Why your CSV export adds an apostrophe

A leading apostrophe in an exported CSV can be deliberate. CozyToolkit adds it to certain formula-like values when Protect CSV from spreadsheet formulas is enabled. That option is on by default.

For example, the text =1+1 becomes '=1+1. This helps prevent a spreadsheet from interpreting the value as a formula. It also changes the underlying data, so a later CSV-to-JSON conversion will keep the apostrophe.

Export four ordinary-looking values

Download the sample JSON and upload it to the CSV, JSON & YAML converter. Set From to JSON and To to CSV. Open Options and leave Protect CSV from spreadsheet formulas enabled.

The sample has four labelled values. In the Code output, the exported fields are:

Use Download to save the CSV, or inspect the checked export. The sample uses a harmless arithmetic expression, a handle and an offset to make the transformation easy to see.

The Table tab previews the input records. Use Code or the downloaded CSV to inspect the apostrophes added during export; the input table is not a preview of those escaped strings.

CSV quotes do a different job

The outer double quotes belong to CSV syntax. A CSV parser removes them when it reads the field. The apostrophe inside those quotes is part of the field's value and survives parsing.

Choose Use result as input to convert the exported CSV back to JSON. With number detection off, the first value is now "'=1+1", not "=1+1". The round-trip JSON shows all four results. This is an intentional data change, not a broken quotation mark.

If a downstream system needs the original strings exactly, keep the source JSON. Do not remove every leading apostrophe indiscriminately: some may have been part of the original data.

Know what this option checks

The converter uses Papa Parse's formula-escaping option. It prefixes values beginning with =, +, -, @, a tab or a carriage return. That includes benign values such as handles and negative-number strings; the option does not decide whether each value is malicious.

This is a limited export precaution, not a guarantee that any spreadsheet can safely open any CSV. The current check does not cover every possible prefix, including a leading line feed or full-width variants of those symbols. Spreadsheet import settings differ, and saving then reopening a CSV can change its escaping. OWASP explains these CSV-injection limitations.

For untrusted data, import through the spreadsheet's text-import controls, explicitly treat the relevant columns as text, and inspect the result. Verify the behavior in the application and version that will receive the file.

Keep exact-data exports separate from spreadsheet exports

When a trusted machine-to-machine workflow requires the exact original strings, disabling the protection avoids these added apostrophes. Keep that copy separate from files people will open in a spreadsheet. JSON is often the clearer handoff when you do not need a table file at all.

Our results record compares protection on and off using the actual converter on 2 November 2026. It confirms the exported text and the values read back by the parser. It does not claim that Excel, LibreOffice or another spreadsheet was tested, or that formula escaping makes an untrusted file universally safe.