Open Source Session Replay: The Complete Guide

Open source session replay means recording and replaying user sessions with openly licensed technology you can read, modify, and run yourself. The core of the ecosystem is rrweb, the MIT-licensed library that many commercial replay products build on. rrweb handles browser capture and event-based playback. A production service adds durable ingest, indexing, retention, deletion, privacy operations, and monitoring. This guide covers both layers, the three ways to adopt them, and where rrweb Cloud fits.

What is session replay?#

Session replay reconstructs a user's visit as a watchable playback built from recorded browser events. A recording library captures the page's DOM once, then appends changes and interactions as timestamped data. A player uses that data to recreate the captured browser experience with high fidelity. Because the recording is structured data, it is searchable, analyzable, and typically much smaller than video of the same session.

If the distinction between recording and replay matters for your search, session recording vs session replay covers it in two minutes.

Why choose open source for session replay specifically?#

Session replay recordings can contain highly sensitive product and user context, which makes inspectability and control especially valuable. Four considerations shape many decisions:

Data ownership. Recordings show everything users did in your product. With open source capture and self-hosted storage, your team has direct control over where that data lives, which can simplify a GDPR review and support your residency strategy.

Inspectable privacy. Masking happens in the user's browser, before transmission. With open source you can read the exact code that decides what gets captured, giving your security team a transparent way to review the implementation alongside the documentation provided by any platform you evaluate.

Cost structure at scale. Hosted replay plans typically scale with usage, while open source scales with infrastructure. Both models can be highly effective; open source offers predictable infrastructure economics at volume, while hosted plans offer clear operating simplicity. Build vs buy works through the math.

Extensibility. When replay is a feature of your product (support tooling, QA evidence, audit trails) rather than an internal analytics tool, the library gives you an embeddable foundation with full control over the experience. Hosted platforms are excellent for teams that want a complete replay workflow out of the box.

How does open source session replay work?#

The rrweb architecture is the reference implementation, and understanding it explains the whole category. Recording starts with a full snapshot: the entire DOM serialized to JSON, every node assigned an id. From then on, the recorder emits incremental snapshots: compact events describing each mutation, mouse move, click, scroll, and input. The result is an event stream, an ordered list of typed JSON objects.

{
  "type": 3,
  "data": { "source": 2, "type": 1, "id": 42, "x": 320, "y": 180 },
  "timestamp": 1716220801456
}

That is a click on node 42. The replayer rebuilds the initial snapshot inside a sandboxed iframe and applies events in order, reproducing the captured experience with high fidelity and adding play, pause, seek, and speed controls. The glossary entries for snapshots, event streams, and the replayer describe this pipeline.

What are the three ways to adopt open source session replay?#

There are three adoption paths, and choosing deliberately helps a team move quickly, so this is the decision that matters.

Path 1: Use the library directly. Install rrweb, write your own ingest and storage, and embed the player where you need it. This is a strong fit when replay is a product feature or your requirements are genuinely unusual. A local proof of concept can be assembled quickly; a production service remains a substantial engineering and operational commitment. It needs durable delivery, authentication, tenancy, indexing, retention and deletion workflows, observability, and an owner for incidents. The rrweb guide covers the library APIs, while self-hosted session replay defines the larger production gap.

Path 2: Self-host an open source product. Tools like OpenReplay and PostHog package dashboards, search, analytics, and replay in software your team can deploy. This path fits teams that want an included product experience, direct infrastructure ownership, and the capacity to operate it. The comparison is in best open source session replay tools, and the responsibility model is in self-hosted session replay.

Path 3: Use rrweb Cloud with the open recorder. rrweb Cloud runs the production layer around rrweb: managed ingest, storage, indexing, deduplication, PII filtering, APIs, and replay serving. The recorder remains open source and portable, while the rrweb maintainers operate the infrastructure. This path fits teams that want rrweb's open capture layer and prefer the maintainers to operate the production data platform.

The library is free either way; what differs is who runs the backend. Free session replay breaks down what "free" actually includes on each path.

What does open source session replay cost?#

The license has no fee. Operating the production system has infrastructure, engineering, and support costs. Total cost includes ingest reliability, retries and deduplication, metadata indexing, secure multi-tenant access, retention and deletion, PII controls, observability, replay-fidelity testing, migrations, support, and on-call ownership. Raw object storage is usually one of several components. Self-hosted session replay breaks down that responsibility model, while rrweb Cloud pricing provides the managed comparison.

What technical boundaries should you plan for?#

Open source replay inherits the technical boundaries of DOM recording, and planning for them up front leads to the best implementation. Cross-origin iframes require control of their content and instrumentation on both sides. Canvas-heavy interfaces benefit from explicit configuration and storage planning. Closed shadow roots follow browser security boundaries. These are characteristics of the underlying browser environment, and teams across the category plan for them in different ways. The glossary covers each clearly: cross-origin iframe, canvas recording, shadow DOM.

Open source gives your team direct control over privacy defaults, consent gating, and retention policy. It also makes your team responsible for proving those controls continue to work across every stored batch, index, cache, backup, and deletion request. The data masking glossary entry is the starting point for capture; production governance extends well beyond that first configuration.

How do I get started?#

Start with the library in a staging environment: the rrweb guide covers recording and playback. Production planning then assigns ownership for ingest, storage, indexing, privacy operations, retention, monitoring, and incidents. rrweb Cloud provides a managed backend for the open recorder, while the build vs buy framework helps teams scope a self-operated system.

Summary#

1. Open source session replay records sessions as structured DOM events, with rrweb as the ecosystem's MIT-licensed core.
2. It gives teams an inspectable, embeddable capture layer; production infrastructure remains a separate responsibility.
3. Three adoption paths: build directly on the library, self-host a product, or use rrweb Cloud with the open recorder.
4. Engineering and operations dominate self-hosted total cost; object storage is only one component.
5. Validate capture in staging, then choose who will own the production data platform before real traffic.

More from this section lives on the Open Source category page.

FAQ#

What is open source session replay?#

Open source session replay is session recording and playback built on openly licensed code, most commonly the rrweb library. You can read, modify, and self-host the entire pipeline, which means full ownership of recordings and no per-seat vendor pricing on the capture layer.

Is rrweb free to use commercially?#

Yes. rrweb is MIT-licensed, which permits commercial use, modification, and redistribution without fees. Running it as a production service still requires ingest, storage, indexing, privacy operations, retention, monitoring, and ongoing ownership. rrweb Cloud provides that managed production layer for teams that want the open library without operating the backend.

Which commercial tools are built on rrweb?#

PostHog, Sentry, and Highlight are rrweb customers and use the library in their session replay products. Each company adds a polished product experience and specialized workflows around the capture layer. Many companies also embed rrweb directly in internal and customer-facing tools.

What is the difference between the rrweb library and a session replay product?#

The library handles recording and playback in the browser. A production platform adds durable ingest, storage, indexing, deduplication, privacy controls, retention, deletion, monitoring, APIs, and user workflows. Teams can build and operate those layers, self-host a product, or use rrweb Cloud while keeping the recorder open source.