curl
Hacker ApprovedThe most recommended of 5 HTTP clients
A mature, well-tested command-line tool for HTTP and many other protocols that composes well in scripts and with agents; critics find it has too many options.
A mature, well-tested command-line tool for HTTP and many other protocols that composes well in scripts and with agents; critics find it has too many options.
126 people gave an opinion
- recommend it
- 100
- criticize it
- 26
- approval share
- 79%
Recommended in 12 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 100 people recommend itNeeds 10 or more, met.
- 3.8 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 12 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Well-engineered, rigorously tested and reliable
“curl is certainly a much more difficult problem to solve well, and does so without 30 million issues”
Comment from 21 Sep 2026 in “I am often wrong” “curl may just happen to be a well-hardened tool that doesn't have too many security vulnerabilities”
Comment from 11 May 2026 in “Mythos Finds a Curl Vulnerability” “Curl and SQLite are my favourite examples of properly engineered, rigourously tested _anything_.”
Comment from 11 May 2026 in “Mythos Finds a Curl Vulnerability” - Comment from 11 May 2026 in “Mythos Finds a Curl Vulnerability”
- Comment from 6 Jun 2026 in “Did Claude Increase Bugs in Rsync?”
- Comment from 15 Jun 2026 in “Curl will not accept vulnerability reports during July 2026”
- Comment from 11 May 2026 in “Mythos Finds a Curl Vulnerability”
Composable in scripts with jq
“a simple script (curl calling steam API and sending a notification if the price is set) + cron handle the job perfectly”
Comment from 22 Apr 2026 in “OpenClaw isn't fooling me. I remember MS-DOS” “providing a few curl + jq oneliners to interact with a REST API works great in my experience”
Comment from 10 Apr 2026 in “I Still Prefer MCP over Skills” “The ones that survive decades (Make, grep, curl) do one thing and compose well”
Comment from 5 Mar 2026 in “Good software knows when to stop” - Comment from 6 Dec 2025 in “Perl's decline was cultural”
- Comment from 19 Jul 2026 in “curl can be used to send emails with SMTP”
- Comment from 21 Sep 2026 in “MCP was always a bad idea?”
- Comment from 23 Jan 2026 in “Composing APIs and CLIs in the LLM Era”
Works well with AI agents
“Complex agent-system integration problems are usually better solved with just AI agent + curl + SKILL.md.”
Comment from 21 Sep 2026 in “MCP was always a bad idea?” “curl is an excellent, very popular command on which all major coding models are well trained on.”
Comment from 28 Jul 2026 in “MCP 2026-07-28 Specification: transport going stateless” “Agents love standing on the shoulders of good crystalized cognition (grep, curl etc)”
Comment from 25 Sep 2026 in “What About Rails?” Supports many protocols and features
“I find myself using curl telnet://server:port too often these days because telnet and nc don’t get installed.”
Comment from 11 Feb 2026 in “The Day the Telnet Died” “it's an enormously complex and capable tool. Support for tons of protocols, certs, and much more.”
Comment from 26 May 2026 in “The Pressure” “curl can do very detailed timing [1] for what it's worth and it can also do this using a proxy”
Comment from 16 Jun 2026 in “TIL: You can make HTTP requests without curl using Bash /dev/TCP” - Comment from 16 Jun 2026 in “TIL: You can make HTTP requests without curl using Bash /dev/TCP”
What people warn about
Each mark is one comment
Vulnerability report pause criticized
“With more advance notice, someone could have found resources to fork curl with different vulnerability management expectations”
Comment from 15 Jun 2026 in “Curl will not accept vulnerability reports during July 2026” “No, that is the point, they are not going to accept your vuln report. They are taking a holiday.”
Comment from 15 Jun 2026 in “Curl will not accept vulnerability reports during July 2026” “Why would you imagine they have any clue about the area of effect if they ignore the report?”
