Only two things can add a line to that log, and neither carries your request. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.

2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.

Which Languages Can It Generate?

  • curl, with every argument single-quoted for the shell and the body sent with --data-raw.
  • fetch and axios for JavaScript, with JSON bodies as real object literals.
  • Python requests, using json= for JSON bodies.
  • HTTPie, PowerShell Invoke-WebRequest, and Go net/http.
  • Raw HTTP/1.1, with the Host and Content-Length a server would actually see.

Every language gets the same URL, headers, and body, and when a body needs a Content-Type you did not set, the builder adds it and tells you.

How Does curl Import Work?

Paste a curl command, including one copied from DevTools with Copy as cURL, and the builder fills in the form. It understands quoting in bash, PowerShell, and Windows cmd style, line continuations, bundled short flags such as -sSL, and attached values such as -XPOST.

  1. Method, URL, and query parameters from -X, --url, -G, -I, and the URL itself.
  2. Headers from -H, -A, -e, -b, and -r, and Basic or Bearer auth from -u and --oauth2-bearer.
  3. Bodies from -d, --data-raw, --data-binary, --data-urlencode, and --json.
  4. Warnings for anything that cannot be represented, such as files, multipart forms, or --insecure.

Which Bugs Were Fixed?

The original builder had six bugs, each now covered by a test. The URL-encode option double-encoded values; it now encodes once, or not at all when switched off. axios and Python repeated the query string; it now appears once, in the URL. An apostrophe in a JSON body produced invalid JavaScript; bodies are now real literals. curl sent JSON labelled as form data; the JSON Content-Type is now added. A half-typed URL threw an error on every keystroke; it is now a note. And masking secrets also masked the copied code, so the copy did not work.

How Are Tokens Kept Safe?

Authorization, Cookie, API-key style headers, and token-like query parameters are masked in the code on screen, so a screenshot or a screen share does not leak them. The Copy button copies the real request, because masked code would not run. The form lives only in this tab's memory and is wiped when you leave the tab, after inactivity, or when you press Wipe. The builder never sends the request, so your token is never exposed to a third party.

What Other Lanes Are in the Audit & Build Section?

  • Security header audit: Grade pasted response headers A to F: HSTS, CSP, framing, referrer, isolation, and leaks.
  • Meta tag generator: Generate title, description, Open Graph, and Twitter tags, or inspect pasted HTML.

Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.

Frequently Asked Questions

Does the builder send my request?

No. It only writes code. You run the generated curl, fetch, or Python yourself. 2http never contacts the URL, so it cannot leak the token or the response.

Why does the copied code show my real token when the screen shows it masked?

Masking is for display, so screenshots and screen shares stay safe. Code with a masked token would not work, so Copy always gives the real request.

Can I convert a curl command to Python?

Yes. Paste the curl command into the importer, then choose Python requests. The same works for fetch, axios, HTTPie, PowerShell, and Go.

Why does a GET request drop my body?

GET and HEAD requests do not carry a body, and fetch refuses to send one. Switch to POST, PUT, or PATCH if the server expects a body.

Was this helpful?