Verdict-based detection
Heretic compares browser-reported claims with measurement results from browser tests and the connection itself, then returns a verdict instead of a raw score that you still have to interpret.
Heretic
Heretic detects bots and devices, returns verdicts with documented findings, and supports optional phone challenges for browser, backend, and form verification.
Bot and device detection with verdicts and phone challenges
Heretic is a bot and device detection product that checks whether a browser’s reported claims match what the browser, network, and session measurements actually show. Instead of giving a single opaque score, it returns a verdict with specific findings and the reasons behind them.
The product is aimed at workflows where you need to decide whether to trust a session, step up verification, or stop a protected action. The site shows browser checks, optional phone challenges, and structured outputs that can be read by a backend or used in a form flow.
Heretic’s checks cover several families of evidence, including network geometry, transport stack, TLS, HTTP construction, compute behavior, and reachability. The pricing page also says every plan includes the current detection rules, available device identifiers, zero-retention mode, and phone challenges.
A typical setup starts with a browser check, and the site says the collector returns a request ID for your backend while the widget adds verification to a form. The free Sandbox includes 1,000 probes and 1,000 challenges each month with no card required.
Core capabilities
Findings with structured reasoning
The homepage shows documented finding IDs and tiers such as absolute, composite, conditional, and weak, so the result can explain what was checked and what changed the outcome.
Multi-family browser and network checks
The product supports checks across network geometry, transport stack, TLS, HTTP construction, compute behavior, and reachability, covering multiple ways a browser claim can be inconsistent.
Optional phone challenge workflow
The site describes optional phone challenges that can be required before a protected action, with a passkey step and recorded motion checks for mobile verification.
Identifiers and zero-retention handling
The pricing page lists site-scoped identifiers, including instance, machine, and rendering identifiers, plus zero-retention mode for one authorized read within ten seconds.
Separate collector and widget components
Heretic offers both a collector and a widget, letting teams run browser checks for backend decisions or add verification to a form without mixing the product into application traffic.
Practical uses
Risk checks on sign-in or account access
Use Heretic to evaluate whether a browser session is consistent with its claimed timezone, platform, device characteristics, and connection behavior before letting a user proceed.
Step-up verification for protected actions
Apply a phone challenge when a policy needs stronger proof before a sensitive action such as signup or another protected step. The site shows the challenge can be required by policy.
Backend-driven authorization decisions
Use the collector to send a request ID to your backend and make an access decision based on the returned verdict and findings, rather than a raw score alone.
Form verification workflows
Add the widget to a form when you want verification in the user flow itself, while keeping Heretic separate from your application traffic.
Manual review and investigation
Review documented findings and their tiers when you need to understand why a session was flagged, especially for cases that look contradictory, refused, or only conditionally suspicious.
Pros and Cons
Pros
- Returns a verdict with documented findings instead of only a numeric risk score.
- Covers both browser claims and connection-level observations, which broadens the kinds of inconsistencies it can detect.
- Supports optional phone challenges for step-up verification on protected actions.
- Offers a free Sandbox with no card required and monthly included usage.
- Includes zero-retention mode and site-scoped identifiers on every plan.
Cons
- The public pages do not provide full implementation documentation or integration details beyond mentioning a collector, a widget, and an API example.
- The pricing page separates probe usage from challenge usage, so estimating total cost requires tracking both dimensions.
- Some findings are conditional or contextual, which means the output may require human review for edge cases rather than a fully automatic decision in every session.
FAQ
How do you get started with Heretic?
Start with a browser check in the Sandbox. The homepage says you can test this browser there, and the signup page notes the Sandbox includes 1,000 probes and 1,000 challenges per month with no card required.
What does Heretic return after a check?
Heretic returns a verdict such as contradicted, refused, or uncontradicted, along with documented findings and their IDs. The homepage and API example show that the response includes the reasons behind the decision.
How is Heretic typically integrated?
The site shows both a collector and a widget. The collector checks a browser session and sends a request ID to your backend, while the widget adds verification to a form.
What is included on every plan?
The pricing page says paid plans include current detection rules, available device identifiers, zero-retention mode, and phone challenges. The same page also notes that plans differ mainly in included usage and commercial terms.
How does billing and usage reset work?
The pricing page says allowance resets on the first day of each UTC month, plan changes are prorated by Stripe, and overage is billed on paid plans. Enterprise terms are handled separately.
Quick Facts
- Category
- Bot and device detection
- Primary output
- Verdict plus documented findings and IDs
- Verification options
- Browser checks, collector, widget, and optional phone challenge
- Free tier
- Sandbox with 1,000 probes and 1,000 challenges per month, no card required
- Billing
- Monthly plans with overage on paid plans; enterprise by quote
- Source domain
- heretic.tech
Heretic Alternatives
EAS Observe
EAS Observe monitors production performance in Expo and React Native apps, showing startup metrics, session timelines, release markers, and errors in the Expo dashboard.
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
PromptScout
PromptScout tracks how ChatGPT, Gemini, Google AI Overviews, and Perplexity mention your brand or competitors, with source analysis and website audits.
Sleek Analytics
Sleek Analytics is a privacy-friendly web analytics tool with real-time visitor tracking, Core Web Vitals, and revenue attribution.
MacSpoof
MacSpoof is a macOS MAC address changer that lets you change or randomize your Wi‑Fi MAC to reconnect and limit device logging on public Wi‑Fi.
Manta AI
Manta AI is an autonomous web app testing tool that maps app behavior, catches regressions, and generates tests from a URL, no scripts or selectors needed.