How to convert JSON to CSV safely

Short answer

CSV is a table; JSON can contain arbitrary trees. A useful conversion starts by defining what one row means and which properties become columns.

Recommended shape

[
  { "name": "Ada", "score": 10 },
  { "name": "Lin", "score": 12 }
]

becomes:

name,score
Ada,10
Lin,12

One object can be treated as one row. An empty array, standalone scalars, or a mixture of objects and other values does not define a table without inventing extra rules.

Quotes, line breaks, and delimiter

A field containing the delimiter, quotes, or line breaks must be enclosed in double quotes, with every inner quote doubled. The delimiter may be comma, semicolon, or tab according to the consumer; do not change it silently based on locale.

The JSON to CSV converter keeps nested objects and arrays as compact JSON in one cell, preserves stable column order, and writes CRLF in the downloaded file.

Spreadsheet formulas

Text beginning with =, +, -, or @ may be interpreted as a formula by some spreadsheet applications. This matters when values come from users or other untrusted sources.

The tool enables a protection that prefixes those strings with an apostrophe. That changes the underlying text, and no universal mitigation works for every spreadsheet and re-import workflow. The OWASP CSV Injection guide describes the risk and limitations.

Before downloading

• Validate the JSON and reject duplicate keys.
• Decide which fields are columns and how missing values behave.
• Choose the delimiter and encoding expected by the importer.
• Keep formula protection when a person will open untrusted text in a spreadsheet.
• If another program consumes the CSV, validate types there: CSV does not retain the distinction between number, boolean, null, and string.