# man > curl(1)

---
type: CommandReference
command: curl
mode: man
section: "1"
source: man-pages
---

## Quick Reference

- `curl https://example.com` — HTTP GET request, output to stdout
- `curl -L -D - https://example.com` — GET with redirects, dump headers to stdout
- `curl -O https://example.com/filename.zip` — Download file, save with remote filename
- `curl -X POST -d 'name=bob' http://example.com/form` — POST form-encoded data
- `curl -k -x http://127.0.0.1:8080 -H 'Authorization: Bearer token' -X GET https://example.com` — Request with custom header, proxy, insecure
- `curl -d '{"name":"bob"}' -H 'Content-Type: application/json' http://example.com/users/1234` — POST JSON data
- `curl -E client.pem --key key.pem -k https://example.com` — Use client certificate for TLS
- `curl -v --resolve example.com:80:127.0.0.1 http://example.com` — Verbose, custom DNS resolution

## Name

curl — transfer a URL

## Synopsis

`curl [options / URLs]`

## Description

curl transfers data from or to a server using one of many supported protocols (DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP). Designed for unattended operation. Powered by libcurl.

## Options

### General Options

- `--abstract-unix-socket <path>` — Connect via abstract Unix domain socket (7.53.0)
- `--alt-svc <file>` — Enable Alt-Svc caching (7.64.1)
- `--anyauth` — Auto-select authentication method (HTTP)
- `-a, --append` — Append to target file when uploading (FTP SFTP)
- `--aws-sigv4 <provider1[:provider2[:region[:service]]]>` — AWS V4 signature authentication (7.75.0)
- `--basic` — Use HTTP Basic authentication (default)
- `--cacert <file>` — CA certificate file for peer verification
- `--capath <dir>` — CA certificate directory
- `--cert-status` — Verify server certificate status via OCSP stapling (7.41.0)
- `--cert-type <type>` — Client certificate type (PEM, DER, ENG, P12)
- `-E, --cert <certificate[:password]>` — Client certificate file
- `--ciphers <list>` — Specify TLS ciphers
- `--compressed-ssh` — Enable SSH compression (7.56.0)
- `--compressed` — Request compressed HTTP response
- `-K, --config <file>` — Read config file
- `--connect-timeout <seconds>` — Maximum time for connection phase
- `--connect-to <HOST1:PORT1:HOST2:PORT2>` — Override connection destination (7.49.0)
- `-C, --continue-at <offset>` — Resume transfer at given offset
- `-c, --cookie-jar <filename>` — Write cookies to file after operation
- `-b, --cookie <data|filename>` — Send cookies from string or file
- `--create-dirs` — Create local directory hierarchy for output
- `--create-file-mode <mode>` — Set file creation mode (7.75.0)
- `--crlf` — Convert LF to CRLF in upload (FTP SMTP)
- `--crlfile <file>` — Certificate Revocation List file
- `--curves <algorithm list>` — Request specific ECC curves (7.73.0)
- `--data-ascii <data>` — Alias for `-d, --data`
- `--data-binary <data>` — Post binary data
- `--data-raw <data>` — Post data without @ interpretation (7.43.0)
- `--data-urlencode <data>` — URL-encode and post data
- `-d, --data <data>` — Send POST data (application/x-www-form-urlencoded)
- `--delegation <LEVEL>` — GSS/kerberos delegation level
- `--digest` — Use HTTP Digest authentication
- `--disable-eprt` — Disable EPRT/LPRT in active FTP
- `--disable-epsv` — Disable EPSV in passive FTP
- `-q, --disable` — Do not read config file
- `--disallow-username-in-url` — Fail if URL contains username (7.61.0)
- `--dns-interface <interface>` — Outgoing DNS interface (7.33.0)
- `--dns-ipv4-addr <address>` — Bind DNS IPv4 requests to address (7.33.0)
- `--dns-ipv6-addr <address>` — Bind DNS IPv6 requests to address (7.33.0)
- `--dns-servers <addresses>` — Custom DNS servers (7.33.0)
- `--doh-cert-status` — Same as --cert-status for DoH (7.76.0)
- `--doh-insecure` — Skip cert verification for DoH (7.76.0)
- `--doh-url <URL>` — DNS-over-HTTPS server (7.62.0)
