A JSON to CSV cheat sheet is a quick-reference summary of the exact rules that turn a JSON array of objects into an RFC 4180-style comma-separated file. The Lizely JSON To CSV tool applies those rules locally in the browser: it accepts only a non-empty top-level array of objects, discovers columns in the order they first appear, serializes nested values as compact JSON inside one cell, applies RFC 4180 quoting, and prefixes dangerous strings with an apostrophe so spreadsheets do not execute them as formulas. Nothing is uploaded — parsing, schema discovery, escaping, preview, and the Blob download all happen in the current tab. The accepted top-level shape is deliberately narrow, so a top-level object, primitive, empty array, null row, array row, or primitive row is rejected with a specific message. The output is deterministic: no trimming, no BOM, no date inference, no number localization, and no locale-based delimiter change. The downloadable file is converted.csv with the MIME type text/csv and a UTF-8 charset, and the preview shows the exact bytes that go into that Blob before you save it.
Convert a JSON Array to CSV
The JSON To CSV tool runs the conversion entirely in your browser tab in three short steps. Use this workflow whenever you need a clean, deterministic RFC 4180 export that you can hand to Excel, Google Sheets, or any other consumer.
- Paste a JSON array of objects. Start with a non-empty array whose every row is an object — for example [{"name":"Alice","age":30},{"name":"Bob","age":31}]. The textarea counter shows you how close you are to the input ceiling, and over-limit input is marked in the counter rather than being silently cut. Top-level objects, primitives, empty arrays, null rows, array rows, or primitive rows are rejected with a specific message.
- Convert and inspect the output. Trigger the conversion, then read the preview for column order, nested JSON cells, quoting, and any reported formula-risk prefixes. Editing the JSON clears the previous CSV, error state, and download URL, and a fresh conversion revokes the older Blob URL before creating a new one.
- Download converted.csv and import. Save the file, then open it with UTF-8 comma-separated import settings in the receiving application. The MIME type is text/csv with a UTF-8 charset, and the preview contains the same complete string that the Blob holds.
Column Discovery and Field Order
Columns are discovered by scanning the parsed records from first to last and adding each field name the first time it appears. Later records can introduce additional columns, so a row at index 50 may add a brand-new field that did not exist in row 0 — every header is added exactly once, in first-encounter order, with no reordering or sorting. The discovered schema tops out at 200 columns; any field beyond that boundary returns an error and no partial CSV.
Missing fields and explicit null values both become empty CSV cells. JSON primitives keep their ordinary text forms: false, true, and 0 stay false, true, and 0 in the output. Object property order inside any compact nested text follows the parsed JavaScript object's enumeration behavior, which is not guaranteed to match the source string.
Quoting, Escaping, and RFC 4180 Rules
Output follows the common RFC 4180 field rules so the file is portable across spreadsheets and CSV libraries. The reference table below captures the exact format choices the converter makes.
| Situation | Behavior in converted.csv |
|---|---|
| Field separator | Comma (,) between every field |
| Record terminator | CRLF (\r\n) between every row |
| Field contains a comma | Field is wrapped in double quotes |
| Field contains a double quote | Field is wrapped in double quotes, and each internal " is doubled |
| Field contains CR or LF | Field is wrapped in double quotes |
| Empty value | Empty field with no quotes |
| Leading/trailing whitespace | Preserved exactly, never trimmed |
| UTF-8 BOM | Not added |
The converter does not trim, does not add a UTF-8 BOM, does not infer dates, does not localize numbers, and does not swap delimiters based on the browser locale. These choices keep the output deterministic, which matters when you compare two exports byte for byte.
Nested Values, Nulls, and Missing Fields
Nested objects and arrays are not flattened into dotted columns. Instead they are serialized as compact JSON inside one CSV cell, and CSV quoting then protects the JSON double quotes and commas. The reason is simple: inventing a flattening convention could collide with real field names and would lose array structure. It also means a downstream consumer must parse that cell as JSON if the nested structure is needed again.
