Safe CSV Import Doctor
Inspect a CSV locally before importing it into a spreadsheet, database, marketplace, CRM, ecommerce platform, or internal system. Detect encoding damage, unsafe spreadsheet prefixes, malformed headers, uneven rows, leading-zero identifiers, long integers, scientific-notation-like codes, ambiguous dates, empty records, and control characters. Export a structurally normalized CSV and a privacy-conscious JSON diagnostic report.
Inspection, repairs, and generated files remain in this browser.
Choose one CSV to inspect its encoding, headers, row structure, spreadsheet formula risks, identifiers, and date-like values.
How to Use Safe CSV Import Doctor
Choose one CSV file. The browser strictly decodes it as UTF-8, parses the table, and inspects every parsed header and data cell.
Review the finding count and diagnostic table. High findings deserve immediate attention, Review findings can change import meaning, and Info findings describe notable structure or formatting.
Choose a formula treatment only after deciding whether the export is intended for spreadsheet viewing or machine ingestion.
Choose whether the repaired export should contain a UTF-8 byte-order mark, then download both the repaired CSV and JSON report.
Recommended CSV import workflow
Swipe horizontally to view the full table.
What the Tool Changes
The repair process is deliberately structural rather than semantic.
Headers can be trimmed, named when blank, made unique, or extended when data rows contain additional fields.
Short rows receive empty trailing cells so every exported record has the repaired table width.
No data column is shifted, guessed, deleted, converted to a number, or converted to a date.
Deterministic structural repairs
Swipe horizontally to view the full table.
What the Tool Does Not Change
Leading-zero identifiers, long integers, scientific-notation-like values, and date-like text are reported but preserved.
The doctor does not decide whether 00123 is a postal code, whether 1E10 is a measurement, or whether 01/02/03 uses day-first or month-first notation.
Those decisions belong to the source owner and the schema of the destination system.
CSV Is a Text Format, Not a Typed Table
CSV stores textual fields and record boundaries. It does not reliably declare that one column is text, another is a date, and another is a 64-bit identifier.
Quoting controls how separators, quotes, and line breaks are represented inside fields. It does not force a spreadsheet to preserve a numeric-looking value as text.
The same CSV can therefore be interpreted differently by a spreadsheet, database wizard, programming library, or marketplace importer.
Strict UTF-8 Validation Happens Before Parsing
The file is read as bytes and decoded with a fatal UTF-8 decoder.
An invalid byte sequence stops the workflow instead of being silently replaced, because replacement can change names, identifiers, addresses, and other meaningful data.
The tool does not guess a legacy encoding. Convert from the known source encoding using a controlled process and retain the original file.
Replacement Characters and NUL Bytes
A literal Unicode replacement character can exist inside otherwise valid UTF-8. It may be intentional, but it can also show that an earlier conversion already discarded an unknown character.
NUL characters are reported as High findings because they are unusual in ordinary CSV text and can produce inconsistent behaviour across import tools.
The report gives coordinates without copying the complete data-cell value.
Header Normalization Is Deterministic
The first parsed row is treated as the header.
Surrounding whitespace is removed. Blank headers become column_n. Case-insensitive duplicates receive _2, _3, and later suffixes.
When a data row is wider than the source header, generated names extend the table so no parsed source field is discarded.
Every header action is recorded. The summary distinguishes affected header columns from the number of repair actions.
Short and Wide Rows
A short row contains fewer fields than the original header. Empty trailing fields are added during export.
A wide row contains more fields than the original header. The repaired header expands to preserve all parsed fields.
The doctor never guesses that an extra value belongs in a different position. A width mismatch can result from a legitimate optional field, an incorrect delimiter, an unescaped separator, or malformed quoting, so the source still requires review.
Empty Rows Are Preserved
Rows containing no non-whitespace values are reported as informational findings.
They remain in the repaired CSV because deleting a record can alter row alignment, audit references, or destination-specific meaning.
Remove them only when the source owner has confirmed that they are not significant.
Spreadsheet Formula Injection
Spreadsheet programs can interpret some CSV cells as formulas rather than literal text.
The scanner reports equals, plus, minus, at sign, tab, carriage return, line feed, and supported full-width variants at the start of a cell after ordinary leading spaces are ignored.
The check applies to both headers and data cells because either can be opened in a spreadsheet.
A diagnostic identifies the coordinate and prefix without embedding the complete source value.
Why Warning Only Is the Default
No formula-prefix treatment is universally safe for every spreadsheet and downstream parser.
An apostrophe or tab can prevent interpretation in a particular spreadsheet workflow, but it also changes the underlying text.
A file intended for database ingestion may need exact source characters, while a file intended only for human spreadsheet viewing may justify a spreadsheet-specific treatment.
The tool therefore begins in warn-only mode and records every optional formula repair when another mode is selected.
