How to convert JSON to CSV safely

Short answer

CSV is a table; JSON can contain arbitrary trees. A useful conversion starts by defining what one row means and which properties become columns.

Open the JSON to CSV converter, paste the rows, choose the Delimiter, and keep Protect spreadsheet formulas enabled for untrusted text. Then select Convert to CSV and review the table before downloading it.

Recommended shape

[
  { "name": "Ada", "score": 10 },
  { "name": "Lin", "score": 12 }
]

becomes:

name,score
Ada,10
Lin,12

One object can be treated as one row. An empty array, standalone scalars, or a mixture of objects and other values does not define a table without inventing extra rules.

The tool includes every top-level property, adding columns in order of first appearance. A later row can add a column; earlier rows then have an empty cell there. Remove unwanted fields from the source before converting—the interface does not include a column selector. null, a missing property, and an empty string all become empty cells, so preserve that distinction in the source if the receiving process needs it.

Quotes, line breaks, and delimiter

A field containing the delimiter, quotes, or line breaks must be enclosed in double quotes, with every inner quote doubled. The delimiter may be comma, semicolon, or tab according to the consumer; do not change it silently based on locale.

The JSON to CSV converter keeps nested objects and arrays as compact JSON in one cell, preserves stable column order, and writes CRLF in the downloaded file.

Spreadsheet formulas

Text beginning with =, +, -, or @ may be interpreted as a formula by some spreadsheet applications. This matters when values come from users or other untrusted sources.

The tool enables a protection that prefixes those strings with an apostrophe. That changes the underlying text, and no universal mitigation works for every spreadsheet and re-import workflow. The OWASP CSV Injection guide describes the risk and limitations.

Before downloading

• Validate the JSON and reject duplicate keys.
• Prepare the top-level fields you want as columns and check the empty-cell rules.
• Choose the delimiter and encoding expected by the importer.
• Keep formula protection when a person will open untrusted text in a spreadsheet.
• If another program consumes the CSV, validate types there: CSV does not retain the distinction between number, boolean, null, and string.