How to Choose a Session Replay Tool: 12 Real Criteria
Pick a session replay tool on three things first: how granular its masking is, how much it captures relative to what you pay, and how long it keeps your data and on what terms. The rest is preference you can argue about later. And "masks by default" no longer earns anyone points. In 2026 that's table stakes, not a differentiator.
Start with the creepy line, not the feature list
A session replay tool records what your users type. Let that sit for a second. Before you ask what a tool can capture, ask what it refuses to capture, because the failure mode here isn't a missed insight. It's a support agent watching someone key in a credit card number that should never have left the browser.
I call the boundary between "helpful reconstruction" and "surveillance of a stranger" the creepy line. Every criterion below exists to defend it. When a vendor demo dazzles you with canvas recording and network waterfalls, the quiet question underneath is always the same: what happens to the field a user thought was private?
Client-side masking is what keeps you on the right side of that line. Datadog documents it plainly: "When data is masked, that data is not collected in its original form by Datadog's SDKs and thus is not sent to the backend." That's the bar. Masked content should die on the device, not travel to a server and get redacted in a dashboard you have to trust.
So the three deciding criteria are masking granularity, capture depth versus cost, and retention economics. The other nine matter, but they rarely flip a decision on their own. If you want the deeper privacy mechanics, we cover them in masking PII without losing the insight.
How to use this rubric
Here's the method, because a flat checklist lies to you. It pretends every criterion weighs the same, and it doesn't.
Give each of the 12 criteria a weight from 1 to 3 based on your product. A checkout-heavy SaaS weights masking and iframe coverage at 3, because a leaked card field is an incident and an empty Stripe iframe is a blind spot over the exact moment money changes hands. A content marketing site weights price and retention at 3 and shrugs at iframe capture.
Each criterion also carries two thresholds. A Red Flag is disqualifying. Trip it and the vendor is out regardless of score. A Nice-to-Have is a bonus that breaks ties. Score each vendor 0–3 per criterion, multiply by your weight, sum it up. The tool with the highest weighted total wins for you, and I mean that qualifier literally, because I've watched the same three tools reorder themselves twice in one afternoon just by changing whose use case we scored for.
Set your weights before you look at a single demo. Otherwise the shiny feature sets them for you.
The 12 criteria
1. Masking granularity (weight this highest)
Client-side masking, as Datadog describes it, is the floor everyone should clear. The real spread is in granularity. Can you mask a single element, unmask an allow-listed one, and leave the rest protected? Or is it all-or-nothing?
Red flag: coarse, all-or-nothing masking that forces you to choose between a useless blur and a privacy incident. Nice-to-have: element-level unmask allow-lists, so you reveal the one label you need and nothing more.
2. Masking-rule drift resilience
This is the failure mode most buyers never test, and it's the one that bites six weeks after signing. Your UI ships changes constantly. A section that was safe to record on Monday might carry a Social Security field by Friday.
Dynatrace names it directly: "If a previously unmasked section of a page is changed to include protected content that now needs to be masked, unmasking needs to be updated accordingly." Read that as: your masking rules rot every time your frontend team deploys. Red flag: no alerting or audit trail when the DOM changes and new fields start leaking. You want the tool to tell you it saw something new, not to find out from a replay three sprints later.
3. Honest disclosure of what is NOT masked
Trust the vendor that documents its gaps. Amplitude does this well, stating that "Session Replay masking applies to text content and form inputs, but does not mask HTML attribute values." That's a real hole. Sensitive data tucked into a data- attribute sails straight through masking that looks complete on the surface.
Red flag: docs that only say "we mask" and never list what slips past. Nice-to-have: an explicit "not masked" section in the documentation. A vendor honest about its blind spots is telling you where to put your own checks.
4. Sampling controls
Sampling is a privacy and cost lever, not just a performance knob. The question is whether you decide who gets recorded, or whether the tool imposes a cap you can't see or shape. PostHog is candid that network capture "can have an impact on your application's performance," and recommends sampling for high-volume traffic.
Red flag: opaque or non-configurable sampling. You don't know who's being recorded, and you can't change it. If you can't answer "what percentage of my logged-in users are we capturing right now," you don't control your own exposure.
