Excel CSV Damage Checker

One line from a customer export: Ada,02134,+1-555-0100,1234567890123456789,MARCH1,true, double-clicked in Excel with English (United States) settings.

02134 looks like a number, so it is stored as 2134: the leading zero is gone.
+1-555-0100 starts with +, so Excel reads the formula =+1-555-0100. The 0100 is just 100, so it calculates 1 − 555 − 100 = −654 and shows that instead of the phone number.
1234567890123456789 has 19 significant digits. Excel keeps 15 and turns the other 4 into zeros, storing 1234567890123450000, and General format shows 1.23457E+18 (6 significant digits, rounded, to fit 11 characters).
MARCH1 is a month name followed by a day, so it becomes the date 1 March of the current year, shown as 1-Mar.
true becomes the logical value TRUE. Only “Ada” survives untouched: 5 of 6 cells change.

The safe CSV writes 02134, the ID, MARCH1 and true as, for example, "=""02134""" (the formula ="02134", which shows the text exactly) and the phone number as '+1-555-0100, so none of them can be converted or run.

The common mistake: fixing it inside Excel after the double-click — selecting the column and formatting it as Text, or re-saving the file. By then 02134 is already the number 2134 and the 19-digit ID is already 1234567890123450000; formatting as Text just turns those wrong values into text, and saving writes them back to the CSV for good. The types have to be set before the data is loaded (Data › From Text/CSV), or the file has to be protected first.

A CSV file is only text: it has no column types, no formats and no way to say “this is a code, not a number”. When you double-click one, Excel guesses each cell’s type the same way it would if you typed it, which is helpful for a column of prices and destructive for anything that only looks like a number or a date.

The 15-digit limit comes from how Excel stores numbers: as 64-bit IEEE 754 floating point, which holds about 15–17 significant decimal digits. Microsoft’s specifications list the number precision as 15 digits, and its documentation says digits beyond the 15th are changed to zeros — which is why credit card numbers, IMEIs and database IDs of 16 or more digits cannot survive as numbers.

Dates caused the best-known damage. In 2016 Mark Ziemann, Yotam Eren and Assam El-Osta reported in Genome Biology that about one in five papers with supplementary Excel gene lists contained gene names converted to dates, such as SEPT2 and MARCH1. In 2020 the HUGO Gene Nomenclature Committee renamed the affected human genes — SEPT1 became SEPTIN1 and MARCH1 became MARCHF1 — citing the spreadsheet problem among its reasons.

Formula injection was described in security research in the mid-2010s, and OWASP’s CSV Injection page lists the characters to neutralise: =, +, -, @, tab and carriage return. Microsoft also documents that a text file whose first two characters are the capital letters “ID” is taken for a SYLK (symbolic link) spreadsheet, which produces a format warning.

This tool reads a CSV with an RFC 4180 parser (quoted fields, doubled quotes and line breaks inside quotes), detects the delimiter, and runs every cell through the conversions Excel applies on a double-click: numbers, leading zeros, the 15-digit limit, E-notation, dates, times, booleans, number formats, formulas and hidden spaces. Each flagged cell shows what Excel would display and why, and the file is checked for the delimiter, the SYLK “ID” warning, the encoding and Excel’s sheet limits.

The predictions follow Excel’s documented and widely reproduced default behaviour for English (United States); anything that depends on version, settings or locale is marked may. Formula results are calculated by a small arithmetic parser, never by running the text. Everything happens in your browser; nothing you paste or drop is uploaded.

Related tools: JSON ⇄ CSV Converter, CSV Viewer, and Database Viewer.