FormspillResources What is session recording?
What is session recording, and how to tell if a site records what you type
Session recording, also called session replay, is a script that records what you do on a page, mouse movements, clicks, scrolling and what you type, so the site can play your visit back later. It records as you go, so text you type into a form can be captured even if you never press send.
Why sites use it
Session recorders such as Hotjar, Microsoft Clarity and FullStory help a site see where visitors get stuck: a button nobody finds, a form people give up on. The site sees a video-like replay of real visits.
Why it matters for your privacy
To replay a visit, the script has to capture it, including form fields. Recorders offer masking settings that hide typed text, and several mask some fields by default, but a site can switch masking off or miss a field.
In 2017, researchers at Princeton found session replay scripts from seven companies on 482 of the 50,000 most visited websites. They found that text typed into forms was collected before the form was submitted, that masking was imperfect, and that recordings could include card details, passwords and medical information. In 2022, the Leaky Forms study found password collection by third-party session replay scripts on 52 websites.
How to tell if a site records you
- Look for the script. In developer tools, open the Network tab, reload, and look for requests to
recorder domains, such as
hotjar.com,clarity.msorfullstory.com. - Read the privacy policy. Sites that record sessions often say so, sometimes as “analytics” or “heatmaps”.
- Watch what it sends while you type. This is the hard part: recorder traffic is compressed and batched, so seeing whether your typing left the page is not practical by hand.
How Formspill checks it
Formspill lists the session recorders whose code runs on the page. Its check types made-up details into the form and shows whether what was typed reached a recorder, and whether that happened while typing, before you pressed send. It reads compressed traffic, and blocks every request carrying the made-up details, so nothing is sent.
Check a form before you type into it. Formspill is free for Chrome: no account, and nothing leaves your browser.
Sources
- Princeton CITP: No boundaries: Exfiltration of personal data by session-replay scripts (2017)
- Senol et al., Leaky Forms, USENIX Security 2022