- `-D, --dump-header <filename>` — Write protocol headers to file
- `--egd-file <file>` — Entropy Gathering Daemon socket
- `--engine <name>` — OpenSSL crypto engine
- `--etag-compare <file>` — Conditional request with stored ETag (7.68.0)
- `--etag-save <file>` — Save ETag to file (7.68.0)
- `--expect100-timeout <seconds>` — Timeout for 100-continue response (7.47.0)
- `--fail-early` — Exit on first transfer error (7.52.0)
- `--fail-with-body` — Fail on HTTP error but save body (7.76.0)
- `-f, --fail` — Fail silently on HTTP errors
- `--false-start` — Enable TLS false start (7.42.0)
- `--form-escape` — Use backslash-escaping in multipart forms (7.81.0)
- `--form-string <name=string>` — Literal form string value
- `-F, --form <name=content>` — Multipart form data upload
- `--ftp-account <data>` — FTP account data
- `--ftp-alternative-to-user <command>` — Fallback auth command
- `--ftp-create-dirs` — Create remote directories on FTP/SFTP
- `--ftp-method <method>` — FTP method (multicwd, nocwd, singlecwd)
- `--ftp-pasv` — Use passive mode (default)
- `-P, --ftp-port <address>` — Use active mode, specify address
- `--ftp-pret` — Send PRET before PASV/EPSV
- `--ftp-skip-pasv-ip` — Reuse control connection IP for data (default since 7.74.0)
- `--ftp-ssl-ccc-mode <mode>` — CCC mode (active/passive)
- `--ftp-ssl-ccc` — Shut down SSL/TLS after auth (Clear Command Channel)
- `--ftp-ssl-control` — Require SSL for control, clear for data
- `-G, --get` — Use GET with data from -d
- `-g, --globoff` — Disable URL globbing
- `--happy-eyeballs-timeout-ms <ms>` — Happy Eyeballs timeout (7.59.0)
- `--haproxy-protocol` — Send HAProxy PROXY protocol header (7.60.0)
- `-I, --head` — Fetch headers only
- `-H, --header <header/@file>` — Custom HTTP header
- `-h, --help <category>` — Display help
- `--hostpubmd5 <md5>` — SSH host key MD5 checksum
- `--hostpubsha256 <sha256>` — SSH host key SHA256 hash (7.80.0)
- `--hsts <file>` — Enable HSTS with cache file (7.74.0)
- `--http0.9` — Allow HTTP/0.9 responses (7.64.0, disabled by default)
- `-0, --http1.0` — Use HTTP/1.0
- `--http1.1` — Use HTTP/1.1 (7.33.0)
- `--http2-prior-knowledge` — Use HTTP/2 without upgrade (7.49.0)
- `--http2` — Use HTTP/2 (7.33.0)
- `--http3` — Use HTTP/3 (experimental, 7.66.0)
- `--ignore-content-length` — Ignore Content-Length header
- `-i, --include` — Include response headers in output
- `-k, --insecure` — Skip SSL/SSH verification
- `--interface <name>` — Use specified network interface
- `-4, --ipv4` — Resolve to IPv4 only
- `-6, --ipv6` — Resolve to IPv6 only
- `-j, --junk-session-cookies` — Discard session cookies
- `--keepalive-time <seconds>` — Idle time before keepalive probes
- `--key-type <type>` — Private key file type (DER, PEM, ENG)
- `--key <key>` — Private key file name
- `--krb <level>` — Kerberos authentication level
- `--libcurl <file>` — Output libcurl C source code
- `--limit-rate <speed>` — Limit transfer rate (bytes/sec, with suffix)
- `-l, --list-only` — FTP: name-only listing; POP3: LIST command
- `--local-port <num/range>` — Preferred local port range
- `--location-trusted` — Follow redirects and send auth to all hosts
- `-L, --location` — Follow redirects
- `--login-options <options>` — Protocol login options (7.34.0)
- `--mail-auth <address>` — SMTP authentication address
- `--mail-from <address>` — SMTP sender address
- `--mail-rcpt-allowfails` — Ignore RCPT TO errors for some recipients (7.69.0)
- `--mail-rcpt <address>` — SMTP recipient address
- `-M, --manual` — Display full manual
- `--max-filesize <bytes>` — Abort if file larger than specified
- `--max-redirs <num>` — Maximum redirects to follow (default 50)
- `-m, --max-time <seconds>` — Maximum time for whole operation
- `--metalink` — Disabled since 7.78.0 (security)
- `--negotiate` — Use HTTP Negotiate (SPNEGO) authentication
- `--netrc-file <filename>` — Use specific netrc file