5. Data-capture depth (console, network, canvas)
More capture means better debugging and more overhead, and the overhead isn't only performance. PostHog's guidance is to capture metric-like network data rather than full request and response bodies, precisely because those bodies are heavy and often full of things you didn't mean to store.
Red flag: full request/response body capture with no toggle. If a tool grabs bodies by default and offers no off switch, it's making a privacy decision on your behalf. For how much this actually helps engineering, we walk through it in session replay as a debugger.
6. Third-party iframe / embed coverage
Your checkout is probably an iframe you don't own, and that's exactly where replay tends to go dark. PostHog is refreshingly blunt: embeds like Typeform, YouTube, Stripe Checkout, and Calendly "cannot be recorded – PostHog can't run inside a foreign domain and the same-origin policy blocks DOM access, so the iframe appears as an empty element."
An empty element over your payment step is the worst kind of blind spot, because the flow looks recorded until you play it back and the crucial ten seconds are a blank rectangle. Red flag: silent empty elements over payment or form flows, with no warning that capture stopped.
7. Error and console linking
A replay is worth ten times more when it's tied to the error that caused it. The tools worth your money let you jump from a spike in a specific console error straight to the sessions where it fired, so you're watching the break instead of hunting for it.
Red flag: replays and errors living in separate silos with no shared identifier. When those two datasets don't talk, your engineers reproduce bugs by guesswork, and your best qualitative evidence sits one query away from the quantitative signal that would make it actionable.
8. Retention window and configurability
Retention is where the fine print hides. Pendo's default is instructive: "Replays are automatically deleted after 30 days, or 90 days if your subscription includes extended retention." Short, and gated behind a higher tier. That's common, not a knock on Pendo specifically. Replay retention runs shorter than analytics retention almost everywhere.
Red flag: short, tier-gated, non-configurable retention that forces you to buy up just to keep last quarter's sessions. Nice-to-have: separate retention settings for replays versus analytics events, so you can hold aggregate trends long after the heavy video-like recordings age out.
9. Data residency and where assets live
Masking covers what users type. It doesn't cover where your site's own assets end up. FullStory documents that "the assets will be fetched by a Fullstory bot and stored on Fullstory's servers for future replay," rewriting references during playback. That's a sensible engineering choice for faithful reconstruction, and it's also a residency question under GDPR. Your CSS, your images, and by extension some of your interface, are copied onto a third party's infrastructure.
Red flag: no disclosure at all of where captured assets are stored. You can't assess a residency risk you can't locate.
10. Data portability / export
Even a free tool can lock your data in. Microsoft Clarity is the case study: per ClarityInsights, "The Clarity Data Export API allows 10 requests per day per project, a maximum of 3 days of data per request, and a maximum of 1,000 rows per response." Generous product, constrained pipe. If you want to warehouse your behavioral data or feed it into another system, those caps decide whether that's realistic.
Red flag: no meaningful export, or an API so throttled it can't move a real dataset. Ask for the export limits in writing before you sign, not after.
11. Pricing model transparency
Three broad shapes exist in 2026. Free and unlimited-volume, like Microsoft Clarity, which reportedly powers replay on 2M+ sites at no cost with no session caps. Per-session pricing, like LogRocket, whose free tier covers 1,000 sessions and scales into Professional plans in the hundreds of dollars per month. And enterprise digital-experience suites, FullStory, Contentsquare, Hotjar, Dynatrace, that often sit behind a quote.
Red flag: opaque, quote-only pricing with no public anchor. Quote-only isn't automatically bad, but it means you can't compare without a sales cycle, and that friction is a cost too.
12. Native mobile support and how you query it
If your product is a mobile app, web-only replay is a non-starter. Check whether a tool captures native iOS and Android or just the browser. Then look at how you actually ask questions of it: dashboards you configure by hand, or plain-language querying.
This is where Kixo shows up as one option among several. It captures web via rrweb plus native iOS and Android replay with heatmaps and masking, and its interface is chat-first. You ask a question in plain language and get charts or dashboards back, with a visible reasoning trail showing how it got there. Whether that querying model fits you is a preference, not a rule, and I'd score it on the same masking and retention criteria as everyone else.