Comment from 15 Jun 2026 in “Curl will not accept vulnerability reports during July 2026” - Comment from 15 Jun 2026 in “Curl will not accept vulnerability reports during July 2026”
Too many options, still limited
“curl is more limited than the programs I use to generate HTTP, it's slower”
Comment from 18 Aug 2026 in “Tell HN: Cloudflare silently injects its analytics when you switch nameservers” “There are some things curl cannot do, even though it has too many options”
Comment from 17 Jun 2026 in “TIL: You can make HTTP requests without curl using Bash /dev/TCP”
Other HTTP clients people recommend
The four most recommended other HTTP clients, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| curlThis page | 100 | 26 | 79% | 12 | — | Approved |
| wget | 19 | 1 | 95% | 10 | — | Approved |
| HTTPie | 7 | 1 | 88% | 6 | — | — |
| curl-impersonate | 5 | 1 | 83% | 4 | — | — |
| lgogdownloader | 5 | 0 | 100% | 2 | — | — |
What people said
40 of the 132 comments that mention it, newest first. Each links to the original comment.
“CLI tools included with macOS 27.2 and Xcode use still contains the compromised eMudhra certificates (curl, git, etc.)”
“their superficial overlap in ability to download a single file from an HTTP server does not make them "trivially replaceable" with each other”
“At least with curl you know that you're getting the supply chain put together by the software author”
“Agents love standing on the shoulders of good crystalized cognition (grep, curl etc)”
“Complex agent-system integration problems are usually better solved with just AI agent + curl + SKILL.md.”
“It would seem that curl + jq represents most of the solution these days.”
“curl is certainly a much more difficult problem to solve well, and does so without 30 million issues”
“curl is more limited than the programs I use to generate HTTP, it's slower”
“Curl is the ideal tool since you don't have to share logs and neither prove your application behaviour.”
“curl is an excellent, very popular command on which all major coding models are well trained on.”
“I use this in all the various little bash scripts I have running via timers.”
“There are some things curl cannot do, even though it has too many options”
“curl can do very detailed timing [1] for what it's worth and it can also do this using a proxy”
“Curl takes care of that (and a host of other annoying stuff) for you.”
“With more advance notice, someone could have found resources to fork curl with different vulnerability management expectations”
“It exchanges packets with the internet and then outputs a safely sanitized byte stream.”
“I'm not sure it's be reasonable to leave an actively exploited critical bug until August.”
“Why would you imagine they have any clue about the area of effect if they ignore the report?”
“No, that is the point, they are not going to accept your vuln report. They are taking a holiday.”
“curl is mature enough that the chance of an impactful bug is basically zero”
“cURL also offers paid support and also paid access to the rock-solid (LTS) version, with guaranteed response times”
“Two of the most reliable software ever to exist, curl and SQLite, are C/C++”
“it's an enormously complex and capable tool. Support for tons of protocols, certs, and much more.”
“curl may just happen to be a well-hardened tool that doesn't have too many security vulnerabilities”
“curl HAS had security, protocol and language experts poking at it for years”
“it shows what is achievable if there is a high bar for quality in every single line of code”
“Curl and SQLite are my favourite examples of properly engineered, rigourously tested _anything_.”
“a simple script (curl calling steam API and sending a notification if the price is set) + cron handle the job perfectly”
“the curl project receives tonnes of issues and support requests from people who run `curl` in PowerShell”
“the curl project receives tonnes of issues and support requests from people who run curl in PowerShell”
“providing a few curl + jq oneliners to interact with a REST API works great in my experience”
“Ended up just wrapping curl with the right User-Agent and it worked without needing a full browser.”
“But this is no different to using an API key with access controls and curl and you get the same thing.”
“The ones that survive decades (Make, grep, curl) do one thing and compose well”
“I find myself using curl telnet://server:port too often these days because telnet and nc don’t get installed.”
“CLIs, cURL, and other shell tools are composable and discoverable.”
“for a project that has a quite good reputation, I think the burden of proof is on you”
“if any program has been the standard for doing this kind of thing for a long time it's curl”
“Given curl, jq, and awk, you can create a quick MVP client for almost any api”
“What does software look like when it's developed out of passion purely for the improvement to the world? Curl, linux, git.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.