Developer Tools

CSV vs JSON

Should your workflow start with CSV or JSON?

Understand practical tradeoffs for ingestion, transformation, export, and developer ergonomics.

Input CSV

Output JSON

Recommended Next Steps

Continue your journey with these related tools

CSV Tools

Convert CSV to JSON and Markdown.

JSON vs CSV

Compare JSON and CSV across structure, parsing, and interoperability.

Spreadsheet to Markdown

Convert spreadsheet rows into Markdown tables.

The Definitive Guide to CSV

Key Insights & Concepts

Comma Separated Values (CSV) is the cockroach of data formats—it survived mainframes, the Dot-com boom, and the Mobile era, and it will likely survive the AI revolution. It is the universal adapter for data.

Why is it still everywhere?

1
Universal Compatibility: Every programming language, database, and spreadsheet software (Excel, Sheets) can read it natively.
2
Compactness: Unlike JSON, CSV doesn't repeat field names. For a file with 1 million rows, this can save 50%+ of distinct file size.
3
Streamability: You can process the first row of a 100GB CSV file without reading the whole file. JSON usually requires parsing the entire object tree.

The Dark Side

1
Inconsistent Standards: RFC 4180 exists, but nobody follows it. Some use semicolons `;` (Europe) or tabs `\t` (TSV).
2
No Types: Everything is a string. `true`, `"true"`, and `1` are all just text.

The "Excel Problem" (BOM & Encoding)

A valid UTF-8 CSV often opens as gibberish in Microsoft Excel. Why?
Excel assumes strict ASCII unless told otherwise. To force Excel to recognize UTF-8 (e.g., emojis ✨, Chinese characters), you must include a hidden character at the very start of the file called the Byte Order Mark (BOM).

// Without BOM (Excel shows "Ã©")
const blob = new Blob([csvString], { type: 'text/csv' });

// With BOM (Correct)
const blob = new Blob(['\uFEFF' + csvString], { type: 'text/csv;charset=utf-8' });

Security Warning: CSV Injection (Formula Injection)

This is a critical vulnerability often overlooked. If you allow users to input data that is later exported to CSV, they can hack your admins.

The Attack Vector

An attacker sets their "Name" to:
=cmd|' /C calc'!A0
When an admin exports the user list and opens it in Excel, Excel interprets the `=` as a formula and executes the command (opening Calculator, or downloading malware).

How to Prevent It:

Sanitize fields starting with `=`, `+`, `-`, or `@`. Prepend a single quote `'` or tab `\t` to force Excel to treat it as text.

Parsing Compexity: It's harder than `split(',')`

Junior developers often try to parse CSV using `string.split(',')`. This fails immediately on real-world data.

The Edge Case Test

Name, "Role", "Quote" 
"Doe, John", Admin, "He said ""Hello"" today"

A parser needs to handle: 1. Quoted Fields: Commas inside quotes are data, not delimiters. 2. Escaped Quotes: Double quotes usually mean a single literal quote. 3. Newlines inside cells: A physical line break in the file doesn't always mean a new row.

Frequently Asked Questions

Excel defaults to ANSI encoding. To fix this, you must add a specialized character called the 'Byte Order Mark' (\uFEFF) at the very beginning of the CSV file. This tells Excel 'This is UTF-8'.

It's a security vulnerability where malicious cell data (starting with =, +, -, @) executes as a formula in Excel. This can lead to data exfiltration or arbitrary code execution on the victim's machine.

Use **CSV** for tabular data, large datasets, and interoperability with legacy systems/spreadsheets. Use **JSON** for nested data, flexible schemas, and web APIs.

You must wrap the entire cell in double quotes. For example: `"New York, NY"` is treated as one cell, whereas `New York, NY` is two cells.

No. CSV is strictly 2-dimensional (rows and columns). To represent nested data, you must either flatten it (e.g., user.address.city) or use a different format like JSON or XML.

Tab Separated Values. It's identical to CSV but uses a Tab character (`\t`) instead of a comma. It's often safer because tabs are rarely used inside actual text content.

The CSV format itself has no limit. However, Microsoft Excel has a hard limit of **1,048,576 rows**. If your file is larger, Excel will truncate it.

The standard (RFC 4180) says you escape a double quote by using two double quotes. Example: `"She said ""Hi"""`.

Excel aggressively auto-formats dates. It might turn `2026-01-31` into `31/01/2026` depending on your locale. There is no way to prevent this in standard CSV; only manual import wizards in Excel can fix it.

**Parquet**. It is a columnar binary format used in big data (Hadoop, Spark). It is much faster to query and much smaller on disk than CSV, but requires special tools to read.

Related Developer Tools

Key Insights & Concepts

Developer Tools

CSV vs JSON

Should your workflow start with CSV or JSON?

Understand practical tradeoffs for ingestion, transformation, export, and developer ergonomics.

Input CSV

Output JSON

Recommended Next Steps

Continue your journey with these related tools

CSV Tools

Convert CSV to JSON and Markdown.

JSON vs CSV

Compare JSON and CSV across structure, parsing, and interoperability.

Spreadsheet to Markdown

Convert spreadsheet rows into Markdown tables.

The Definitive Guide to CSV

Key Insights & Concepts

Why is it still everywhere?

1
Universal Compatibility: Every programming language, database, and spreadsheet software (Excel, Sheets) can read it natively.
2
Compactness: Unlike JSON, CSV doesn't repeat field names. For a file with 1 million rows, this can save 50%+ of distinct file size.
3
Streamability: You can process the first row of a 100GB CSV file without reading the whole file. JSON usually requires parsing the entire object tree.

The Dark Side

1
Inconsistent Standards: RFC 4180 exists, but nobody follows it. Some use semicolons `;` (Europe) or tabs `\t` (TSV).
2
No Types: Everything is a string. `true`, `"true"`, and `1` are all just text.

The "Excel Problem" (BOM & Encoding)

// Without BOM (Excel shows "Ã©")
const blob = new Blob([csvString], { type: 'text/csv' });

// With BOM (Correct)
const blob = new Blob(['\uFEFF' + csvString], { type: 'text/csv;charset=utf-8' });

Security Warning: CSV Injection (Formula Injection)

This is a critical vulnerability often overlooked. If you allow users to input data that is later exported to CSV, they can hack your admins.

The Attack Vector

How to Prevent It:

Sanitize fields starting with `=`, `+`, `-`, or `@`. Prepend a single quote `'` or tab `\t` to force Excel to treat it as text.

Parsing Compexity: It's harder than `split(',')`

Junior developers often try to parse CSV using `string.split(',')`. This fails immediately on real-world data.

The Edge Case Test

Name, "Role", "Quote" 
"Doe, John", Admin, "He said ""Hello"" today"