Self-hosted session replay

Watch what your users did before the error.

A JavaScript error stops being a bare stack trace and becomes the thirty seconds of footage that led up to it. Hindcast records real sessions as DOM events — every click, scroll and input — and plays them back like film. Sensitive fields are masked in the browser before anything leaves it, and the whole thing runs on your own infrastructure.

Get started View the source

How it works

Record

One async script tag captures DOM mutations — the rrweb technique, events not pixels — and flushes every few seconds.

Mask

Inputs are masked in the visitor's browser before anything is sent. Password and card fields can never be unmasked.

Store

The ingest API gzips event chunks into your object storage and keeps only metadata in Postgres.

Replay

Watch the session back with errors and failed requests on a synced timeline. Click one, land on the moment it broke.

Get started

Hindcast is self-hosted — you run the backend (steps 1–2), then point your site at it (step 3). No hosted service, no account. Four steps from clone to first replay.

Run it

Docker brings up Postgres, Redis and object storage; then start the ingest API (:4100) and the dashboard (:3000). Set an ADMIN_SECRET to lock the dashboard.

git clone https://github.com/haneenpk/hindcast && cd hindcast

docker compose up -d

pnpm install && pnpm db:migrate

pnpm --filter @hindcast/ingest start:dev

pnpm --filter @hindcast/web dev

Create a project

Unlock the dashboard with your secret and create a project — one per site you want to record. It hands you a project key and the install snippet.

Add the script

Point it at the ingest host from step 1 and recording starts immediately, masked in the browser. Two ways to load it — pick one.

A drop-in tag — no build step

<script async
  src="https://hindcast.example.com/r.js"
  data-key="prj_live_9f2c…"
  data-endpoint="https://hindcast.example.com"></script>

Or npm, if you build with a bundler

npm i @hindcast/sdk

import { init } from "@hindcast/sdk";

init({
  key: "prj_live_9f2c…",
  endpoint: "https://hindcast.example.com",
});

Watch

Sessions appear within seconds. The ones that broke wear a red dot — click one and watch it back, with the console and network timeline synced underneath.

Deploying for real? The self-host guide covers env vars, object storage, and exposing ingest to the internet.

Privacy is the default, not a setting.

Masking runs in the visitor's browser before a single event is sent, so sensitive data is never recorded in the first place — there is nothing to leak later. Password and card fields have no unmask escape hatch at any layer, and anything marked data-private records as a blank block. What was never captured can't leak.