- `--netrc-optional` — Optional netrc usage
- `-n, --netrc` — Use .netrc file for credentials
- `-:, --next` — Start next operation with separate options (7.36.0)
- `--no-alpn` — Disable ALPN TLS extension (7.36.0)
- `-N, --no-buffer` — Disable output buffering
- `--no-keepalive` — Disable TCP keepalive
- `--no-npn` — Disable NPN TLS extension (7.36.0)
- `--no-progress-meter` — Suppress progress meter (7.67.0)
- `--no-sessionid` — Disable SSL session-ID caching
- `--noproxy <list>` — Hosts that bypass proxy
- `--ntlm-wb` — NTLM authentication via external binary
- `--ntlm` — Use NTLM authentication
- `--oauth2-bearer <token>` — Bearer Token for OAuth 2.0 (7.33.0)
- `--output-dir <dir>` — Directory for output files (7.73.0)
- `-o, --output <file>` — Write output to file
- `--parallel-immediate` — Open more connections in parallel (7.68.0)
- `--parallel-max <num>` — Maximum parallel transfers (default 50, 7.66.0)
- `-Z, --parallel` — Perform transfers in parallel (7.66.0)
- `--pass <phrase>` — Passphrase for private key
- `--path-as-is` — Do not normalize path sequences (../ etc.) (7.42.0)
- `--pinnedpubkey <hashes>` — Public key pinning (7.39.0)
- `--post301` — Do not convert POST to GET on 301 redirect
- `--post302` — Do not convert POST to GET on 302 redirect
- `--post303` — Do not convert POST to GET on 303 redirect
- `--preproxy [protocol://]host[:port]` — SOCKS proxy before HTTP(S) proxy (7.52.0)
- `-#, --progress-bar` — Display progress bar instead of meter
- `--proto-default <protocol>` — Default protocol for URLs without scheme (7.45.0)
- `--proto-redir <protocols>` — Allowed protocols on redirect (7.45.0)
- `--proto <protocols>` — Limit allowed protocols
- `--proxy-anyauth` — Auto-select proxy auth method
- `--proxy-basic` — HTTP Basic proxy auth
- `--proxy-cacert <file>` — CA cert for proxy (7.52.0)
- `--proxy-capath <dir>` — CA cert directory for proxy (7.52.0)
- `--proxy-cert-type <type>` — Proxy client cert type (7.52.0)
- `--proxy-cert <cert[:passwd]>` — Proxy client cert (7.52.0)
- `--proxy-ciphers <list>` — Proxy TLS ciphers (7.52.0)
- `--proxy-crlfile <file>` — Proxy CRL file (7.52.0)
- `--proxy-digest` — HTTP Digest proxy auth
- `--proxy-header <header/@file>` — Custom header sent to proxy (7.37.0)
- `--proxy-insecure` — Skip proxy cert verification (7.52.0)
- `--proxy-key-type <type>` — Proxy private key type (7.52.0)
- `--proxy-key <key>` — Proxy private key (7.52.0)
- `--proxy-negotiate` — HTTP Negotiate proxy auth
- `--proxy-ntlm` — HTTP NTLM proxy auth
- `--proxy-pass <phrase>` — Proxy private key passphrase (7.52.0)
- `--proxy-pinnedpubkey <hashes>` — Public key pinning for proxy (7.59.0)
- `--proxy-service-name <name>` — Proxy service name for SPNEGO (7.43.0)
- `--proxy-ssl-allow-beast` — Allow BEAST workaround for proxy (7.52.0)
- `--proxy-ssl-auto-client-cert` — Auto-select client cert for proxy (7.77.0)
- `--proxy-tls13-ciphers <list>` — TLS 1.3 cipher suites for proxy (7.61.0)
- `--proxy-tlsauthtype <type>` — Proxy TLS auth type (7.52.0)
- `--proxy-tlspassword <string>` — Proxy TLS password (7.52.0)
- `--proxy-tlsuser <name>` — Proxy TLS username (7.52.0)
- `--proxy-tlsv1` — Use TLS v1 for proxy (7.52.0)
- `-U, --proxy-user <user:password>` — Proxy authentication credentials
- `-x, --proxy [protocol://]host[:port]` — Use specified proxy
- `--proxy1.0 <host[:port]>` — HTTP 1.0 proxy
- `-p, --proxytunnel` — Tunnel through HTTP proxy via CONNECT
- `--pubkey <key>` — Public key file for SFTP/SCP
- `-Q, --quote <command>` — Send arbitrary command to FTP/SFTP server
- `--random-file <file>` — File with random data for SSL
- `-r, --range <range>` — Byte range (partial download)
- `--raw` — Disable internal HTTP content/transfer encoding decoding
- `-e, --referer <URL>` — Referer header
- `-J, --remote-header-name` — Use server-specified filename from Content-Disposition
