Verdict-based detection
Heretic compares browser-reported claims with measurement results from browser tests and the connection itself, then returns a verdict instead of a raw score that you still have to interpret.
Heretic
Heretic is a bot and device detection product that returns a verdict with documented findings, plus an optional phone challenge for step-up verification. It is designed for browser checks, backend decisions, and form-based verification flows.
Bot and device detection with verdicts and phone challenges
Heretic is a bot and device detection product that checks whether a browser’s reported claims match what the browser, network, and session measurements actually show. Instead of giving a single opaque score, it returns a verdict with specific findings and the reasons behind them.
The product is aimed at workflows where you need to decide whether to trust a session, step up verification, or stop a protected action. The site shows browser checks, optional phone challenges, and structured outputs that can be read by a backend or used in a form flow.
Heretic’s checks cover several families of evidence, including network geometry, transport stack, TLS, HTTP construction, compute behavior, and reachability. The pricing page also says every plan includes the current detection rules, available device identifiers, zero-retention mode, and phone challenges.
A typical setup starts with a browser check, and the site says the collector returns a request ID for your backend while the widget adds verification to a form. The free Sandbox includes 1,000 probes and 1,000 challenges each month with no card required.
Core capabilities
Findings with structured reasoning
The homepage shows documented finding IDs and tiers such as absolute, composite, conditional, and weak, so the result can explain what was checked and what changed the outcome.
Multi-family browser and network checks
The product supports checks across network geometry, transport stack, TLS, HTTP construction, compute behavior, and reachability, covering multiple ways a browser claim can be inconsistent.
Optional phone challenge workflow
The site describes optional phone challenges that can be required before a protected action, with a passkey step and recorded motion checks for mobile verification.
Identifiers and zero-retention handling
The pricing page lists site-scoped identifiers, including instance, machine, and rendering identifiers, plus zero-retention mode for one authorized read within ten seconds.
Separate collector and widget components
Heretic offers both a collector and a widget, letting teams run browser checks for backend decisions or add verification to a form without mixing the product into application traffic.
Practical uses
Risk checks on sign-in or account access
Use Heretic to evaluate whether a browser session is consistent with its claimed timezone, platform, device characteristics, and connection behavior before letting a user proceed.
Step-up verification for protected actions
Apply a phone challenge when a policy needs stronger proof before a sensitive action such as signup or another protected step. The site shows the challenge can be required by policy.
Backend-driven authorization decisions
Use the collector to send a request ID to your backend and make an access decision based on the returned verdict and findings, rather than a raw score alone.
Form verification workflows
Add the widget to a form when you want verification in the user flow itself, while keeping Heretic separate from your application traffic.
Manual review and investigation
Review documented findings and their tiers when you need to understand why a session was flagged, especially for cases that look contradictory, refused, or only conditionally suspicious.
Pros and Cons
Pros
- Returns a verdict with documented findings instead of only a numeric risk score.
- Covers both browser claims and connection-level observations, which broadens the kinds of inconsistencies it can detect.
- Supports optional phone challenges for step-up verification on protected actions.
- Offers a free Sandbox with no card required and monthly included usage.
- Includes zero-retention mode and site-scoped identifiers on every plan.
Cons
- The public pages do not provide full implementation documentation or integration details beyond mentioning a collector, a widget, and an API example.
- The pricing page separates probe usage from challenge usage, so estimating total cost requires tracking both dimensions.
- Some findings are conditional or contextual, which means the output may require human review for edge cases rather than a fully automatic decision in every session.
FAQ
How do you get started with Heretic?
Start with a browser check in the Sandbox. The homepage says you can test this browser there, and the signup page notes the Sandbox includes 1,000 probes and 1,000 challenges per month with no card required.
What does Heretic return after a check?
Heretic returns a verdict such as contradicted, refused, or uncontradicted, along with documented findings and their IDs. The homepage and API example show that the response includes the reasons behind the decision.
How is Heretic typically integrated?
The site shows both a collector and a widget. The collector checks a browser session and sends a request ID to your backend, while the widget adds verification to a form.
What is included on every plan?
The pricing page says paid plans include current detection rules, available device identifiers, zero-retention mode, and phone challenges. The same page also notes that plans differ mainly in included usage and commercial terms.
How does billing and usage reset work?
The pricing page says allowance resets on the first day of each UTC month, plan changes are prorated by Stripe, and overage is billed on paid plans. Enterprise terms are handled separately.
Quick Facts
- Category
- Bot and device detection
- Primary output
- Verdict plus documented findings and IDs
- Verification options
- Browser checks, collector, widget, and optional phone challenge
- Free tier
- Sandbox with 1,000 probes and 1,000 challenges per month, no card required
- Billing
- Monthly plans with overage on paid plans; enterprise by quote
- Source domain
- heretic.tech
Alternative a Heretic
EAS Observe
EAS Observe is a production performance monitoring tool for Expo and React Native apps. It shows startup metrics, session timelines, release markers, and errors inside the Expo dashboard.
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repositories and verifies changes with the real compiler, debugger, sanitizers, and tests before showing a diff. It offers a free tier plus paid plans, with editor connectors and zero-retention handling described in the source.
PromptScout
PromptScout tracks how ChatGPT, Gemini, Google AI Overviews, and Perplexity mention your brand or competitors, then pairs those results with source analysis and website audits. It helps teams decide what to fix in content, positioning, or site readiness next.
Sleek Analytics
Sleek Analytics is a privacy-friendly web analytics tool with real-time visitor tracking, Core Web Vitals, and revenue attribution. It helps site owners understand traffic and conversions without cookie banners or a heavy setup.
MacSpoof
MacSpoof cambia o randomizza l’indirizzo MAC Wi‑Fi su macOS: riconnettiti alle reti e limita la registrazione dell’identità su Wi‑Fi pubbliche.
Manta AI
Manta AI is an autonomous web app testing tool for teams that want to map application behavior, catch regressions, and generate tests without writing scripts or maintaining selectors. It works from a URL and supports plain-English test flows, run results with screenshots, and scheduled or deployment-triggered checks.