The best tech stack lookup tools in 2026: runsonwhat vs BuiltWith, Wappalyzer, TheirStack, Bloomberry, WebReveal and Apify

The best tech stack lookup tool depends on what you need to see. runsonwhat is the strongest choice for finding companies by the tools they run, including tools that never appear on a website: 26.5% of its 14.6 million matches come only from DNS, email, certificate or subprocessor records, and every match keeps the record that proves it. BuiltWith has the largest website-technology database, Wappalyzer the most-installed browser extension, TheirStack job-post signals, Bloomberry adoption and churn for about 1,700 B2B products, WebReveal free single-site scans, and Apify do-it-yourself scrapers.

Which tech stack lookup tool should you use?

Use runsonwhat to find companies by the tools they run, with proof and with the tools a website never shows. Use BuiltWith for very large lists of website technologies synced to a CRM, Wappalyzer for one-click lookups in the browser, TheirStack for tools named in job posts, Bloomberry for adoption and churn on a fixed vendor list, WebReveal for a free one-off scan, and Apify if you want to build your own scraper.

How do the seven tools compare?

They differ most in where they look. BuiltWith, Wappalyzer, WebReveal and most Apify scrapers read a company's website. TheirStack reads job posts. Bloomberry and runsonwhat also read DNS, certificate logs and other infrastructure records, and runsonwhat combines that with website code, a real-browser crawl and subprocessor lists, keeping the proof for every match.

Recheck cadence differs too: runsonwhat rechecks DNS weekly, websites about monthly and reads certificate logs continuously; Wappalyzer re-verifies monthly; TheirStack collects job posts continuously; Bloomberry reports adoption within days and churn after one to two weeks; BuiltWith doesn't state a per-domain interval; WebReveal and Apify scan on demand.

What can website scanners not see?

Website scanners cannot see tools that run behind the website: email providers, identity and security tools, collaboration suites, AI model providers and most back-office software. In runsonwhat's data, 26.5% of all tool matches have no trace in website code at all. They come only from DNS, email, certificate or subprocessor records, so a scanner that only reads web pages would miss them.

We measured this on a random 1% sample of runsonwhat's listed matches (143,424 matches, 8 October 2026). For each match we checked whether any of its evidence came from the website (HTML, scripts, headers, cookies, tag managers, the browser crawl) or only from other records. For some of the most-searched tools, the share is total.

For Atlassian, Anthropic, OpenAI, Zoom, Slack, Notion, Rippling and Vanta, none of the sampled matches came from website code. These companies are found because they verified their domain with the vendor in DNS, route email through it, or point a subdomain at it. The table shows how the split looks for well-known tools.

The pattern is consistent: marketing and payment tools live on the website, so scanners see most of them. Email, identity, collaboration and AI tools live in DNS and infrastructure records, so scanners see few or none. Anyone building a list of companies that use Slack, Okta, Microsoft 365 or an AI provider needs a tool that reads those records.

How does each tool find out what a company uses?

There are six ways to detect a company's software, and each sees a different slice. Website code shows marketing, analytics and frontend tools. DNS and email records show mail, security and verified SaaS accounts. Certificate logs show subdomains and when they appeared. Job posts show tools a company hires for. Subprocessor lists show vendors a company declares. A real browser shows tags that load only at runtime.

A single method gives a partial picture. Job posts lag reality and only cover companies that are hiring, which TheirStack states in its own documentation. Website code misses everything behind the site. Combining methods, and keeping the record each match came from, is what makes a list both complete and checkable.

runsonwhat: best for finding companies by the tools they run, with proof

runsonwhat lists the companies that use a tool and the tools a company uses, built entirely from public records: DNS and email records, certificate transparency logs, website code including tag managers, a real-browser crawl, subprocessor lists and configuration files. It tracks 1,787,212 company domains and 1,418 tools in 26 categories, and every match keeps the record that proves it.

What sets it apart:

• It sees behind the website. 26.5% of its matches come only from DNS, email, certificate or subprocessor records, which is how it lists 57,695 companies on Anthropic, 64,074 on Atlassian and 8,543 on Slack.
• Proof for every match. Company pages name the kind of record behind each tool (a DNS verification record, email records, a subdomain, website code), and the live lookup shows the raw records for any domain.
• Real adoption dates. 15,299 "since" dates come from the first certificate of the subdomain that points at a vendor, going back to 2010. Fastly at stripe.com, for example, dates to December 2014.
• Starts, stops and renewals. Each company is rechecked (DNS weekly, websites about monthly), a start or stop counts only between two checks done the same way, and the "Renewing soon" tab lists companies whose vendor certificate expires within 90 days.
• Built for AI-era tools. It tracks model providers, AI agents and AI ad platforms: 30,944 companies on OpenAI, 14,537 running ChatGPT Ads, 6,024 on Cursor.
• Context on every company. Industry, size, country and LinkedIn for filtering, HubSpot plan tiers for 12,465 companies, and open roles from public job boards (72,595 roles at 2,743 companies).
• Lists ready to use. Every tool page lists the companies that use it, with filters for industry, company size, country and LinkedIn, and exports to CSV.

