CSV to Google Sheets
Google Sheets pastes tab-separated text straight into cells, and evaluates anything starting with =, +, - or @ as a formula. That is a wrong-value bug and a security hole in one. This page prefixes those cells with an apostrophe, which is the fix Sheets itself documents, so they land as the text you meant.
Try an example loads a sales table including a negative number, which is the case that catches people out.
The negative number problem, and the one behind it
Paste a cell containing -5 into Google Sheets and you get the number -5, which is probably fine. Paste one containing -Q3 revenue and Sheets tries to evaluate it as a formula and gives you #NAME?. Paste +44 20 7946 0018 and the phone number becomes an error too, because it starts with a plus.
That is the everyday version, and it is annoying. The version behind it is worse. A cell reading =cmd|'/c calc'!A1 is the CSV injection attack: a spreadsheet that evaluates it can be made to run a command or, more practically in a cloud spreadsheet, to exfiltrate data through a crafted IMPORTXML or HYPERLINK call. If your CSV came from user input anywhere, from a form, a support ticket, an upload, then it can contain one of these.
The fix is the same in both cases and it is the one Google documents: prefix the cell with a single apostrophe. Sheets treats the rest as literal text and does not store the apostrophe in the value, so the cell reads -Q3 revenue afterwards with nothing attached.
Worked example
In:
label,value,contact
Q3 change,-5,+44 20 7946 0018
Note,=SUM(A1:A9),ada@example.com
Total,120.50,@handleOut, with formula-safe quoting on:
label value contact
Q3 change '-5 '+44 20 7946 0018
Note '=SUM(A1:A9) ada@example.com
Total 120.50 '@handleFour cells were protected and a note names the count. In Sheets they read -5, +44 20 7946 0018, =SUM(A1:A9) and @handle, all as text, none evaluated. 120.50 and the email address were left alone because neither starts with a trigger character.
Turning it off, and what you are told when you do
Sometimes you genuinely want the formulas. A column of =A2*B2 that you are pasting deliberately is a real case, and the option exists for it.
Turn Formula-safe off and nothing is prefixed. The page then counts the cells that will be evaluated and warns you, naming the number, and specifically calls out the injection pattern if it sees one. That is the right shape for this control: safe by default, and an informed choice when you override it, rather than a silent switch.
Tabs and line breaks, same as any grid paste
Sheets reads the clipboard as tab-separated text, so a tab inside a cell splits it and a line break inside a cell starts a new row. Both are replaced with a space before the text reaches the clipboard, and the count is reported.
As with Airtable, quoting is not the fix. Sheets does honor quoting when you use File, Import with a real CSV file, and does not when you paste. The two paths behave differently and this page is built for the paste one.
Paste, or import?
| Paste (this page) | File, Import | |
|---|---|---|
| Speed for a few hundred rows | instant | several clicks and a dialog |
| Lands where your cursor is | yes | no, it replaces or adds a sheet |
| Honors CSV quoting | no, hence this page | yes |
| Evaluates formula-shaped cells | yes, unless protected | yes, and the same protection applies |
| Good for tens of thousands of rows | no | yes |
The row cap here is twenty thousand and it is editable. Past a few thousand the import is the better route, and the formula problem exists on that path too, so running the file through this page first is still worth doing.
Frequently Asked Questions
What is CSV injection?
A cell crafted to be executed by a spreadsheet that opens it. A value beginning with an equals, plus, minus or at sign is treated as a formula, and formulas can call out to the network or, in desktop spreadsheets, to the shell. If your CSV contains anything a user typed, it can contain one. Prefixing with an apostrophe neutralizes it, which is what this page does by default.
Will the apostrophe show up in my cells?
No. Sheets uses a leading apostrophe as a marker meaning treat this as text, and strips it from the stored value. The cell displays and exports without it. You will see it in the formula bar, which is Sheets telling you the cell is pinned as text.
My phone numbers lose their plus sign.
That is exactly what formula-safe quoting prevents, so make sure it is on. A cell reading +44 20 7946 0018 starts with a plus, which Sheets reads as a formula and turns into an error. With the option on it pastes as the text you meant.
What if I actually want the formulas evaluated?
Turn Formula-safe off. The page then counts the cells that will be evaluated and warns you, and specifically flags anything matching a known injection pattern. It is a deliberate override rather than a silent one.
Does this help with leading zeros too?
Partly. A ZIP code such as 01730 does not start with a trigger character, so it is not prefixed and Sheets will read it as the number 1730. Format the destination column as plain text before pasting, or use the CSV to Excel converter, which writes real text cells.
How many rows can I paste?
Twenty thousand by default and the cap is editable. Above a few thousand, File, Import is the smoother route, and running the file through this page first still protects you from the formula problem there.
Does anything I paste leave my computer?
No. There is no upload endpoint on this page and no network request in the code that does the work. JavaScript in your own tab reads the text, processes it and hands back the result. Nothing is stored between visits either, so reloading gives you an empty box again. You can confirm it by opening your browser's network panel and watching it stay quiet while you work.
Paste it without Sheets rewriting it
Free, no account, no upload. Safe by default, with a count of what was protected.
Back to the converter