CSV File Guide and Free Online Converter
The grammar, encoding, import behavior, and security limits behind comma-separated values files.
- Add a file Choose or drop it here
- Pick the format Change it whenever needed
- Download the result After conversion completes
CSV Began as a Simple Exchange File, Not an Excel Workbook
CSV means comma-separated values. It is a plain-text way to place a table into a sequence of records and fields. The Internet Engineering Task Force published RFC 4180 in October 2005 as a common format and registered the media type text/csv. The document calls the first record a possible header and says a record is on one line, normally ending with carriage return plus line feed. That description is intentionally small: it gives programs a shared way to pass flat rows, rather than a full spreadsheet language.
This matters because CSV is often associated with Excel but is not an Excel format. It has no native cell type, formula, chart, font, filter, comment, image, protected range, column width, or second worksheet. It can be produced by a database, a reporting system, a web export, a text editor, or a spreadsheet program. A file called report.csv may therefore be valid text data yet open differently in two spreadsheet programs. The program supplies the types and the display rules; the file itself mostly supplies characters and separators.
The CSV Grammar Has Important Rules Beyond “Put Commas Between Values”
RFC 4180 says fields are separated by commas and that spaces are part of a field; an importer should not casually trim them away. Each record should have the same number of fields, and the final field should not be followed by an extra comma. A field may be unquoted, but a field containing a comma, a double quote, a CR, or an LF should be enclosed in double quotes. Within that quoted field, a real quote is escaped by writing it twice. For example, a note containing He said "yes" is represented with doubled quotes inside its surrounding quotes.
The allowance for CR or LF inside a quoted field is easy to miss. It means a physical line is not always a complete logical row. Software that splits at every line break will move the rest of a note or address into a new record. Software that splits at every comma will move part of a company name or free-text comment into later columns. Before accepting a large conversion, inspect a sample containing a comma, a quote, and a line break. That test exposes a parser that only appears to work on easy data.
What CSV Gives You and What It Cannot Carry
- Easy inspection: a text editor can show the raw records, which is useful for checking separators and escaping.
- Broad exchange: database and spreadsheet tools can commonly import a flat table without sharing one workbook program.
- No formula history: a CSV export normally holds a displayed result, not the formula or calculation settings that made it.
- No workbook layout: sheet tabs, styles, charts, filters, and print settings cannot be restored after a CSV round trip.
- Ambiguous values:
0004,03/04/05, and a long digit string have no built-in instruction saying text, date order, or numeric precision.
This is why CSV works well for a documented data exchange and poorly as the only master copy of a working spreadsheet. A receiving workbook can add formatting and formulas after import, but those are new target features, not recovered source information. Keep the source workbook whenever later editing depends on anything beyond the visible values.
Excel and Calc Use Import Settings That Can Change What You See
Character encoding is not defined by the basic CSV grammar. Microsoft says Excel can open a UTF-8 CSV normally when the file was saved with a BOM. When the UTF-8 file has no BOM, Microsoft recommends the Data menu path: Get Data, From File, From Text/CSV, then choose the encoding. This is a direct answer to the frequent “my accented letters changed” report. A direct double-click and the controlled import route do not always make the same choice.
LibreOffice Calc likewise has a Text Import dialog. Its help says the selected language affects detection of dates, time, and scientific notation, and it provides a way to make a quoted field text. A CSV that becomes one column may use a separator that the program did not expect; in many locales a semicolon is common because the comma is used as a decimal separator. Do not alter the file blindly. Select its separator and character set on import, and set codes, postal-style numbers, account identifiers, and date-like text columns to text before Calc or Excel can reinterpret them.
Known CSV Problems Include a Security Risk, Not Just Bad Columns
OWASP documents CSV Injection, also called Formula Injection. When a spreadsheet opens exported untrusted text, a cell beginning with =, +, -, or @ can be treated as a formula. OWASP also lists tab, carriage return, line feed, and full-width versions of formula-starting characters as cases to consider. An attacker may use a separator or quote to begin a new cell, so checking only the beginning of the original submitted text is not enough.
The fix belongs where the CSV is created: validate and neutralize untrusted field content according to the export policy, and test the generated result in the receiving spreadsheet app. OWASP cautions that Excel can remove quotes or escape characters after a save-and-reopen cycle, making a previously suggested escape ineffective. For ordinary data errors, compare the source text to imported columns before any save. Once a program has turned an identifier into a date or rounded a long number, the original spelling may no longer be visible in the workbook copy.
CSV Details That Are Quick to Verify in a Real File
| Check | CSV fact | Reason to check it |
|---|---|---|
| Media type | text/csv in RFC 4180 | Confirms the intended web type |
| Record ending | CRLF in the RFC form | Some parsers care about line endings |
| Quoted comma | Whole field is double-quoted | Stops a false extra column |
| Inner quote | Written as two quotes | Stops an early field close |
| UTF-8 in Excel | BOM supports normal direct open | Helps avoid damaged characters |
| CSV export from Calc | Current sheet only | Prevents assuming all sheets travelled |
Answers to Common CSV Import and Conversion Searches
Why did Excel remove leading zeroes from my CSV?
Excel guessed that the value was numeric. Use From Text/CSV and set that destination column to Text before loading it.
Why are commas inside a name making new columns?
The field was not quoted correctly, or the reader does not honor the CSV quoting rules. A comma-containing field needs surrounding double quotes.
Does CSV support multiple sheets?
No. It is one flat table. LibreOffice explicitly says only the current sheet is saved when exporting to CSV.
Should I use UTF-8 with BOM?
Microsoft documents that Excel opens UTF-8 CSV normally with a BOM. Test the intended downstream system too, because some machine readers expect UTF-8 without one.
Can I safely open an exported CSV from a website?
Check whether it contains untrusted values that could start spreadsheet formulas. CSV Injection is a real OWASP-documented export risk, not a mere formatting issue.
Test a CSV in two views. In a text editor, check headers, delimiter consistency, quoting, doubled quotation marks, and the actual characters. Then import a copy through the receiving program and compare headers, parsed row count, last row, identifiers, totals, and non-English text. A text editor cannot reveal automatic type guesses; a grid cannot easily reveal a missing separator. Keep values such as postcodes, order references, telephone-like strings, long numeric references, and ambiguous dates as text until their meaning is known. The extension does not settle the delimiter or encoding, so controlled import is safer than an unexamined double-click.
A delivery note should name the separator, encoding, BOM policy, header rule, date convention, decimal convention, and important text columns. Some CSV files use semicolons because a comma is the local decimal mark; others include a first-line separator instruction for specific applications. These are not necessarily invalid files, but the receiver needs to know how to read them. Preserve an untouched raw copy while review is underway, because a later workbook save cannot always show the original spelling that type detection changed.
CSV also has no universal promise about headers, empty fields, duplicate column names, or the meaning of a zero. These details should be defined by the sender. A blank can mean unknown, not applicable, or an empty string; those are different states in many systems. If data is going into a database, provide its expected column order and type rules. If it is going to a person, provide a short explanation of date order, decimal notation, and whether values are calculated results. That information is not filler: it prevents a correct CSV parser from making a wrong business decision with an otherwise valid cell.