JSON to CSV Converter

What is JSON to CSV conversion?

Converting JSON to CSV means taking an array of JSON objects, or a single object, and laying it out as a table: one header row built from the keys, one row per object underneath. It is the reverse of what a CSV to JSON tool does, and it is usually needed for the opposite reason — the data already exists as JSON, from an API response or a config file, and the next step is a spreadsheet, not a script. Every record in the array might not have the same fields, which is exactly the part that makes this more than a formatting exercise.

APIs and application logs speak JSON; analysts, accountants, and most people's Monday morning speak spreadsheets. Excel and Google Sheets do not open a JSON array natively, so somebody has to build the table first, deciding what happens to a field one record has and another does not, or a value that is not a flat string or number at all. That is the actual work this tool does, beyond the reformatting.

How to use it

1. Paste the JSON. Paste an array of objects, or a single object, into the box. It does not need to be pre-flattened — that part is handled next.
2. Choose delimiter and flattening. Pick comma, semicolon, tab, or pipe, keep flattening on to turn nested fields into dotted column names, and leave formula neutralising on unless you specifically need raw values. Choose LF or CRLF depending on where the file is headed.
3. Copy the CSV and check the counts. The result reports rows, columns, and how many values it defused against formula injection. Copy it with the button once the shape looks right.

What flattening a document into a table actually decides

The column list is not fixed in advance — it is built as the union of every record's keys, in the order each key was first seen. So if one record has a discount field and the next ninety-nine do not, that column exists once, and the ninety-nine rows without it get a blank cell rather than the whole row shifting sideways to compensate for a missing value. That is a real decision, not an accident of implementation; the alternative, aligning by position, breaks the instant records disagree on shape, which JSON records are free to do.

Nested objects flatten to dotted keys — a record with a nested user object containing a name field becomes a column called user.name, because CSV has no concept of nesting and a table needs a flat set of columns. Arrays and objects that should not be pulled apart are instead written whole as JSON text inside a single cell; it is a workaround, but a lossless and reversible one, since a JSON parser reading that cell back gets the original structure exactly. Any value containing the chosen delimiter, a quote character, or a newline gets wrapped in quotes with internal quotes doubled — the same convention this site's CSV reader reads back correctly, verified by round-tripping 2,000 randomly generated tables through both directions unchanged.

The one that matters for security is formula injection, and it is a real attack, not a theoretical one. If a cell's value starts with an equals sign, a plus, a minus, or an at sign, Excel and Google Sheets run it as a formula the moment the file is opened — so if the underlying data came from a form somebody else filled in, that is potentially code execution on whoever opens the export. The tool defuses this by prefixing a single apostrophe to any value that starts with one of those four characters, which forces spreadsheet software to treat it as text. It is on by default, it counts how many values it changed, and it can be turned off for cases where you specifically need the raw value.

Honest limitations

CSV cannot represent two things, and no amount of careful escaping changes that. A trailing empty row in the output is indistinguishable from a trailing newline at end of file. An empty string value is also indistinguishable from an empty field once it is written down, so a JSON array that round-trips through CSV and back may not return byte-for-byte identical, even though nothing was lost that CSV is capable of keeping in the first place.

Malformed quoting has no universally correct fix, only a documented one, and that matters here because this tool's output is somebody else's input. Different readers make different choices about where a quoted section ends: this site's own CSV to JSON converter ends it at the closing quote and returns three fields for a,"b"c,d, while Papa Parse keeps consuming and returns two. The CSV written here follows RFC 4180's quoting rules cleanly enough that this should not come up in practice, but it is worth knowing the ambiguity exists in the ecosystem this file is headed into.

This tool controls what it writes, not what happens after. Once the CSV is opened in Excel or Sheets, that program is free to reinterpret a value on its own terms. A plain-looking numeric string can still get mangled by autoformatting the moment it is opened, and nothing in the CSV file itself can prevent that from happening.

Why is it free?

The conversion runs in your browser, which is also why it costs nothing: there is no server processing the file, so there is no server bill to recover from you. No account, no watermark, nothing uploaded — the JSON you paste in never leaves the device it is sitting on. The flattening, the escaping, the formula defusing, all of it runs as JavaScript in the tab you already have open.

That is the point for exactly the JSON people are most careful with: an API response with customer records, a database dump pulled for a one-off report. It stays local because the tool never had a reason to send it anywhere in the first place, not because of a privacy policy promising to delete it later.