Top-level fields keep their first-encounter names, and JSON primitives render as ordinary text. {"name":"Alice","age":30,"meta":{"plan":"pro","tags":["a","b"]}} becomes three CSV columns — name, age, and meta — with the meta cell holding the compact JSON {"plan":"pro","tags":["a","b"]}. Missing fields and explicit null values render as empty CSV cells, never as the literal string null.
Spreadsheet Formula Protection
Spreadsheet formula injection is handled by an always-on safety policy — there is no toggle to disable it. Any JSON string value or field name that begins with one of the triggers below receives a leading apostrophe before CSV escaping, and the result summary reports how many cells were prefixed. The apostrophe is the standard signal that spreadsheet programs should treat the cell as text rather than as a formula.
| Trigger character | Example source | Result after protection |
|---|---|---|
| = | "=SUM(A1:A10)" | '=SUM(A1:A10) wrapped in CSV quotes |
| + | "+1+1" | '+1+1 wrapped in CSV quotes |
| - | "-2+3" | '-2+3 wrapped in CSV quotes |
| @ | "@SUM(A1:A10)" | '@SUM(A1:A10) wrapped in CSV quotes |
| Tab (\t) | "\t=cmd" | '\t=cmd wrapped in CSV quotes |
| Carriage return (\r) | "\r=cmd" | '\r=cmd wrapped in CSV quotes |
Triggers also fire after ECMAScript whitespace, including a leading BOM or no-break space, so a value such as "\uFEFF=cmd" is still flagged. JSON numeric values are typed data rather than attacker-controlled formula strings, so a JSON number such as -42 remains -42 and is not prefixed. According to OWASP's CSV Injection guidance, this kind of prefix mitigation reduces a common risk but is not a universal guarantee — a later application might remove the apostrophe, reinterpret text, or apply different trigger rules. Review untrusted exports before opening them in software that can execute formulas, commands, links, or external data connections.
Hard Limits at a Glance
Limits are explicit and never implemented as silent caps. Crossing any boundary returns an error and no shortened CSV — the text area continues to show the over-limit input and marks it in the counter rather than cutting characters during typing. Keep these four numbers in view when you size a payload.
| Limit | Maximum | What happens at the boundary |
|---|---|---|
| Input JSON size | 1,000,000 JavaScript characters | Conversion errors; over-limit input remains visible and marked in the counter |
| Array length | 10,000 rows | Conversion errors; no partial CSV produced |
| Discovered columns | 200 fields | Conversion errors; no partial CSV produced |
| Output CSV size | 5,000,000 characters | Conversion errors; no partial CSV produced |
If your payload is larger than any of those ceilings, split it before you paste and combine the resulting CSV files downstream — the converter deliberately refuses to produce a truncated file rather than silently cut rows or columns.
Import Settings in the Receiving App
The receiving application controls how converted.csv is interpreted, and the right import settings depend on the consumer. Two quick recipes cover most spreadsheet and developer workflows.
- Excel. Use Data → From Text/CSV, pick UTF-8 as the file origin, comma as the delimiter, and treat the first row as headers. If your data contains non-ASCII characters and Excel still misreads them, save the file through the Remove BOM from CSV Files Without Losing Data walkthrough and re-import with the same settings.
- Google Sheets. Use File → Import → Upload, choose Replace current sheet, set separator to comma, and confirm UTF-8 detection. Sheets auto-detects UTF-8 in most cases, but explicit confirmation avoids silent mojibake.
For developer consumers, the file is plain UTF-8 text with CRLF terminators and RFC 4180 quoting, so any standard CSV parser in Python, Node.js, Go, or Java can read it without preprocessing. As the Library of Congress CSV format description notes, CSV does not carry data types, nested schemas, character-encoding declarations inside the file, or a universal dialect marker — so keep the original JSON whenever types and structure matter, and use a schema-aware pipeline for production migrations or regulated data.
Related reading: Is a JSON to Excel Converter Safe to Use Online?.