Formula-prefix treatment modes
Swipe horizontally to view the full table.
Why Legitimate Negative Values Are Flagged
A negative number starts with a minus sign, which is also one of the spreadsheet-active prefixes.
The scanner cannot determine whether −10 is trusted numerical data or attacker-controlled text.
Review the expected column type. Applying a text prefix to a legitimate numerical column can prevent later arithmetic or break a machine importer.
Leading-Zero Identifiers
Values such as 00123 are often identifiers rather than quantities.
Spreadsheet software may remove the initial zeros when it interprets the field as a number.
The repaired CSV preserves the original characters, but the destination column still needs to be imported or configured as text.
Common examples include SKUs, postal codes, phone numbers, account codes, employee IDs, and fixed-width reference numbers.
Integers Longer Than 15 Digits
Excel documents a maximum numerical precision of 15 significant digits.
A 16-digit or longer identifier can therefore be changed when it is interpreted as a number, even when every digit appears correctly in the source CSV.
The scanner reports signed and unsigned integer-looking values containing at least 16 digits. It does not add punctuation or change the source string.
Scientific-Notation-Like Values
Text such as 1E10 can represent a valid numerical value or an identifier that merely resembles scientific notation.
The tool reports the pattern and leaves it unchanged.
Choose a numerical destination type only when exponential notation is intentional. Otherwise import the column as text.
Ambiguous and Date-Like Text
Numeric dates can depend on day-first, month-first, and two-digit-year conventions.
A value is reported as ambiguous when both initial components can represent a month and day or when the year uses two digits.
Unambiguous but date-like numeric and month-name forms are reported as Info because spreadsheet software may still convert them automatically.
No date is rewritten, assigned a timezone, or converted to an internal serial number.
Line Endings, Delimiters, and sep= Directives
The metadata records CRLF, LF, CR, mixed, or absent line endings.
Mixed line endings are informational because the repaired serializer may use one normal export convention.
The shared parser determines the delimiter. The repaired CSV preserves that parsed delimiter.
A spreadsheet sep= directive is reported because parsers disagree on whether it is metadata or an ordinary first record.
UTF-8 BOM Export
A UTF-8 byte-order mark can help some spreadsheet programs recognize UTF-8.
Some database, shell, and programming workflows expect UTF-8 without a BOM.
The export checkbox initially matches the source file rather than adding a BOM to every output automatically.
Changing the setting is an explicit export decision and is recorded in the JSON report.
Understanding Diagnostic Priorities
High means the pattern can create unsafe spreadsheet behaviour or invalid textual content.
Review means the file may import with a different structure or meaning than expected.
Info describes a property that may be relevant without proving an error.
Priorities organize review work; they do not replace knowledge of the source and destination.
Diagnostic priority meanings
Swipe horizontally to view the full table.
Conversion Hazards at a Glance
The same text can be harmless in one destination and damaging in another.
The scanner reports patterns rather than declaring a universal corrected value.
Use the examples to choose an import type and review policy.
Common CSV conversion hazards
Swipe horizontally to view the full table.
The JSON Report Is Designed for Auditing
The report contains source filename, byte count, generation time, parsed delimiter, selected export settings, metadata, summary counts, header repairs, formula repairs, and stored diagnostics.
Data-cell diagnostics contain coordinates, category, code, priority, column name, and explanation without copying the complete source cell.
Header repair entries include original and repaired names because those changes need to be traceable.
When detailed diagnostics reach the browser-safety cap, aggregate counts still include all detected patterns.
A Clean Result Is Not an Import Guarantee
The doctor does not know required columns, primary keys, unique constraints, accepted codes, foreign keys, numerical ranges, locale, timezone, or application-specific limits.
A structurally clean file can still contain missing records, incorrect values, duplicated entities, invalid references, or incompatible business meaning.
Run a controlled test import and validate the result inside the destination before replacing production data.
Privacy and Local Processing
File reading, fatal UTF-8 decoding, CSV parsing, inspection, filtering, repair, serialization, and report generation run locally in the browser.
The source file and parsed values are not uploaded or placed into a shareable URL.
Downloaded files are generated only when the corresponding action is selected.
Examples
Repair duplicate and blank headers
1Input
Headers: SKU, Price, price, blank.
Show result
Result
Headers become SKU, Price, price_2, and column_4.
Comparison is case-insensitive while retained capitalization remains unchanged.
Preserve an extra field
2Input
The header contains three fields and a later row contains four.
Show result
Result
A generated fourth header preserves the extra parsed field.
The tool does not guess whether the additional delimiter was intentional.
Pad a short row
3Input
The header contains four fields and one data row contains two.
Show result
Result
Two empty trailing cells are added to the repaired row.
Existing values remain in their original positions.
