{
  "schemaVersion": "1.0",
  "canonicalPage": "https://fileformat.co/ext/csv",
  "inspectorUrl": "https://fileformat.co/inspect",
  "spec": {
    "slug": "csv",
    "extension": ".csv",
    "aliases": [
      ".tsv"
    ],
    "name": "Comma-Separated Values (RFC 4180)",
    "shortName": "CSV",
    "category": "data-lake",
    "tier": 1,
    "summary": "Plain-text tabular interchange format notorious for real-world parser edge cases: optional UTF-8 BOMs (`EF BB BF`), multiline quoted cells, doubled quote escapes (`\"\"`), and formula injection.",
    "technicalNotes": "RFC 4180 permits embedded CRLF line breaks inside double-quoted fields—naive `text.split('\\n')` parsers corrupt row counts whenever user comments span multiple lines.",
    "mimeTypes": [
      "text/csv",
      "application/csv"
    ],
    "identifiers": {
      "pronomPuid": "x-fmt/18",
      "specUrl": "https://datatracker.ietf.org/doc/html/rfc4180"
    },
    "binarySignature": {
      "endianness": "text",
      "magicBytes": [],
      "containerFamily": "text",
      "headerLayout": [
        {
          "offset": "0x00 (opt)",
          "byteOffset": 0,
          "byteLength": 3,
          "lengthLabel": "0 or 3 B",
          "dataType": "uint8[3]",
          "fieldName": "utf8_bom",
          "description": "Optional Excel UTF-8 BOM (EF BB BF)"
        },
        {
          "offset": "Row 1",
          "byteOffset": 0,
          "byteLength": 24,
          "lengthLabel": "var",
          "dataType": "utf8",
          "fieldName": "header_record",
          "description": "Comma-delimited column names terminated by LF or CRLF"
        }
      ]
    },
    "securityProfile": {
      "riskLevel": "medium",
      "allowsArbitraryCodeOrMacros": false,
      "xxeRisk": false,
      "polyglotPrependRisk": false,
      "pickleDeserializationRisk": false,
      "uploadValidationNotes": "Guard against CSV Formula Injection (DDE): sanitize or prefix cells starting with '=', '+', '-', or '@' when exporting user-uploaded CSVs back to Excel/Sheets."
    },
    "codeSnippets": {
      "python": "import csv, sys\nwith open(sys.argv[1], \"r\", encoding=\"utf-8-sig\", newline=\"\") as f:\n    reader = csv.reader(f)\n    headers = next(reader)\n    print(f\"CSV columns ({len(headers)}): {headers}\")",
      "typescript": "export async function previewCsvHeader(file: File) {\n  const raw = new Uint8Array(await file.slice(0, 4096).arrayBuffer());\n  const hasBom = raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf;\n  const text = new TextDecoder().decode(hasBom ? raw.subarray(3) : raw);\n  return { hasBom, firstLine: text.split(/\\r?\\n/)[0] };\n}",
      "rust": "use std::{fs::File, io::{BufRead, BufReader}};\nfn main() -> std::io::Result<()> {\n    let mut s = String::new();\n    BufReader::new(File::open(std::env::args().nth(1).expect(\"usage: <prog> <file>\"))?).read_line(&mut s)?;\n    println!(\"CSV header: {}\", s.trim_start_matches('\\u{feff}').trim());\n    Ok(())\n}",
      "go": "package main\nimport (\"encoding/csv\"; \"fmt\"; \"os\")\nfunc main() {\n    f, err := os.Open(os.Args[1])\n    if err != nil {\n        fmt.Fprintln(os.Stderr, \"open:\", err)\n        os.Exit(1)\n    }\n    defer f.Close()\n    rec, err := csv.NewReader(f).Read()\n    if err != nil {\n        fmt.Fprintln(os.Stderr, \"csv:\", err)\n        os.Exit(1)\n    }\n    fmt.Println(\"Columns:\", len(rec))\n}"
    },
    "relatedFormats": [
      "jsonl",
      "parquet",
      "xlsx"
    ],
    "verifiedAt": "2026-11-14T16:09:03Z"
  },
  "samples": [
    {
      "id": "csv-minimal",
      "filename": "minimal-rfc4180.csv",
      "variant": "minimal",
      "title": "Minimal RFC 4180 UTF-8 CSV",
      "description": "Clean 2-row comma-separated table with LF line endings and no BOM.",
      "localPath": "/fixtures/v1/csv/minimal-rfc4180.csv",
      "cdnUrl": "https://fileformat.co/fixtures/v1/csv/minimal-rfc4180.csv",
      "sizeBytes": 89,
      "sha256": "05718c2daf0ae301a68f435f20cbb9feb8f079fae27efc908a41c41a86daba62",
      "expectValid": true
    },
    {
      "id": "csv-realistic",
      "filename": "orders-unicode-quoted.csv",
      "variant": "realistic",
      "title": "Quoted Commas & CJK Unicode CSV",
      "description": "Realistic UTF-8 CSV containing quoted commas, whitespace padding, and Japanese characters.",
      "localPath": "/fixtures/v1/csv/orders-unicode-quoted.csv",
      "cdnUrl": "https://fileformat.co/fixtures/v1/csv/orders-unicode-quoted.csv",
      "sizeBytes": 230,
      "sha256": "8dcc3d4302a7e62ad485797bc492f9d5217e8a919469109eed8af219eb4e1354",
      "expectValid": true
    },
    {
      "id": "csv-edge-case",
      "filename": "utf8-bom-multiline-escaped.csv",
      "variant": "edge-case",
      "title": "UTF-8 BOM + Multiline CRLF Quoted Cell + Escaped Quotes",
      "description": "Classic parser breaker: starts with `EF BB BF` BOM, uses `\\r\\n` inside quoted cells, doubled `\"\"` escapes, and ZWJ emoji.",
      "localPath": "/fixtures/v1/csv/utf8-bom-multiline-escaped.csv",
      "cdnUrl": "https://fileformat.co/fixtures/v1/csv/utf8-bom-multiline-escaped.csv",
      "sizeBytes": 158,
      "sha256": "1550b6c3787e1ad84d709a50341f88dbd2b5ae5a96e5e620e3459a82d0392a5f",
      "expectValid": true,
      "edgeCaseTag": "UTF-8 BOM + Multiline Quotes"
    }
  ]
}