Open-Source and Self-Hosted Session Replay Tools

The main open source session replay tools are rrweb, the recording library most web replay is built on, and OpenReplay and PostHog, which you can run on your own servers. Sentry and Matomo offer self-hosted routes with replay or recordings attached to a wider product, and AnyReplay pairs MIT-licensed SDKs with a documented self-hosted deployment. Which one fits depends less on the licence than on how much infrastructure you are willing to operate.

This guide describes each option from its public positioning, separates "open source" from "self-hosted" (they are often treated as the same thing and are not), and summarises what running replay yourself actually involves. Licences and editions change, so check each project's site before you commit.

Open-source session replay at a glance

Open source vs self-hosted: not the same thing

Open source describes a licence: you can read, modify and usually redistribute the code under stated terms. Self-hosted describes where the software runs: on servers you control rather than the vendor's. The two overlap often but not always.

• An open-source library such as rrweb is not something you "host" at all until you build ingest, storage and a player around it.
• An open-source project may keep some features in a commercial edition, or use a licence with conditions that matter for your use. Read the licence, not just the badge.
• A product can be self-hostable without being open source: you run the vendor's software under a commercial agreement.
• A product can have open-source SDKs while the server side stays closed. The code running in your users' browsers is auditable; the platform is not.

For most teams the question behind "open source session replay" is really about control: can we inspect what the recorder collects, and can recordings stay on our infrastructure? Answer those two separately and the list of candidates gets clearer.

The tools, one by one

rrweb

rrweb is the MIT-licensed library that takes a full snapshot of the DOM, records mutations and input, and replays them in a browser. It is the foundation of many replay products, AnyReplay's browser SDK included. It gives you recording and a replayer, and leaves everything else to you: transport, storage, retention, search, access control and masking policy. See rrweb explained and the rrweb glossary entry.

OpenReplay

OpenReplay is generally known as an open-source, self-hostable replay tool with a developer-tools flavour: network requests, console output and application state next to the recording. A hosted option also exists. It is one of the most direct answers to "self-hosted session replay tools". Check their docs for deployment requirements and their licence for which features each edition includes. See AnyReplay vs OpenReplay.

PostHog

PostHog positions itself as an open-source, all-in-one product platform with analytics, session replay, feature flags, experiments and surveys, offered in the cloud or self-hosted. It suits teams that want replay as part of a broader analytics stack. Check their site for the current self-hosted edition, what it includes and how they recommend running it. See AnyReplay vs PostHog.

Sentry

Sentry is error and performance monitoring with session replay attached to errors, on web and mobile. A self-hosted Sentry is generally known to exist; check their site for its licence terms and which features, including replay, the self-hosted version supports. If your aim is to see what led up to an exception, it is a natural choice.

Matomo

Matomo is privacy-focused web analytics that you can host yourself, and it is often the first self-hosted analytics tool European teams consider. Heatmaps and session recordings are available as a premium feature rather than part of the core; check their site for current details. It fits when analytics is the main job and recordings are a supplement.

AnyReplay

AnyReplay is precise about what is open: its SDKs, @anyreplay/browser and @anyreplay/react-native, are MIT-licensed with source on GitHub, so you can audit exactly what the recorder collects and how masking works before data leaves the page or device. The AnyReplay platform (dashboard, API and ingest) is not open source.

For teams that need recordings on their own infrastructure, AnyReplay documents a single-host deployment: Ubuntu 24.04, PostgreSQL, the API, ingest and dashboard behind nginx, chunk storage on the filesystem, and encrypted, verified backups. Self-hosted ingest is available on the Enterprise plan; see the self-hosting overview and talk to us.

Can session replay be self-hosted?

Yes. OpenReplay, PostHog, Sentry and Matomo all describe self-hosted routes, rrweb can be built into your own backend, and AnyReplay offers a documented deployment on its Enterprise plan. The harder question is whether your team should, because installing it is the easy part.

What self-hosting session replay really takes

Our post on self-hosted session replay walks through a real deployment in detail. In short, whichever tool you choose, you take on the same list:

• Operations. Services to monitor, restart and scale, and someone on call when ingest stops accepting data.
• Storage growth. Recordings grow with traffic multiplied by retention. Estimate sessions per day, average session size and retention days before you provision, and watch the disk after.
• Backups. Recordings and the database that indexes them need off-host, encrypted backups, and a restore you have actually tested.
• Upgrades. New versions, schema migrations and security patches arrive on the project's schedule, not yours.
• TLS and access. Certificates, DNS, a firewall, and authentication for the dashboard that holds every recording.

If that list is routine for your team, self-hosting buys real control. If it reads as a second job, a hosted service with strong masking and a clear processor agreement may serve your users better.

Is self-hosted session replay GDPR compliant?

Self-hosting does not make replay compliant by itself; it removes a third-party processor and simplifies questions about where data is stored and transferred. You still need a lawful basis, usually consent, masking of personal data, a retention limit and a way to honour deletion requests. Session replay and GDPR covers the obligations, and none of this is legal advice.

How to choose

1. Decide whether you need open source (licence and auditability), self-hosting (where data lives), or both.
2. Read the licence and edition list for the features you depend on, not just the repository.
3. Match the product to the job: developer debugging, product analytics, error context, web analytics, or reviewing sessions in other languages.
4. Check mobile support if you ship an app, and which frameworks each SDK covers.
5. Cost the operations honestly: disk, backups, upgrades, TLS and on-call time.

Where AnyReplay fits (and where it doesn't)

If you need a fully open-source replay platform you can fork and run without a commercial agreement, AnyReplay is not it: choose OpenReplay, PostHog or a custom rrweb build. AnyReplay also does not capture console logs or network requests and builds no heatmaps or funnels, so OpenReplay, Sentry or Matomo cover those needs better.

AnyReplay fits when you want auditable MIT-licensed recorders, masking that runs in the browser and is on by default, translation of sessions for reviewers in other languages, React Native recording without a native module, and the option to keep recordings on your own server through the Enterprise plan. The hosted Free plan costs nothing during early access; see pricing.

Frequently asked questions

rrweb, OpenReplay, PostHog, Sentry, Matomo, Hotjar and FullStory are trademarks of their owners. AnyReplay is not affiliated with or endorsed by them. Descriptions are general and may be out of date; check each vendor's site for current features, pricing and limits.