cURL with a Bearer token — inspect and sanitize locally

Paste a curl command to see exactly what it sends — method, URL, headers, body — then rewrite the hardcoded token as an environment variable. Runs entirely in your browser.

Why hardcoded tokens in curl commands are dangerous

• Shell history — every command lands in ~/.bash_history or ~/.zsh_history in plaintext.
• Process list — while the request runs, ps aux shows your full command line to every user on the machine.
• Screen shares and tickets — the most common way tokens leak into Slack, Zoom and Jira.
• CI logs — pasted commands end up in build output, archived forever.

The fix: environment variables

Store the token in an environment variable and reference it — the command line then contains no secret at all:

1. export TOKEN="eyJhbGci…" (once per shell, or in your shell rc / CI secret store)
2. -H "Authorization: Bearer $TOKEN" — history and ps now show only the variable name.
3. For scripts, read from a secrets manager instead of exporting in plaintext.

Is my command uploaded anywhere?

No. This page is a single static HTML file — parsing runs entirely in your browser. Disconnect from the internet after it loads and it keeps working.

Need the full toolbox?

This page is one tool from LocalDevToolbox — 15+ local developer tools: cURL → Python converter, context optimizer, stack trace analyzer, log doctor and more.