Report File Formats

Choose the format in Report Format before a scan. HTML is the default and the only format with screenshots, tickets and editing. CSV and JSON are for spreadsheets, scripts and other tools. For the features of the HTML report, see Report Anatomy. For where report files are kept, see Where files are kept.

1. CSV format

You get a CSV report when:

• Report Format is set to CSV.
• A scan makes an HTML report. A companion CSV with the same results is saved beside it.
• An HTML report would be too large for the available memory, so a CSV is made instead. See A CSV report was produced instead of HTML.

Layout

• Encoding: UTF-8 with a byte order mark, so spreadsheet apps detect the encoding.
• Line endings: Windows-style (CRLF).
• Preamble: The file starts with three lines of text and a blank line. The column headings are on line 5.
• Rows: One row for each element that has an issue, on each page and viewport. An issue found on 40 elements gives 40 rows. After these come rows for Local LLM suggestions, manually added issues, PDF issues, PDFs that couldn't be checked, pages that weren't fully scanned and skipped pages.
• Quoting: A value that contains a comma, a double quote or a line break is wrapped in double quotes, and quotes inside it are doubled.
• Formula protection: A value that starts with =, +, - or @ (even after spaces), a tab or a line break gets a leading apostrophe and is wrapped in quotes, so a spreadsheet can't run it as a formula.

The three preamble lines are:

1. Generated by Octopus Scanner followed by the app version.
2. Confidential. Do not share this report without authorisation.
3. Not a substitute for manual review or legal compliance. Octopus Scanner is not affiliated with or endorsed by the scanned content.

If the scan stopped early, a fourth line starting Scan stopped early: gives the reason, such as memory running low.

Columns

Needs Review items are included only when Include Needs Review Section is on. The CSV doesn't contain PDFs that passed every check. Use the HTML or JSON report for those.

Manual issue, PDF, scan error and skipped page rows

• Manual issues: Issue ID is manual- followed by a number, Description is the description you entered, URL/File, CSS Selector and WCAG Tags hold the address, selector and WCAG criteria you entered, Help URL holds the evidence link and Source is Manual.
• PDF issues: Issue ID is the PDF check, such as pdf-not-tagged, pdf-no-text, pdf-image-no-alt or pdf-no-language.
  • The full list is in PDF checks.
  • Description gives the issue and what was found, URL/File is the PDF's address, Help URL links to the WCAG technique or criterion, WCAG Tags lists the criteria, How to Fix gives the fix and Source is PDF check.
  • The viewport, selector and snippet columns are empty.
• PDFs that couldn't be checked: Issue ID is pdf-not-checked, Description reads PDF not checked: [reason], URL/File is the PDF's address and Source is PDF check.
• Scan errors: Issue ID is error- followed by the error type, such as error-scan_error. Description reads Page not fully scanned ([type]): [message], URL/File is the page, Viewport is the viewport if known and Source is Scan error.
• Skipped pages: Issue ID is skipped- followed by the category, Description reads Skipped ([category]): [reason], URL/File is the skipped address and Source is Skipped page. The other columns are empty. The categories are described in Skip categories.

Example

The first lines of a CSV report look like this. The values are made up.

Generated by Octopus Scanner x.y.z
Confidential. Do not share this report without authorisation.
Not a substitute for manual review or legal compliance. Octopus Scanner is not affiliated with or endorsed by the scanned content.

Issue ID,Description,Impact,URL/File,Viewport,CSS Selector,HTML Snippet,Help URL,WCAG Tags,How to Fix,Source,LLM Review
image-alt,Ensure images have alternative text,critical,https://example.com/menu,Desktop_1280x800,.hero > img,"<img src=""/hero.jpg"">",https://docs.example.com/rules/image-alt,cat.text-alternatives wcag2a wcag111,Element does not have an alt attribute,axe-core,
link-name,Ensure links have discernible text,serious,https://example.com/,Desktop_1280x800,.social > a:nth-child(2),"<a href=""https://example.com/shop""></a>",https://docs.example.com/rules/link-name,cat.name-role-value wcag2a wcag244,Element is not focusable,axe-core,

Opening the CSV in a spreadsheet

• Skip the preamble: When you import the file, start at row 5 so the column headings become the header row. If you open the file directly, delete rows 1 to 4 before you sort or filter.
• Import as text if values change: Some apps turn values that look like dates or numbers into something else. Importing every column as text keeps them as written.
• Expect apostrophes: A value that started with =, +, - or @ keeps its added apostrophe. Remove it only if you're sure the value is safe.
• Count unique issues with a pivot table: Group by Issue ID for issue types, or by URL/File for the pages with most problems.
• Use a script for very large files: A CSV made because the HTML report was too large can have more rows than a spreadsheet app can open.

