No. 26 of 30 ยท Heatmaps and session replay
Hotjar
The tool that taught a generation of marketers what a heatmap was, now inside Contentsquare.
Visiting hotjar.com today redirects you to Contentsquare, which is the clearest statement of where the product now lives.
The verdict
Hotjar is why most marketers know what a heatmap is. Click maps, scroll maps, move maps, session recordings and on-page surveys, packaged so that somebody who does not write code can install it and learn something the same afternoon. On the behaviour measure it scores a 10 because it defined what that measure means, and the recordings-plus-surveys combination remains unusually good at turning a hunch into a finding.
The thing to understand in 2026 is that it is no longer really its own product. Hotjar was acquired by Contentsquare in 2021, and hotjar.com now redirects to Contentsquare's pricing. The free tier is still generous at 200,000 monthly sessions with replays, heatmaps and funnels, and Growth starts around $39 a month billed yearly.
What you actually get
The costs are the ones every replay tool carries, and they are heavier here than the marketing admits. The script is large and it is one of the more visible performance bills on this list. It sets cookies, so you need consent, and the consent you need is the more demanding kind because you are recording sessions rather than counting visits. Recording sessions means capturing what people typed into forms unless masking is configured correctly, and the default posture matters enormously: this is the exact problem Absolutely Analytics addresses by masking every input in the browser before transmission and making you opt fields back in, rather than redacting on arrival.
The privacy score of 3 is about that architecture rather than about the company's intentions. A tool that transmits session content and then filters it has a different risk profile from one that never transmits it, and if your site has a checkout, a login or a form with personal data in it, that difference is the whole conversation with your DPO.
Best for
Marketing and UX teams who need to see what people do on a page and ask them why, with a free tier large enough to answer a redesign question before anyone signs anything.
Getting it running
One script tag and a dashboard, genuinely approachable for non-technical users. Configuring masking properly is the part that needs care and the part most often skipped.
What to watch out for
Heavy script with a real performance cost. Cookies and a demanding consent obligation because you are recording, not counting. Masking must be configured rather than assumed. The product now sits inside Contentsquare's portfolio, so the pricing and roadmap are Contentsquare's decisions.
Pricing and practicalities
Free at 200,000 monthly sessions, one project, with replays, heatmaps, funnels and basic surveys. Growth from $39 a month billed yearly, from 7,000 monthly sessions with 13 months of data access and three projects. Pro is quoted. Prices read 2026-09-11 on Contentsquare's pricing page.
Who should go elsewhere
Anyone who wants behaviour tooling without a consent banner and a payload, where Absolutely Analytics includes click, scroll and attention maps from $14 with in-browser masking. Also not for teams on zero budget, where Microsoft Clarity is free at any volume.
How it compares
The unavoidable comparison is Microsoft Clarity, which does most of this for nothing and is the reason Hotjar's paid tiers are a harder sell than they were. Against FullStory it is the cheaper, simpler tool aimed at marketers rather than product analysts.
Head to head:
The ten measures
Each measure is scored 0 to 10 and weighted. The overall figure is the weighted mean, and it is relative to the other 29 tools on this list rather than absolute. How this works.
What this rests on
Contentsquare's pricing page, which now serves hotjar.com, read 2026-09-11; Contentsquare's published announcement of the 2021 acquisition; Hotjar's documentation on masking and suppression.
Desk research against published pricing and documentation. The privacy judgement is an architectural comparison between in-browser masking and server-side redaction, drawn from both vendors' own descriptions of their systems, not from a security audit of either.
This is a desk review. I have not been given access by the vendor, I have no commercial relationship with them, and everything above is my opinion rather than a statement of fact. If something here is wrong, tell me and I will correct it.