best 14 session replay tools

clarity's faq is unusually blunt: 'content in the input boxes is masked in all modes and can't be customized'. no configuration, no flag, no enterprise override. everything else in this category is a default you can weaken; this is a constraint. for an organisation where the snippet will be installed by whoever picks up the ticket, that distinction is worth more than any feature.

the rest holds up. there is a native consent api, third-party cmp support, and microsoft requires explicit consent for eea, uk and swiss visitors — enforced by degrading the product rather than by trust. without a consent signal, session continuity breaks and each page view becomes a new session, so replay stops working properly rather than quietly continuing. eu customers contract with microsoft ireland, with standard contractual clauses covering transfers. the client-side capture sdk is open source under mit; the backend is not.

the thing to understand before adopting it is why it costs nothing. clarity is free with no traffic ceiling in a category where competitors charge $300 a month at the same volume, and the reason is that clarity behaviour data feeds microsoft advertising — advertisers see what happens on a landing page after a click on a microsoft ad. microsoft states it does not sell the data to advertisers, and clarity honours global privacy control and the digital advertising alliance opt-out. it is still a structural conflict: the product's incentive is to exist inside an ad platform, not to serve you as a paying customer. retention terms are also not published anywhere we could find, which is a real gap for anyone with a compliance window to satisfy.

most masking in this category is a promise about what a vendor's servers do with data that has already been transmitted. contentsquare's automatic personal data redaction runs in the tracking tag: emails, jwts, oauth tokens and credit card numbers are detected and removed in the browser, before any request leaves the client. that is a materially different guarantee — the unmasked value never exists on someone else's infrastructure.

the defaults underneath are also right. the tag does not capture the values of pre-filled input or textarea fields and does not collect what the user types, with all-pages masking applied by default on every project. eu customer data is stored in eu data centres, enterprise plans add configurable residency for sovereignty requirements, and the company is iso 27701 certified as both controller and processor and acts as its own gdpr article 27 representative.

the free tier is the outlier fact: 200,000 sessions a month at no cost, which covers the 100,000-session benchmark this page uses twice over. that number arrived with the hotjar merger, and the merger is also the caveat — contentsquare is currently absorbing another product's users and pricing, and unified pricing that generous is not obviously permanent. retention windows and the exact consent-gating default are spread across help-centre articles rather than stated in one place, which took cross-referencing to establish and still left gaps.

the docs state the reasoning plainly: 'as any input element is highly likely to contain sensitive text such as email or password, we mask these by default'. `maskAllInputs` is true until you set it false. that is the right posture, and posthog is one of the few here that explains why rather than listing it as a feature.

eu or us region is selectable at signup on every plan, including the free one — most competitors gate eu residency behind enterprise. pricing is genuinely computable rather than quoted: the published per-recording tiers work out to $272.50 for 100,000 web sessions a month, which we can show the arithmetic for, unlike five other vendors on this page. mobile replay is billed separately and starts higher, at $0.0100 a recording.

two things to know. most of the codebase is mit, but the `ee/` directory is separately proprietary — 'open source' here does not mean the whole feature set is unencumbered, and self-hosting gets you the core rather than everything. and retention is 1 year on the pure free plan, extending to 7 years only once a credit card is attached to the account, which catches teams sitting under the free session quota deliberately. we could not confirm whether recording is consent-gated by default; it appears to capture on load unless you wire a gate yourself.

everyone in this category says they mask pii. quantum metric does something categorically different: pii is pseudonymised at capture using an encryption key held locally by the customer, and the vendor states it never has access to the private key. only a customer admin holding that key can re-identify a user within a session. that is a structural guarantee rather than a policy one — it does not depend on quantum metric's internal controls, employee access rules or future ownership.

the masking layer on top is thorough too: automatic blocking of health data, card and payment details, cvv numbers, passwords and one-time passcodes, with an admin interface for reviewing flagged pii, masking it directly or dismissing false positives and re-scanning going forward. that review loop is something the cheaper tools do not have at all.

the cost of all this is that you cannot evaluate it. there is no free tier, no trial, no published rate, and no self-serve entry point — pricing depends on annual session volume, digital properties, add-on modules and professional services, all negotiated. retention, data residency and consent integration are likewise undocumented publicly. for a mid-sized team this is unbuyable in any practical sense; for a bank it is the entry it should probably shortlist first.

datadog does the one thing almost nobody else does: it puts a floor under the configuration. if the privacy setting is not specified, `mask` — the strictest level — is applied. and regardless of what level you then choose, input elements of type password, email and tel, plus anything carrying an autocomplete attribute for card number, expiry or security code, are always masked. a developer who loosens the setting to debug something cannot accidentally expose a card field. that is a better safety model than 'we default to safe and trust you'.

eu residency is real and available to all paying customers — datadoghq.eu runs in frankfurt — though some replay sub-features have site-specific availability limits worth confirming for your region. the value proposition is the correlation: a replay sits next to the trace, the log line and the host metric, which no standalone replay tool can match.