ABCD 1Issue IDDescriptionImpactURL/File 2image-altEnsure images have alternative textcriticalhttps://example.com/menu 3link-nameEnsure links have discernible textserioushttps://example.com/

Text description: CSV report opened in a spreadsheet

Example of a spreadsheet with column letters A to D. Row 1 holds the headings Issue ID, Description, Impact and URL/File. Row 2: image-alt, Ensure images have alternative text, critical, https://example.com/menu. Row 3: link-name, Ensure links have discernible text, serious, https://example.com/.

CSV files exported from an HTML report

The HTML report has its own CSV downloads. They use a slightly different layout:

• Export as CSV: the same three preamble lines, without any Scan stopped early: line, and the same twelve columns, with the column headings in quotes.
  • It also includes manual issue, PDF issue and skipped page rows, and every instance of every rule.
  • For rules where the report keeps only a sample of a very large number of matches, the full list comes from the companion CSV, with any severity you changed in the report. That needs the report open from Octopus Scanner. A report opened straight from its folder in a browser can't read the companion CSV, so it lists the sample and adds a note row naming those rules.
  • Issues you have removed or hidden in the report are left out.
  • The file name ends in _instances.csv.
• Ticket instance CSV: from a ticket, with the columns Issue ID, Page URL, Viewport, CSS Selector, HTML Snippet and Failure Detail, after the same three preamble lines and a blank line.
  • When the report is open from Octopus Scanner, it lists every instance of the issue.
  • A saved copy opened from a folder lists the instances kept in the report and adds a line pointing to the companion CSV.
  • The file is named ticket-[issue ID]-instances.csv.

2. JSON format

A JSON report is a single object. The example below shows its top-level keys with made-up values, shortened.

{
  "_notice": {
    "generator": "Octopus Scanner x.y.z",
    "confidential": "Do not share this report without authorisation.",
    "disclaimer": "Not a substitute for manual review or legal compliance. Octopus Scanner is not affiliated with or endorsed by the scanned content."
  },
  "scanUrl": "https://example.com/",
  "timestamp": "2026-10-17T09:30:00.000Z",
  "results": {
    "https://example.com/::Desktop_1280x800": [
      {
        "id": "image-alt",
        "impact": "critical",
        "tags": ["cat.text-alternatives", "wcag2a", "wcag111"],
        "description": "Ensure images have alternative text",
        "helpUrl": "https://docs.example.com/rules/image-alt",
        "nodes": [
          {
            "html": "<img src=\"/hero.jpg\">",
            "target": [".hero > img"],
            "failureSummary": "Element does not have an alt attribute"
          }
        ]
      }
    ]
  },
  "manualIssues": [],
  "pdfResults": [
    {
      "url": "https://example.com/menu.pdf",
      "isTagged": false,
      "error": null,
      "checks": {
        "tagged": { "status": "fail", "detail": "No tags (/StructTreeRoot) found." },
        "title": { "status": "pass", "detail": "Title: \"Lunch menu\"" }
      },
      "findings": [
        { "id": "pdf-not-tagged", "name": "PDF is not tagged", "impact": "serious", "wcag": "1.3.1" }
      ]
    }
  ],
  "errors": {
    "https://example.com/shop": { "type": "SCAN_ERROR", "message": "…", "viewport": "Desktop_1280x800" }
  },
  "skipped": {
    "https://example.com/blog/feed.xml": { "reason": "Skipped non-HTML asset", "category": "not-a-page" }
  },
  "screenshotPaths": {},
  "screenshotFilenames": {},
  "environment": {
    "axeVersion": "x.y.z",
    "browserVersion": "x.y.z",
    "scanOs": "darwin",
    "viewports": ["Desktop_1280x800"]
  }
}

