Save and name response files

By default curl prints the response body to your terminal. For downloads you want a file instead. There are two ways to name it.

--output lets you pick the name. --remote-name (short form -O) takes the name from the last part of the URL. The second is convenient, but only when you trust that name.

Name the file yourself

Download a text file with an explicit destination:

curl --fail --output robots.txt https://curl.se/robots.txt

Then check the exit status and look at the file:

echo $?
cat robots.txt

0 means the transfer worked and the HTTP status was fine.

--fail is the option people forget, and it matters. Without it, a 404 is a “successful” transfer. curl saves the HTML error page as robots.txt and exits with 0. Your script moves on, and the broken file surfaces much later, far from its cause.

With --fail, any HTTP status of 400 or above makes the command fail. Exit code 22, and no misleading file on disk.

Try it against a URL that does not exist. example.org serves no robots.txt:

curl --fail --output robots.txt https://example.org/robots.txt

You get curl: (22) The requested URL returned error: 404 and nothing on disk. On some HTTP/2 transfers the same failure shows up as exit code 56 instead. Either way, non-zero.

Let the URL name the file

When you already know and trust the filename in the URL:

curl --fail -O https://curl.se/robots.txt

curl takes the last path segment, robots.txt, and writes to that name in the current directory. You typed the URL, so you know what the name will be.

It stops being that easy with --remote-header-name (-J). That option lets the server pick the filename through a response header. A hostile or compromised server can suggest a name you did not expect. Be careful with it, and never run it in a directory you care about.

Resume a big download

For large files that get interrupted, resume instead of starting over:

curl --fail -C - --output ubuntu.iso https://releases.ubuntu.com/24.04/ubuntu-24.04.4-desktop-amd64.iso

-C - tells curl to look at the partial file and continue from where it stopped.

Do not run what you have not read

Do not pipe a download straight into a shell. The popular curl ... | bash pattern runs whatever bytes arrive, right away, with your permissions.

Save the script first. Read it. Check the source or the checksum. That costs you two extra commands. Running an attacker’s script costs a lot more.