- `--remote-name-all` — Treat all URLs as -O
- `-O, --remote-name` — Write output to file named after remote file
- `-R, --remote-time` — Set local file timestamp to remote file's
- `--request-target <path>` — Custom request target path (7.55.0)
- `-X, --request <method>` — Custom HTTP method
- `--resolve <[+]host:port:addr[,addr]...>` — Custom host resolution (like /etc/hosts)
- `--retry-all-errors` — Retry on any error (7.71.0)
- `--retry-connrefused` — Treat ECONNREFUSED as transient error (7.52.0)
- `--retry-delay <seconds>` — Sleep between retries
- `--retry-max-time <seconds>` — Maximum time for retries
- `--retry <num>` — Retry count on transient errors
- `--sasl-authzid <identity>` — SASL authorization identity (7.66.0)
- `--sasl-ir` — Enable initial response in SASL (7.31.0)
- `--service-name <name>` — Service name for SPNEGO (7.43.0)
- `-S, --show-error` — Show error message with -s
- `-s, --silent` — Silent mode (no progress or errors)
- `--socks4 <host[:port]>` — SOCKS4 proxy
- `--socks4a <host[:port]>` — SOCKS4a proxy (hostname resolved by proxy)
- `--socks5-basic` — Username/password for SOCKS5 (7.55.0)
- `--socks5-gssapi-nec` — Allow unprotected GSS-API negotiation
- `--socks5-gssapi-service <name>` — SOCKS5 GSS-API service name
- `--socks5-gssapi` — Use GSS-API for SOCKS5 (7.55.0)
- `--socks5-hostname <host[:port]>` — SOCKS5 proxy (hostname resolved by proxy)
- `--socks5 <host[:port]>` — SOCKS5 proxy (local resolution)
- `-Y, --speed-limit <speed>` — Abort if speed below limit for speed-time seconds
- `-y, --speed-time <seconds>` — Time for speed-limit check
- `--ssl-allow-beast` — Allow BEAST workaround (loosens security)
- `--ssl-auto-client-cert` — Auto-select client cert for Schannel (7.77.0)
- `--ssl-no-revoke` — Disable certificate revocation checks (Schannel, 7.44.0)
- `--ssl-reqd` — Require SSL/TLS for connection
- `--ssl-revoke-best-effort` — Ignore revocation check failures (Schannel, 7.70.0)
- `--ssl` — Try SSL/TLS, fallback to insecure
- `-2, --sslv2` — Ignored (SSLv2 insecure)
- `-3, --sslv3` — Ignored (SSLv3 insecure)
- `--stderr <file>` — Redirect stderr to file
- `--styled-output` — Use bold fonts for HTTP headers (7.61.0)
- `--suppress-connect-headers` — Suppress proxy CONNECT response headers (7.54.0)
- `--tcp-fastopen` — Enable TCP Fast Open (7.49.0)
- `--tcp-nodelay` — Enable TCP_NODELAY (default since 7.50.2)
- `-t, --telnet-option <opt=val>` — Telnet option (TTYPE, XDISPLOC, NEW_ENV)
- `--tftp-blksize <value>` — TFTP block size (>512)
- `--tftp-no-options` — Disable TFTP options (7.48.0)
- `-z, --time-cond <time>` — Request file modified after (or before) given time
- `--tls-max <VERSION>` — Maximum TLS version (7.54.0)
- `--tls13-ciphers <ciphersuite list>` — TLS 1.3 cipher suites (7.61.0)
- `--tlsauthtype <type>` — TLS authentication type (SRP)
- `--tlspassword <string>` — TLS password
- `--tlsuser <name>` — TLS username
- `--tlsv1.0` — Use TLS 1.0 or later (7.34.0)
- `--tlsv1.1` — Use TLS 1.1 or later (7.34.0)
- `--tlsv1.2` — Use TLS 1.2 or later (7.34.0)
- `--tlsv1.3` — Use TLS 1.3 or later (7.52.0)
- `-1, --tlsv1` — Use at least TLS 1.x
- `--tr-encoding` — Request compressed transfer encoding
- `--trace-ascii <file>` — Dump data (ASCII only) to file
- `--trace-time` — Prepend timestamp to trace lines
- `--trace <file>` — Full hex dump of data to file
- `--unix-socket <path>` — Connect via Unix domain socket (7.40.0)
- `-T, --upload-file <file>` — Upload local file to remote
- `--url <url>` — Specify URL (useful in config files)
- `-B, --use-ascii` — ASCII transfer (FTP LDAP)
- `-A, --user-agent <name>` — User-Agent header
- `-u, --user <user:password>` — Server authentication credentials
- `-v, --verbose` — Verbose output
- `-V, --version` — Display version info
- `-w, --write-out <format>` — Output custom info after transfer
- `--xattr` — Store metadata in extended file attributes