Report identifier conversion risks
4Input
SKU 00123 and account code 1234567890123456.
Show result
Result
Leading-zero and long-integer Review findings; both source strings remain unchanged.
Configure these destination columns as text.
Report an ambiguous date
5Input
01/02/03
Show result
Result
Ambiguous numeric date warning without conversion.
The value can depend on locale and two-digit-year rules.
Detect a spreadsheet-active value
6Input
A parsed cell begins with =WEBSERVICE(...).
Show result
Result
High formula-risk finding. Warn-only preserves the value; an optional prefix mode records the change.
Prefix treatment changes the underlying cell text.
Reject invalid UTF-8
7Input
A legacy-encoded byte sequence is decoded as UTF-8.
Show result
Result
The file is rejected before CSV parsing.
Convert from the known source encoding while retaining the original.
Preserve the source BOM policy
8Input
A valid UTF-8 CSV without a BOM.
Show result
Result
The export BOM option begins disabled but can be enabled manually.
A source file containing a BOM starts with the option enabled.
Frequently Asked Questions
What does the CSV doctor repair?
It normalizes headers, extends the header for wide rows, and pads short rows with empty trailing fields.
Will it change my numbers or dates?
No. Identifier, long-number, scientific-notation, and date diagnostics do not semantically convert data cells.
Why is formula treatment not automatic?
Every treatment changes data, and no CSV sanitization method is universal across spreadsheet applications and machine importers.
What does warn-only mode do?
It reports spreadsheet-active prefixes without modifying the associated header or data cell.
What does apostrophe mode do?
It adds an apostrophe before each detected formula-active cell. This is spreadsheet-oriented but is not reliable in every workflow.
What does tab mode do?
It adds a tab before each detected formula-active value. It is Excel-focused and changes the data consumed by later systems.
Why is a negative number reported as a formula risk?
The minus sign is also a spreadsheet-active prefix. The scanner cannot infer whether the value is trusted numerical data or untrusted text.
Will CSV quoting preserve leading zeros?
Not reliably. Quoting controls CSV syntax, while the destination decides whether a field is imported as text or a number.
Why are 16-digit integers reported?
Excel documents a 15-significant-digit numerical precision limit. Longer identifiers can lose trailing digits when interpreted as numbers.
Why is scientific notation reported?
A value such as 1E10 may be a legitimate number or an identifier that only resembles one.
Does the doctor convert dates?
No. It reports ambiguous and date-like forms while preserving their source text.
What is an ambiguous numeric date?
It is a date-like value whose day and month order or two-digit year can be interpreted differently under different conventions.
Are ISO-style dates considered errors?
No. A date-like form may receive an informational finding because spreadsheet software can still convert its storage type automatically.
Why reject non-UTF-8 instead of guessing?
An incorrect encoding guess can silently replace meaningful characters. Controlled conversion from a known encoding is safer.
What is a UTF-8 BOM?
It is a three-byte marker that can help some programs recognize UTF-8. Other importers prefer UTF-8 without it.
Does the repaired CSV keep the source delimiter?
Yes. The export uses the delimiter returned by the shared parser.
Are empty rows removed?
No. They are reported and preserved so the tool does not silently delete source records.
Does the JSON report include my complete cell values?
Data-cell diagnostics omit complete source values. Header repair records include header names because those changes must be auditable.
Why are detailed diagnostics capped?
The cap bounds browser memory and report size. Aggregate counts continue to include all detected patterns.
What does a clean result mean?
No implemented pattern was detected. It does not certify that the file satisfies the destination schema or contains correct business data.
Can this validate required columns or primary keys?
No. Those rules require the actual destination schema and business requirements.
Should I keep the original file?
Yes. Preserve the unchanged source together with the repaired export and diagnostic report.
Is my CSV uploaded?
No. Decoding, parsing, inspection, repair, and download generation occur locally in the browser.
References
- IETF RFC 4180 — Common Format and MIME Type for CSV Files
- IETF RFC 7111 — URI Fragment Identifiers for text/csv
- WHATWG — Encoding Standard
- OWASP — CSV Injection
- OWASP Web Security Testing Guide — Testing for CSV Injection
- Microsoft Support — Keeping Leading Zeros and Large Numbers
- Microsoft Support — Data Import and Automatic Conversion Options
You might also like
JSON to CSV Converter
Convert JSON, nested API responses, JSONL, and NDJSON to CSV or Excel with row-source selection, column preview, and browser-local file processing.
Image Resizer for Online Forms
Check and resize JPG, PNG or WebP images against online-form requirements for file size, pixels, format, aspect ratio and DPI.
Text to Binary Converter
Convert text, Unicode characters, and emoji into grouped UTF-8 binary and hexadecimal bytes.
Random Word Generator
Generate 1 to 50 unique words from a curated English list or paste your own list for custom random picks.