How to convert CSV to JSON without corrupting your data

CSV has no types, loose standards and many dialects. Most conversion bugs are a value that quietly changed on the way through.

By NoFrillzApps · 4 min read

What CSV actually specifies

The closest thing to a standard is RFC 4180. Its rules, which every serious parser follows:

Fields are separated by a delimiter (comma by default) and records by line breaks.
A field containing the delimiter, a double quote or a line break must be wrapped in double quotes.
A double quote inside a quoted field is written twice: "".

id,name,notes
1,"Sharma, Priya","Said ""hello"""
2,Lee,"Line one
line two"

That is two records, not three: the quoted line break belongs to the field. Splitting a CSV file on commas and newlines yourself breaks on exactly these cases, which is why you should always use a real parser.

A worked example

The CSV above, converted with the first row as headers and Auto-type turned off, becomes:

[
  { "id": "1", "name": "Sharma, Priya", "notes": "Said \"hello\"" },
  { "id": "2", "name": "Lee", "notes": "Line one\nline two" }
]

Notice "id": "1": a string. CSV has no types; every value is text. The CSV to JSON Converter has an Auto-type numbers & booleans option (on by default) that turns 1 into the number 1 and true into a boolean, but deliberately leaves values with leading zeros, such as 007423, as text. Whether to convert is a decision you make per column, which the next section is about.

Types: where data gets damaged

Automatic type guessing is the main source of silent corruption:

Leading zeros: postal codes, phone numbers and account numbers like 007423 become 7423 if treated as numbers.
Long IDs: numbers beyond 15-16 significant digits lose precision as floating point (see the JSON guide).
Dates: 03/04/2026 is 3 April in India and the UK but March 4 in the US. Convert to ISO 8601 (2026-04-03) as early as possible.
Booleans and blanks: decide whether "" means an empty string or null, and whether "TRUE" becomes true.

A safe default is to keep everything as strings, then convert only the columns you know are numeric.

Delimiters, encodings and Excel

Excel writes CSV using the system's list separator. In locales that use a comma as the decimal mark (much of Europe), that separator is a semicolon, so a "CSV" file may contain no commas at all. The CSV to JSON Converter detects comma, semicolon and tab automatically; if a column count looks wrong, check the delimiter first.

Encoding is the other trap. Files exported as UTF-8 by Excel often start with a byte-order mark, which can end up glued to the first header name ("\ufeffid" instead of "id"). Older exports may be Windows-1252 instead of UTF-8, which turns accented names into garbled characters. Re-save as UTF-8 if that happens.

Going back: JSON to CSV and formula injection

When you convert JSON to CSV for someone to open in a spreadsheet, values that start with =, +, - or @ may be executed as formulas. If the data came from users (names, comments), that's an attack vector known as CSV or formula injection. A value like =HYPERLINK("http://evil.example","Click") becomes a live link.

If the CSV is for spreadsheet users and the data isn't trusted, prefix such values with a single quote (') or another neutral character before export. If it's for another program, leave values untouched.

Checklist

Use a real CSV parser that follows RFC 4180 quoting.
Confirm the delimiter and the encoding before trusting the output.
Keep IDs, postal codes and phone numbers as strings.
Normalise dates to ISO 8601.
When exporting for spreadsheets, neutralise leading =, +, -, @ in untrusted values.

The converter runs in your browser, so customer lists and exports aren't uploaded anywhere.

Common questions

Why did my numbers lose their leading zeros?

The converter or spreadsheet treated the column as numbers. Postal codes, phone numbers and IDs should stay as strings, since 007423 and 7423 are different values.

My CSV has semicolons instead of commas. Is that still CSV?

Yes. Spreadsheet software in locales that use a comma as the decimal separator writes semicolon-separated files. Choose the semicolon delimiter or let the converter detect it.

How are commas and line breaks inside a field handled?

Under RFC 4180 such fields are wrapped in double quotes, and a quote inside a field is doubled. A proper CSV parser reads them as one value.

What is CSV injection?

When a CSV is opened in a spreadsheet, cells starting with =, +, - or @ can run as formulas. If the data comes from untrusted users, neutralise those characters before sharing the file.

Try it: CSV to JSON Converter — runs in your browser, nothing uploaded.