## Examples

shell
# HTTP GET request
curl https://example.com

# GET with redirects and header dump
curl -L -D - https://example.com

# Download file with remote name
curl -O https://example.com/filename.zip

# POST form data
curl -d "name=curl" -d "tool=cmdline" https://example.com

# POST JSON
curl -d '{"name":"curl"}' -H "Content-Type: application/json" https://example.com

# Upload file via FTP
curl -T localfile ftp://example.com/remote/

# Use client certificate
curl -E cert.pem --key key.pem -k https://example.com

# Custom DNS resolution
curl --resolve example.com:443:127.0.0.1 https://example.com
## See Also

[ftp(1)](https://www.chedong.com/phpMan.php/man/ftp/1/markdown), [wget(1)](https://www.chedong.com/phpMan.php/man/wget/1/markdown), [libcurl(3)](https://www.chedong.com/phpMan.php/man/libcurl/3/markdown)

## Exit Codes

| Code | Description |
|------|-------------|
| 1 | Unsupported protocol |
| 2 | Failed to initialize |
| 3 | URL malformed |
| 4 | Feature not enabled |
| 5 | Could not resolve proxy |
| 6 | Could not resolve host |
| 7 | Failed to connect to host |
| 8 | Weird server reply |
| 9 | FTP access denied |
| 10 | FTP accept failed |
| 11 | FTP weird PASS reply |
| 12 | FTP timeout |
| 13 | FTP weird PASV reply |
| 14 | FTP weird 227 format |
| 15 | FTP cannot use host |
| 16 | HTTP/2 error |
| 17 | FTP could not set binary |
| 18 | Partial file |
| 19 | FTP could not download/access file |
| 21 | FTP quote error |
| 22 | HTTP page not retrieved (with -f) |
| 23 | Write error |
| 25 | FTP could not STOR file |
| 26 | Read error |
| 27 | Out of memory |
| 28 | Operation timeout |
| 30 | FTP PORT failed |
| 31 | FTP could not use REST |
| 33 | HTTP range error |
| 34 | HTTP post error |
| 35 | SSL connect error |
| 36 | Bad download resume |
| 37 | FILE could not read file |
| 38 | LDAP cannot bind |
| 39 | LDAP search failed |
| 41 | Function not found |
| 42 | Aborted by callback |
| 43 | Internal error |
| 45 | Interface error |
| 47 | Too many redirects |
| 48 | Unknown option |
| 49 | Malformed telnet option |
| 51 | Peer certificate not OK |
| 52 | Server replied nothing |
| 53 | SSL crypto engine not found |
| 54 | Cannot set SSL engine default |
| 55 | Failed sending network data |
| 56 | Failure in receiving network data |
| 58 | Problem with local certificate |
| 59 | Could not use specified SSL cipher |
| 60 | Peer certificate cannot be authenticated |
| 61 | Unrecognized transfer encoding |
| 62 | Invalid LDAP URL |
| 63 | Maximum file size exceeded |
| 64 | Requested FTP SSL level failed |
| 65 | Rewind failed |
| 66 | Failed to initialize SSL engine |
| 67 | Login failed |
| 68 | File not found on TFTP |
| 69 | Permission problem on TFTP |
| 70 | Out of disk space on TFTP |
| 71 | Illegal TFTP operation |
| 72 | Unknown TFTP transfer ID |
| 73 | File already exists (TFTP) |
| 74 | No such user (TFTP) |
| 75 | Character conversion failed |
| 76 | Character conversion functions required |
| 77 | Problem reading SSL CA cert |
| 78 | Resource not found |
| 79 | SSH error |
| 80 | Failed to shut down SSL |
| 82 | Could not load CRL file |
| 83 | Issuer check failed |
| 84 | FTP PRET command failed |
| 85 | RTSP CSeq mismatch |
| 86 | RTSP Session Identifier mismatch |
| 87 | Unable to parse FTP file list |
| 88 | FTP chunk callback error |
| 89 | No connection available (queued) |
| 90 | SSL public key mismatch |
| 91 | Invalid SSL certificate status |
| 92 | HTTP/2 stream error |
| 93 | API called from callback |
| 94 | Authentication function error |
| 95 | HTTP/3 error |
| 96 | QUIC connection error |