# report-sha256 keyword (/en/docs/web-security/policies/content-security-policy/values/report-sha-keyword)



The `'report-sha256'`, `'report-sha384'`, and `'report-sha512'` keywords ask the
browser to compute and report a hash of each inline and external script it loads,
without blocking anything. Unlike a normal
[hash source](/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce),
which allows a script whose digest you already know, these report-only keywords
flip the direction: the browser tells you what it ran by emitting a `csp-hash`
report. That is the mechanism behind the CentralCSP
[script inventory and SBOM](/platform/csp-builder).

<Callout type="warn" title="Chromium-only, in standardization">
  These keywords ship stable in Chromium, enabled by default, and they are in the CSP3 editor's draft grammar. Firefox and Safari have not implemented them or signaled support, so the inventory they produce covers Chromium users only. See the Browser support section below.
</Callout>

A report-only collection policy, as you would ship it:

```http
Content-Security-Policy-Report-Only:
    script-src 'report-sha256';
    report-to csp-endpoint
```

## Syntax [#syntax]

Each keyword is a single-quoted token placed in a script directive, usually
`script-src`, and is meant for the
[Report-Only header](/en/docs/web-security/policies/content-security-policy/report-only)
so it never affects enforcement.

The number names the digest algorithm: `'report-sha256'`, `'report-sha384'`, or
`'report-sha512'`. The browser hashes each script with that algorithm and includes
the result in a report.

| Value             | Status          | Description                                             |
| ----------------- | --------------- | ------------------------------------------------------- |
| `'report-sha256'` | 🧪 Experimental | Report each script's SHA-256 digest. Chromium-only.     |
| `'report-sha384'` | 🧪 Experimental | The same reporting with SHA-384 digests. Chromium-only. |
| `'report-sha512'` | 🧪 Experimental | The same reporting with SHA-512 digests. Chromium-only. |

## What it does [#what-it-does]

When a directive contains a `'report-sha...'` keyword, the browser computes the
digest of every script it loads under that directive and sends a `csp-hash` report
for each one to the configured endpoint. It does not change whether the script
runs; collection is the only effect. Over time the stream of reports describes
every script that actually executed on real page loads, inline and external,
including ones added by third-party tags at runtime.

```http
Reporting-Endpoints: csp-endpoint="https://<Endpoint-ID>.report.centralcsp.com"
```

## The csp-hash report [#the-csp-hash-report]

The browser delivers these through the Reporting API as reports of type
[`csp-hash`](/en/docs/web-security/reporting-api/reports/csp-hash). Each report carries the script's hash and enough context to identify
the resource. The keyword and the report are in the CSP3 editor's draft, but no
second engine has implemented them yet, so the details could still evolve before
multi-vendor agreement.

This is what powers a script inventory: by matching reported hashes against known
libraries, CentralCSP builds a software bill of materials (SBOM) for each page,
detects the technology and version behind each script, and flags known CVEs,
without you maintaining a hash allowlist by hand.

## What it protects against [#what-it-protects-against]

On its own the keyword enforces nothing; its value is visibility. Knowing exactly
which scripts run on a page, especially the third-party and dynamically injected
ones a manual review misses, is the input to detecting an unexpected or tampered
script, which is the client-side change-detection problem behind PCI DSS v4
requirements 6.4.3 and 11.6.1. CentralCSP uses that signal for
[script monitoring and alerting](/platform/csp-builder).

## Known limitations [#known-limitations]

This is a reporting aid, not a control: it cannot block a malicious script, only
report that one ran. Because it is Chromium-only, the inventory it produces
reflects Chromium users; Firefox and Safari visitors generate no `csp-hash`
reports. Pair it with an enforcing policy (nonces, hashes, `'strict-dynamic'`)
for actual protection.

## Risks [#risks]

The reporting volume can be high on script-heavy pages, since every script load
produces a report; sample or aggregate at the endpoint rather than storing each
one raw. Do not mistake report coverage for enforcement: a page can be fully
inventoried and still allow inline injection if the enforced policy is weak.

## Examples [#examples]

Collect script hashes in report-only mode while an enforcing policy runs
separately:

```http
Content-Security-Policy: script-src 'self' 'nonce-r4nd0m' 'strict-dynamic'
```

```http
Content-Security-Policy-Report-Only:
    script-src 'report-sha256';
    report-to csp-endpoint
```

## Recommendation [#recommendation]

Add `'report-sha256'` to `script-src` in a
[Report-Only policy](/en/docs/web-security/policies/content-security-policy/report-only),
next to your enforced policy, so hash collection never affects what runs.

```http
Content-Security-Policy-Report-Only:
    script-src 'report-sha256';
    report-to csp-endpoint
```

The report stream gives you a continuous inventory of every script that actually
executes on real page loads, which is what the CentralCSP
[script inventory and SBOM](/platform/supply-chain) is built from. It costs
nothing in enforcement and works today for your Chromium traffic.

## Browser support [#browser-support]

Stable in Chromium-based browsers (Chrome, Edge), enabled by
default, on desktop, Android, and WebView. Not an origin trial: a separate origin
trial covers a different feature, URL and eval hashes in `script-src`.
Firefox and Safari have not implemented the keywords or signaled support. The
keywords are in the CSP3 editor's draft grammar, so they are on a standards
track but not yet a multi-vendor standard.

## See also [#see-also]

* [Hashes and nonces](/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce)
* [Keywords](/en/docs/web-security/policies/content-security-policy/values/csp-keywords)
* [Report-Only header](/en/docs/web-security/policies/content-security-policy/report-only)
* [script-src directive](/en/docs/web-security/policies/content-security-policy/directives/script-src)
* [csp-hash report](/en/docs/web-security/reporting-api/reports/csp-hash)
* [The CSP report-sha keywords explained](/en/blog/csp-report-sha-keywords)

## Sources [#sources]

* [W3C, Content Security Policy Level 3, hash sources](https://w3c.github.io/webappsec-csp/#framework-directive-source-list)
* [MDN, Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy)
* [Chrome, Content security policy](https://developer.chrome.com/docs/privacy-security/csp)
* [Chrome Platform Status, hash reporting for scripts](https://chromestatus.com/feature/6337535507431424)
* [Chrome blog, hashes in script-src](https://developer.chrome.com/blog/script-src-hashes)