Convert CSV to Excel — and Excel back to CSV
A CSV file becomes a real .xlsx workbook here: bold header, frozen first row, column widths fitted to the content, numbers written as numbers. The other way round, the tool reads an Excel file, lets you pick a worksheet when there are several, and writes it out as CSV with the delimiter of your choice. Both directions run entirely in your browser — no upload, no sign-up, no queue.
Why are cells starting with =, +, - and @ defused?
Because spreadsheet apps execute a cell whose content looks like a formula. Excel, LibreOffice Calc and Google Sheets all do it, and OWASP tracks the attack as CSV injection (also formula injection). The classic payload looks like this:
=cmd|' /C calc'!A0
If that string reaches an export through a web form and someone opens the file, the spreadsheet app tries to launch an external program. Other variants use WEBSERVICE() or HYPERLINK() to fetch a remote address and send cell contents along with it — data leaving the building without the victim clicking anything.
The standard mitigation is a leading apostrophe, and that is exactly what this tool writes into the .xlsx. Two honest notes:
- The apostrophe is visible in the cell. An invisible guard would be nicer, but it cannot be expressed reliably in the XLSX format.
- Genuine negative numbers such as
-5or-1.5e3are never touched, otherwise the protection would wreck every set of accounts.
If the data comes from a source you trust, a checkbox turns the defusing off.
What does the tool write, and what does it not?
It writes .xlsx — Office Open XML, the default format since Excel 2007 and essentially a ZIP archive full of XML. Excel, LibreOffice, Numbers and Google Sheets all read it.
It does not write the old .xls. That is a proprietary binary format, and producing it correctly in a browser would be wildly disproportionate effort. If you really need .xls, open the generated .xlsx once in Excel and save it in that format.
The limits of a spreadsheet lie elsewhere anyway: an .xlsx sheet holds 1,048,576 rows and 16,384 columns. This tool takes over up to 100,000 rows so the browser tab stays usable, and tells you when it had to cut.
What is lost when converting Excel to CSV?
A CSV file holds exactly one table of text. Everything else falls away:
- Formulas are taken over with their last calculated result — CSV has no formulas.
- Formatting, colours, borders, merged cells, images, charts and comments disappear.
- Other worksheets stay behind; you choose which one is exported.
- Dates are written as
YYYY-MM-DDso they stay sortable and unambiguous.
Why the UTF-8 marker at the start of the file?
When you double-click a CSV file, Excel guesses the encoding from the system locale instead of assuming UTF-8. Without a marker, umlauts and accents turn into the familiar pairs of odd letters. The three bytes at the start solve that for the double-click route; they only go into the downloaded file, not into the text shown on this page. Some import scripts trip over the marker, which is why it can be switched off.
Honest limits
No .xls, no macros, no pivot tables, no charts. Password-protected workbooks cannot be opened. Very large files cost memory, because the whole workbook is assembled in the browser — beyond a few hundred thousand rows, a script using pandas or openpyxl is the better tool.