forecasting the bill is the problem. rum is metered as at least three separate products — measure per session, investigate per indexed session, replay per replayed session — so a single per-session comparison against mouseflow or posthog understates it. and we could not get the per-tier figures off datadog's own pricing page in this pass; the numbers above came from a third-party aggregator and should be confirmed directly before you budget against them. consent integration is likewise undocumented on datadog's own pages, and third-party gdpr guides suggest replay needs separate consent from base rum.

both `maskAllText` and `maskAllInputs` default to true. sentry masks more than most — not just input values but all text content — before anything reaches the server, and you have to explicitly set both to false to see anything. for a debugging tool that is a defensible trade: you get the interaction sequence and the error, not the customer's data.

the eu data region in frankfurt is generally available across all plans including the free developer tier, which is unusual — most competitors treat eu residency as an enterprise upsell. the choice is permanent per organisation, so you pick it at creation or create a new org later. the real draw is the linkage: a replay is automatically attached to the error that triggered it, so you are watching the thirty seconds before the exception rather than searching for the session.

two things stopped this ranking higher. we could not extract the per-replay overage rate from sentry's own pricing page, so the cost estimate above came from secondary aggregators and should be treated as approximate — verify it before budgeting. and the licence position on the self-hostable server is genuinely unclear without reading the current licence file: sentry's sdks are permissive, but the main server has historically been under a business source licence, and we did not confirm today's terms. free-tier retention is also 30 days against 90 on paid plans, and retention is fixed at ingestion, so upgrading later does not extend data you already collected.

hotjar's defaults are better than its reputation. the docs state 'by default, hotjar suppresses user input' — keyboard input into forms is suppressed unless explicitly allowed. on top of that it attempts to auto-detect sensitive field types, including names, addresses, phone numbers, passwords and credit cards, and suppresses text written into them. it also suppresses sequences of numbers by default, without you enabling separate numeric suppression, which catches card and phone numbers typed into fields it did not recognise.

data is stored in ireland on aws eu-west-1, which is a confirmed eu location rather than a contractual arrangement, and the tool remains the most approachable in the category for non-engineers — heatmaps, recordings and surveys without a developer in the loop.

the reason it sits seventh rather than second is that hotjar as an independently priced product is gone. its own pricing page 308-redirects to contentsquare, and its plans are now contentsquare's plans. the backend is likely to follow. you can still buy the capability — and inside the merged 200,000-session free tier it costs nothing at this page's benchmark — but you are buying contentsquare with hotjar's interface on it, and what that product looks like in a year is not something either company has published. retention terms and the consent-gating default we could not pin down at all.

most tools mask inputs. highlight masks inputs and then goes looking: by default it 'will obfuscate all inputs and any text that matches commonly used regex expressions of personally identifiable information', naming emails, ssns, phone numbers, credit card numbers, unformatted 9-16 digit sequences, addresses and ip addresses. that catches the case the input-only maskers miss entirely — pii rendered onto the page rather than typed into it, like an order confirmation showing the customer's address back to them.

the controls are granular: a `strict` setting for more aggressive masking, `none` to disable, and css classes (`highlight-ignore`, `highlight-block`, `highlight-mask`) for element-level overrides. most of the repo is apache 2.0, with the `highlight.io/` and `enterprise/` directories under separate licences.

pricing is where it falls down for this comparison. the $50 base tier covers 500 sessions with three months of retention — two orders of magnitude below the 100,000-session benchmark — and beyond it you are into per-unit overages across sessions, errors, logs and traces, computed through a cost estimator rather than a rate card. there is no way to state what this costs at volume without running their calculator or talking to sales. no eu-hosted region is confirmed either; self-hosting is the answer to residency here, not a region toggle.

glassbox uses a whitelisting approach: all input fields are masked or blocked by default and you allow specific ones through, which is the correct direction of travel for a regulated buyer. the company describes patented real-time masking that detects and omits pii and pci data out of the box, client-side and server-side, across web and mobile. it holds iso 27701 for privacy management and is positioned squarely at hipaa, glba, pci, ccpa and gdpr use cases.

for a bank, the certification matters as much as the feature. iso 27701 is an audit of the vendor's own privacy management system, not a claim about the product, and it is the kind of evidence a procurement team can actually act on.

the difficulty is that we could not verify much of this from glassbox's own pages. there is no public pricing at all, and the masking description above came via secondary sources reporting glassbox's positioning rather than from a primary vendor doc we could read. retention, data residency, consent integration and the exact scope of the whitelist are all undocumented publicly. the cost estimates circulating — roughly $3,000 to $12,000 a month, contracts from around $15,000 a year, implementation from $15,000 to $50,000 — are third-party figures and should be treated as industry rumour, not quotes. this ranking reflects a good architecture we mostly had to take on trust.

form privacy is enabled automatically on all accounts and applies six element rules without anyone configuring anything: input, textarea, select and contenteditable elements are masked, so clicks and changes are captured but the text values are not, and radio and checkbox elements are excluded entirely — neither text nor interaction. developers create exceptions to let a search box through rather than opting into protection, which is the right way round.