Keys

• _notice: The generator, confidentiality and disclaimer text, the same as the CSV preamble. If the scan stopped early, stoppedEarly gives the reason.
• scanUrl: The address the scan started from.
• timestamp: When the report was written, in ISO 8601 format (UTC).
• results: One entry for each page and viewport, keyed as [address]::[viewport]. Each value is a list of axe-core violations with their affected elements in nodes. Passed rules aren't included. Needs Review items appear here with "impact": "needs-review" when Include Needs Review Section is on.
• manualIssues: Issues added by hand, if any. Usually an empty list.
• pdfResults: One entry for each PDF checked when Check PDFs is on, with isTagged and any error.
  • A PDF that could be read also has checks, with a status of pass, fail, unknown (couldn't be checked) or not-applicable (not checked) and a detail for each of tagged, text, accessPermission, title, displayTitle, language, figureAlt, headings, tableHeaders, formFields, links, tabOrder and bookmarks, and findings, one for each check that failed, with its id, name, description, impact, wcag, technique and recommendation.
  • The example is shortened.
  • See PDF checks.
• errors: Pages that couldn't be scanned, keyed by address, with an error type, a message and the viewport.
• skipped: Pages that were found but not scanned, keyed by address, with a reason and a category: bot-protection, http-error, auth (Sign-in required), robots, excluded, redirect, cap (Caps and duplicates), not-a-page, error (Timeout or error) or other. Every reason is explained in Messages and Skipped Pages, Skipped pages section.
• screenshotPaths and screenshotFilenames: Screenshot file names. Screenshot Mode is turned off for JSON reports, so these are usually empty.
• llmReview: Only when the optional Local LLM Review ran: the model, whether the server was on your computer or your local network, counts, the second opinions for each issue type and the items suggested for LLM Review. Each violation in results also carries an llm field with its second opinion.
• environment: The axe-core version, the browser version, the operating system the scan ran on (darwin for macOS, win32 for Windows) and the names of the viewports scanned.

The Export as JSON button in an HTML report produces a different file, named with _data.json. It holds the report's own data, grouped by issue rather than by page, with the same three preamble notices in _notice and no Scan stopped early: line, and leaves out issues you have removed or hidden.

3. File names

Every report is named the same way:

accessibility_report_[address]_[timestamp].[html|csv|json]

• [address]: The start address without http://, https:// or file:///, in lower case, with every character other than a letter or a number replaced by _, and cut to 50 characters.
• [timestamp]: When the report was created, as milliseconds since 1 January 1970 (UTC). It keeps names unique and sorts them in date order.

For example, a scan of https://www.example.com/menu could produce accessibility_report_www_example_com_menu_1792229400000.html.

Files that belong to an HTML report share its name, without the .html:

• Companion CSV: [name].csv, the same name with .csv in place of .html.
• Screenshots folder: [name]_screenshots, when screenshots are stored outside the report.
• Screenshots ZIP: [name]_screenshots.zip.

When you delete an HTML report in Past Reports, its screenshots folder and ZIP are deleted with it. If it has a companion CSV, Octopus Scanner asks whether to delete that too.

Don't rename reports in the reports folder. Past Reports lists only HTML, CSV and JSON files whose names start with accessibility_report_ and contain only letters, numbers, underscores (_), hyphens (-) and full stops (.). A renamed report no longer appears. Renaming a copy you share is fine.

4. Screenshots

Screenshots appear only in HTML reports. They are normally embedded in the report file, so one file holds everything.

When a scan has more than 400 screenshots, or more than 100 MB of them, they are saved in the [name]_screenshots folder beside the report instead. This keeps the report fast to open. The report shows a note naming the folder.

• Opened from Octopus Scanner: The screenshots load automatically.
• Opened from disk: Select Load Screenshots Folder at the top of the report, then choose the folder. This needs Google Chrome.
• Sharing: Send the folder, or the screenshots ZIP, with the report.

When screenshots are in a folder, the ZIP isn't saved to disk. It is built when you download it from Octopus Scanner. When screenshots are embedded, the ZIP is saved beside the report. See also Screenshots are in a folder instead of the report.

5. Integrity hash

Every HTML report shows a SHA-256 hash in its footer, labelled SHA-256. CSV and JSON reports don't have one.

• What is hashed: Octopus Scanner calculates the hash over every byte of the report file as it is written, except the 64-character hash itself. The space where the hash goes is left out of the calculation, and the hash is then written into that space.
• What it is for: It identifies the exact file Octopus Scanner produced. Any change to the file, however small, gives a different result, so it no longer matches the hash in its footer.
• Edited and re-saved copies: A copy saved with Save & Download HTML, with or without edits, keeps the original hash in its footer, relabelled Original SHA-256, but the file itself is different. The hash describes the original report, not the copy.

Octopus Scanner doesn't include a tool that checks the hash. Keep the original file if you may need to show later that a report hasn't changed.

6. Related guides

For how to read and act on the HTML report, see Report Anatomy and After Your Scan. For skip reasons and log messages, see Messages and Skipped Pages, top of the page.