Back to catalog
rrweb
MITrrweb provides open-source session replay for web apps, replacing hosted tools like LogRocket and FullStory with private, self-hosted DOM event capture.
Open-source alternative to — compare it against:
Overview
Commercial session replay platforms require streaming sensitive user interactions to third-party cloud infrastructure, creating data residency risks and unpredictable telemetry bills. rrweb keeps session recording entirely within internal boundaries by serializing DOM mutations into compact JSON event streams. This gives engineering teams full control over sensitive data masking and storage infrastructure without relying on external SaaS vendors.
Why rrweb instead of LogRocket
LogRocket delivers a managed monitoring platform pairing session playback with hosted ingestion, log aggregation, and error tracking out of the box. rrweb isolates the core technical problem: recording the exact visual state of the browser and replaying it deterministically. It provides the client-side recorder, event serializer, and replay player, but omits backend storage, search indexing, and alerting. Choosing rrweb decouples telemetry capture from commercial vendor contracts, allowing teams to pipe session streams directly into private object storage such as MinIO or AWS S3.
From an operations perspective, the difference centers on infrastructure ownership versus ongoing SaaS overhead. Managed vendors charge per recorded session and require outbound connections to external ingestion clusters, creating compliance friction under GDPR and HIPAA. With rrweb, DevOps engineers manage their own ingestion endpoints and retention policies, filtering or compressing payloads before disk writes. While building the pipeline requires upfront development, it eliminates vendor lock-in and scales on commodity cloud storage.
What it does well
- Event-based DOM serialization: Captures an initial DOM snapshot and tracks subsequent mutations using
MutationObserver, outputting a lightweight JSON stream rather than video. - Client-side privacy controls: Configures masking rules for sensitive text, form inputs, and CSS selectors directly in the browser before data egress.
- Sandboxed playback: Rebuilds DOM nodes inside an isolated iframe with scripts disabled to prevent cross-site execution risks during session reviews.
- Modular architecture: Provides independent packages for recording (
@rrweb/record), replaying (@rrweb/replay), and UI player controls (rrweb-player) for flexible integration.