the free tier is the most usable evaluation path in the category after clarity: 30,000 sessions a month with twelve months of retention and up to ten users. twelve months of retention on a free plan is longer than sentry gives paying customers.

beyond that you are in the dark. every paid tier — business, advanced, enterprise — is 'request pricing and demo' with no published rate, so the cost at 100,000 sessions a month is unknowable without a sales call. we also could not confirm an eu data residency option anywhere on the site; the company has a london office, which is not the same thing. and while the generic element rules are clear, how they apply to custom javascript-rendered input components is something you would need to verify on your own site rather than read.

mouseflow publishes what almost nobody else here does: a rate card with session volumes attached. essential at $25 covers 5,000 sessions, advanced at $109 covers 25,000, premium at $319 covers exactly 100,000. no estimator, no sales call, no componentised meters. for this page's benchmark that is $3.19 per thousand sessions, and it is the only figure on the list we could state without a caveat.

masking covers the categories that carry the most risk automatically: password fields have their interaction captured but content never recorded, and credit card numbers and cvv codes are masked by default. the visual privacy tool lets non-developers mark up fields to reveal or further restrict without touching code, which is genuinely useful for a marketing team.

retention is welded to the tier rather than configurable — one month on free, three on essential, six on advanced, twelve on premium — so a team that wants a year of history has to buy the 100,000-session plan whether or not they have the traffic. and the compliance picture is simply absent: no consent-management integration documented, no data residency stated, nothing on what mouseflow does with the data. against posthog offering eu hosting on its free tier, that silence is what keeps this eleventh rather than sixth.

self-hosting solves problems the saas tools can only promise around. you choose the jurisdiction, you set retention, and no session data leaves your infrastructure at all. the core is agplv3 — genuine copyleft, so network use of modified code requires releasing source — with some directories mit and the `ee/` enterprise code separately proprietary. the managed dedicated tier starts at $199 a month for a dedicated vm in its own vpc, with unlimited recordings and retention, deployable across 50 regions or bring-your-own-cloud.

the defaults are the problem, and they are worse than they look at a glance. `obscureTextEmails` and `obscureInputEmails` are both true, so emails are masked in text and in inputs. but `obscureInputDates` is false and `obscureTextNumbers` is false — meaning dates and generic digit sequences are not masked unless a developer explicitly turns those options on. `obscureTextNumbers` is the setting that would catch card-number-shaped strings. general non-email text and input content is not masked either.

so a default openreplay install protects email addresses and records more or less everything else as typed. against posthog masking all inputs by default under a comparably permissive licence, that is a hard difference to justify, and it is the reason a genuinely good self-hosting story ranks twelfth. if you deploy this, budget the configuration work first — the settings exist and are documented, but nothing prompts you to use them.

as a debugger it is the strongest thing here. network requests, redux and application state, console output — all correlated with the replay, so you reconstruct what the code was doing rather than only what the user saw. for a frontend team chasing an intermittent bug, that is a genuinely different product from the ux-oriented tools.

the privacy default is the problem, and it is not a subtle one. the docs state that password fields are never recorded — and that is the extent of it. everything else is captured as typed unless a developer adds a `data-private` attribute to the element. the exclusion model is explicitly per-element: you mark what to hide. that means every form logrocket was not specifically told about — a search box, a non-password auth field, a custom card-entry widget that does not use `type=password`, an address field, a free-text medical note — is recorded verbatim.

in a category where nine of the fourteen tools mask by default, opting in per element is a choice, and it is one that fails open in exactly the situation that matters: an install nobody revisited. pricing compounds it — the tiers run from 25,000 to 4 million sessions a month with no per-tier rates published, so we cannot say what 100,000 sessions costs. eu data residency exists only on enterprise. we would install this behind a deliberate masking pass and a review, or not at all.

smartlook's default was the strictest in this category and it is worth recording before the product disappears. the docs state 'by default, no inputs or forms are visible in recordings' and that the sdk 'does not record anything the visitor enters' unless explicitly enabled through the record api. even with form recording turned on, passwords and credit card numbers were never captured — a typing-animation placeholder was shown instead. that is a harder floor than datadog's and a stricter default than clarity's, because it covered forms wholesale rather than input values.

none of which you can buy. cisco and splunk are winding the product down on a published timeline: end of sale was 31 may 2026, contract renewals stop on 31 august 2026, support ends 31 august 2027, and the platform is decommissioned with customer data deleted on 30 september 2027. existing paid subscriptions run to their term and then drop to the free plan until that final date. the capability is migrating into splunk's digital experience analytics inside splunk observability cloud, which is a different product with different pricing and a different buyer.

it ranks last not because it is bad but because ranking a product you cannot purchase above one you can would be dishonest. if you are already on it, the date that matters is 30 september 2027 — after that the data is gone, so plan the export well before then. if you are evaluating it because a comparison article listed it, this is the entry that tells you not to.