Paste a pile of cURL commands and get back one tidy Postman collection: named requests, folders, repeated values pulled out into variables, and the values that look like keys left blank in the file. Plus an OpenAPI starting point, a .env file and ready code in five languages.
Bash, zsh and Windows cmd line continuations are all understood, backtick continuations included. In a browser network tab use Copy as cURL (bash) or Copy as cURL (cmd). Copy as PowerShell produces an Invoke-WebRequest command, which is a different thing and is not read here. Paste as many commands as you like, one after another.
Name it, rename the requests, and group them into folders. Folder names are free text, so typing the same name on two requests puts them together.
A cURL command does not say which part of a path is an id. An id shaped segment that repeats across commands is offered as a variable, so it shows here as {{name}}; untick it under Variables to keep the literal value. Click a path segment to turn it into a named path parameter as well. Segments that look like an id are outlined with a dashed border as a hint.
Anything ticked here is replaced with {{name}} wherever that exact value appears, and inside longer text such as a JSON body when the value is at least eight characters long. Shorter values are only swapped when they are the whole field, because a three letter value would otherwise rewrite half the path.
If the detector missed a key, paste it here to pull it out of the collection file without editing your commands. It is marked secret, so the file gets a blank value.
Before you send this file to anyone, read the collection preview above. Anything the detector did not recognise is still in there with its real value. Add it under Variables and it will be blanked out.
postman_collection.json imports into Postman and into Insomnia. openapi.yaml is a starting point, not a finished spec: a cURL command describes what you send, never what comes back, so every response in it is a stub you fill in. .env.example lists every variable, with the values that were detected as secrets left blank. code/ holds one file per language with a function per request. README.md repeats the import steps.
Postman's own importer takes one raw cURL command and makes one request out of it. That is genuinely fine when you have one command. The problem starts at command number nine, when a week of debugging has left you with a text file of calls that all point at the same host, all carry the same bearer token, all repeat the same account id in the path, and none of them have a name. Importing those one at a time gives you nine requests called "https://api.example.com" and a token pasted nine times.
This page reads the whole pile in one go. It finds the base URL every command shares, finds the values that repeat, and offers to lift them into collection variables so there is one place to change them. It names each request from its method and path, lets you drop them into folders, and writes a Postman v2.1 collection file that imports cleanly into Postman and Insomnia alike.
A collection is a file people email each other, drop into Slack and commit to a repository, which is exactly how live API keys escape. Anything that looks like a credential here, an Authorization header, an x-api-key, a password from -u, a token in the query string, is turned into a variable whose value in the collection file is empty. The real value stays on screen for you to copy, and is only written to a file if you ask for it, into .env.local rather than into anything you would normally commit.
Be clear on what that detection is: a list of known credential header names, a list of known credential query names, a set of known token prefixes such as sk_ and eyJ, and a rule that promotes long values which repeat across commands. A house specific header nobody has heard of, holding a value that does not look like a token and appears in only one command, will not be recognised. So the preview is not decoration: read it, and paste anything it missed into the Add a variable box, which blanks it the same way.
Two things genuinely cannot be inferred, and this page does not pretend otherwise. The first is path parameters. /contacts/ve9EPM428h8 is just a path; nothing in the command says that last part is an id rather than a route. What the page does instead is offer: an id shaped segment that repeats across several commands is listed under Variables, ticked, so it comes out as {{name}} in the URL and as a named parameter in the OpenAPI file. Untick it and the literal value comes back. A segment that appears once is left alone until you click it, and clicking it makes it a Postman path variable as well. The second is responses. cURL describes the request only, so the OpenAPI file gets a stubbed 200 that you replace with the real shape once you have seen one.
Method with -X, headers with -H, bodies with -d, --data-raw, --data-binary, --data-urlencode and --json, multipart with -F, basic auth with -u, cookies with -b, plus -G, -I, --url, --user-agent, --referer, --oauth2-bearer and --next. Transport flags such as -L, -k, --compressed, --proxy and -o have no equivalent in a collection, so they are dropped and listed on the request that carried them rather than silently ignored. A body loaded from a file with -d @file.json cannot be read from a web page, so that is flagged and left empty for you to paste in.
A -F "file=@/path/logo.png" becomes a real Postman form data row of type file, pointing at that path, which is what Postman expects. Postman only reads files from inside its own working directory, so an absolute path from someone else's machine usually imports with a missing file warning and you pick the file again. The file itself is never read here. In the OpenAPI file the same part comes out as multipart content with a binary string schema.