What is a CSV file?

A CSV file stores a table as plain text, with the values in each row separated by commas. CSV stands for comma-separated values. Each line is one row of the table, and each comma-separated piece is one cell.

Because it’s just text, almost any tool can read and write CSV: spreadsheets, databases and web services alike. It’s a common way to export the answers to a class sign-up form into a list, or to move an online course’s student roster into another tool. The format is so simple that, depending on how you open it, text can come out garbled or numbers can change. Knowing how it works helps you avoid that.

What does a CSV file look like?

Here’s what a few class sign-ups might look like as CSV:

• Line 1: Name,Email,Course
• Line 2: Hana Yamada,hana@example.com,Intro to Watercolor
• Line 3: Ken Sato,ken@example.com,Oil Painting Basics

Open it in a spreadsheet and you see this:

Name	Email	Course
Hana Yamada	hana@example.com	Intro to Watercolor
Ken Sato	ken@example.com	Oil Painting Basics

Each line is one record, and each position between commas is a column. The first line is often a header row that names the columns. Every line should have the same number of columns.

The common format is written down in RFC 4180, published in 2005. It describes what most tools already did rather than setting a strict standard, so tools still differ in the details.

What if a value contains a comma or a line break?

If a value itself contains a comma, a program can’t tell where to split it. So any value that contains a comma, a line break or a double quote (“) is wrapped in double quotes:

• A value with a comma: "Monday, Wednesday" is read as one value.
• A value with a double quote: """First-timers"" welcome", where each “ inside is written twice.
• A value with a line break: wrapped in double quotes, a multi-line answer still counts as one value.

If you write a program that simply splits each line at every comma, the columns will shift. To read CSV, use a spreadsheet’s import feature or the CSV library that comes with most programming languages.

In countries that use a comma as the decimal mark, CSV files often use semicolons (;) as the separator instead. A file separated by tabs is called TSV.

Why does text come out garbled?

A CSV file doesn’t record which character encoding (the rule for turning characters into numbers) it was written in. The program opening it has to guess, and when it guesses wrong, names with accents, Japanese text or emoji come out garbled.

Encoding	What to know
UTF-8	Covers the world’s writing systems. Widely used on the web and in modern services
Regional encodings	Older systems may use a regional encoding, such as Windows-1252 for Western European languages or Shift_JIS for Japanese

A UTF-8 file sometimes starts with an invisible marker called a BOM (byte order mark). According to Microsoft, Excel opens a UTF-8 CSV file correctly if it was saved with a BOM. If there’s no BOM, don’t double-click the file. Use the text and CSV import on the Data tab instead, and choose the file’s original encoding there (Microsoft’s guide).

A BOM can cause trouble elsewhere, though. A program that doesn’t expect it may read it as part of the first column’s name. When you hand a CSV file to another tool, check first which encoding it expects and whether it wants a BOM.

Why do leading zeros and dates change?

A CSV cell carries no information about whether it’s a number, a date or text. When a spreadsheet opens the file, it guesses from what each value looks like and converts it. That leads to things like:

• A ZIP code such as 02134 turning into 2134
• A phone number written with a leading zero losing that zero
• A membership number with 16 or more digits showing in scientific notation (like 1.23E+15), with every digit after the 15th turned into 0
• Values like 12/2 or MAR1 turning into dates

Excel stores numbers with at most 15 digits of precision, so once a long ID is read as a number, the lost digits can’t be recovered. Read values like these as text instead:

1. Open the file with the import feature and set columns such as phone numbers, ZIP codes and IDs to Text before loading.
2. In newer versions of Excel, such as Excel for Microsoft 365, you can turn off conversions like removing leading zeros or creating dates under Automatic Data Conversion in the options.
3. If you open the file and save over it, the converted values are what end up in the CSV, so keep a copy of the original.

Dates written like 03/04/2026 can mean March 4 or April 3, depending on the country. When you exchange data, write dates as year, month, day, such as 2026-10-12, the format set by the international standard ISO 8601, to avoid mix-ups.

How is CSV different from an Excel file?

An Excel workbook (.xlsx) can hold values together with formulas, formatting, charts and several sheets. A CSV file holds the values of one table, written out as text.

	CSV (.csv)	Excel workbook (.xlsx)
Contents	Values as plain text	Values, formulas, formatting, charts and more
Sheets	One table	Several sheets
Data types	None (the program opening it guesses)	Keeps numbers, dates and text apart
Opens in	Almost any tool, including text editors	Spreadsheet apps

To move data from one tool to another, CSV is the better fit because almost everything can read it. For a table people format by hand, or totals built with formulas, a spreadsheet file is the better fit. When you save as CSV from Excel, only the sheet you have open is saved. Formulas become their calculated values, and formatting is dropped.

How do you handle CSV files safely?

What is CSV injection?

Spreadsheets treat a cell that starts with = as a formula. OWASP, a community that publishes web security guidance, notes that values starting with +, -, @ or a tab can be treated as formulas too. CSV injection, also called formula injection, is when someone types formula-like text into a place anyone can fill in, such as a form, hoping it will run in the spreadsheet of whoever opens the exported file. The formula might try to send data to an outside site or show a misleading link.

Spreadsheets may warn you before doing something like loading outside data. A few calm habits go a long way:

• If a warning appears when you open a CSV exported from a public form, don’t select Enable unless you understand why it’s needed.
• Don’t click links or formulas in cells you don’t recognize. Check what’s in them first.
• If you’re the one creating CSV files, stop values from running as formulas, for example by adding ' in front of text values that start with one of those characters (OWASP’s guidance).

Files with personal information

A CSV file of sign-ups with names and email addresses is plain text with no lock of its own. Rather than emailing it around, keep it somewhere only the people who need it can open. Limiting access to only those who need it is the idea behind the principle of least privilege. When you’re done with a file, delete it rather than leaving it in your Downloads folder.

Summary

• A CSV file is a plain-text table: one record per line, with commas marking the columns.
• Values that contain commas, line breaks or double quotes are wrapped in double quotes.
• Garbled text comes from reading the wrong encoding. Check for a BOM and choose the encoding when you import.
• Read phone numbers, ZIP codes and long IDs as text so leading zeros and digits aren’t lost.
• Open CSV files exported from public forms with care for formulas and links.