Worked example: scoring three tools against the rubric
Let's make it concrete. Say you're a checkout-heavy B2B SaaS. You set weights: masking ×3, iframe coverage ×3, retention ×2, price ×1. Scores are 0–3 per criterion.
| Criterion (weight) | Clarity | FullStory | Per-session tool |
|---|---|---|---|
| Masking granularity (×3) | 2 | 3 | 3 |
| Iframe / embed (×3) | 2 | 3 | 2 |
| Retention (×2) | 2 | 3 | 2 |
| Price transparency (×1) | 3 | 1 | 2 |
| Weighted total | 19 | 28 | 23 |
Clarity scores well on price, free and unlimited, but its export caps per ClarityInsights and less granular masking pull it down on the two criteria this buyer weights hardest. FullStory wins here on capture depth, though you'd accept its asset-residency posture per FullStory's own docs as part of the deal. The per-session tool lands in the middle.
Now flip the buyer. A content site sets price ×3, retention ×3, masking ×1, iframe ×1. Clarity's price-3 and generous retention rocket it to the top, and FullStory's quote-only price-1 sinks it. Same three tools, different winner. There is no universal number one, and any listicle that hands you one is scoring for a buyer who isn't you.
Where each tool lands
A quick, even-handed map, same scrutiny for each. Microsoft Clarity is free and unlimited on volume, which is genuinely hard to beat, with the export ceilings ClarityInsights documents as the real constraint. LogRocket uses per-session pricing that stays cheap at low volume and climbs with traffic. FullStory offers deep capture and mature debugging, alongside the asset-storage residency consideration in its documentation. Hotjar and Contentsquare sit in the experience-suite category, strong on the qualitative-plus-quantitative blend.
Kixo captures web through rrweb and adds native iOS and Android replay with heatmaps and privacy masking, wrapped in a chat-first interface where you ask questions in plain language and see the reasoning behind each answer. Pricing is per-project across FREE, GROWTH, and ENTERPRISE tiers, bracketed by monthly active users. Honest caveat: I'm not citing named customers, benchmark wins, or compliance certifications for it here, because none belong on this page. Evaluate it against the same 12 criteria you'd apply to anyone else. If you want to look, it's at kixo.io.
If you're weighing replay against heatmaps in this shortlist, that comparison sorts out which question each one answers.
The three questions to ask any vendor before you sign
Everything above collapses into three questions. Ask them in a live call, and watch how fast the answers come.
First: show me your "what we do NOT mask" list. A vendor that can produce one, the way Amplitude documents its HTML-attribute gap, is a vendor that respects the creepy line. A vendor that only repeats "we mask by default" is hiding the part that matters.
Second: what happens to my masking rules when my UI ships next week? This is the drift problem Dynatrace spells out. You want to hear about alerting and audit, not a shrug and a promise that it'll be fine.
Third: what's my configurable retention, and can I export the data? Pin down the retention window, whether it's tier-gated like Pendo's 30-to-90-day step, and what the export limits actually are before those Clarity-style caps surprise you in production.
Get those three answered in writing. If a vendor can't, you already have your answer, and it's the one that keeps you off the wrong side of the line.
FAQ
Is "masks by default" enough for GDPR compliance? No. Masking by default is the starting point, not the finish. GDPR compliance depends on what's actually captured, where assets are stored (FullStory stores them on its own servers, per its docs), your retention window, and whether your rules survive UI changes. Masking is necessary and nowhere near sufficient.
Why does replay retention run shorter than analytics retention? Replays are heavy compared to event data, so vendors often cap them tighter to control storage cost. Pendo's default of 30 days, extending to 90 only on higher tiers, is a representative example. Score retention as its own criterion rather than assuming it matches your analytics window.
Can a free tool still lock in my data? Yes. Microsoft Clarity is free and unlimited on volume, yet per ClarityInsights its export API allows only 10 requests per day, 3 days of data per request, and 1,000 rows per response. Free on capture doesn't mean free to leave.