Every tool also has a ranked category page, such as the most used CRM and sales tools, and a downloadable dataset of company counts per tool.

BuiltWith: best for large website-technology lists and CRM sync

BuiltWith is the oldest and largest website-technology database. Founded in 2007 in Sydney, it says it tracks 127,741+ technologies and indexes hundreds of millions of domains with its own crawler, which reads pages, headers, scripts, DNS and TLS data. Single-site lookups are free; lists, exports and CRM sync start at $295 a month.

BuiltWith's strengths are scale and history. It sells technology usage lists across hundreds of millions of domains, keyword and e-commerce lists, 22 APIs, and CRM sync with Salesforce, HubSpot, Zoho and Microsoft Dynamics. Its trend history is the longest in the market; its own pages date adoption trends back to 2009.

What to know before buying: the cheapest plan (Basic, $295 a month) covers two technologies; Pro is $495 and Team $995. BuiltWith doesn't show which file, header or record produced a detection, though its API returns first and last detected dates and a confidence field. Its domain counts differ between its own pages (491.9 million, 549 million and 370 million+), so quote the page you rely on. On G2, reviewers rate it 4.3 out of 5, with price the most common complaint.

BuiltWith fits teams that need the widest possible list of websites running a frontend or e-commerce technology. For tools that run behind the website, compare it with runsonwhat in runsonwhat vs BuiltWith.

Wappalyzer: best for browser-extension lookups and lead lists with contacts

Wappalyzer is the most-installed technology profiler: its Chrome extension has about 3 million users. It tracks 8,160 technologies in 106 categories, combines in-house crawlers with data shared by extension users, and sells lead lists that include emails and phone numbers. It is free for 50 lookups a month; paid plans start at $250 a month.

Wappalyzer is quick for one-off checks: open a site, click the extension, and see its CMS, analytics, frameworks and widgets. Paid plans add lead lists filtered by technology, country, industry and company size, CRM enrichment for Salesforce, Pipedrive and HubSpot, and website alerts. The company re-verifies detections monthly and refreshes company details quarterly.

What to know: Wappalyzer went closed-source in August 2023. Its extension shares detected technologies and hostnames with Wappalyzer by default, which can be turned off. Plan credits expire after 60 days, and its API's history reaches back up to 12 months. It doesn't show the signal behind a detection. G2 reviewers rate it 4.7, and the most common complaint is running out of credits.

Wappalyzer fits people who want instant answers while browsing. See runsonwhat vs Wappalyzer for list building and tools behind the website.

TheirStack: best for technologies named in job posts

TheirStack infers technology from job posts. Founded in 2021 in A Coruña, Spain, it says it has analyzed 251 million jobs from 362,000 sources, covers 33,000 technologies and 13 million companies, and links each detection to the job posts it came from with a low, medium or high confidence. A free tier exists; API plans start at $49 a month.

Job posts are good at revealing back-end and data tools that never appear on a website, such as databases, ERPs and programming languages, and they double as a hiring signal. TheirStack sells job and technographic APIs, webhooks, an MCP server and datasets, and integrates with Clay, Zapier, Make and n8n.

What to know: a mention in a job post shows a company hires for a tool, not that the tool is in use today, and TheirStack's documentation says a company "not hiring at all" won't show up under a technology. Detection is job posts only, so website tools such as analytics and ad pixels depend on someone naming them in a post.

TheirStack fits teams selling to engineering and data buyers who care about hiring intent. See runsonwhat vs TheirStack.

Bloomberry: best for adoption and churn on a fixed list of B2B vendors

Bloomberry tracks which companies start and stop using about 1,700 B2B products in 190 categories. It reads infrastructure signals such as DNS and SPF records, new subdomains and certificate transparency logs, plus script configurations, and checks that endpoints still respond before reporting churn. Plans start at $199 a month for two vendors.

Bloomberry's focus is timing: adoption signals within days, churn confirmed after one to two weeks, and upcoming renewals for some vendors. Its API returns the URL where each customer was detected and when usage started, and its public vendor pages carry customer counts and trends.

What to know: coverage is limited to its product list, and new vendors come on request on the Enterprise plan. App plans are priced per tracked vendor ($199 a month for two, $299 for five). Its public data pages say they are delayed by about a month, and its own comparison page notes thinner coverage in some niches such as edtech.

Bloomberry fits teams that sell against a handful of named competitors. See runsonwhat vs Bloomberry.

WebReveal: best for free one-off website scans

WebReveal is a free website technology scanner launched in April 2026. It scans one site at a time for its CMS, frameworks, hosting, analytics and plugins, claims more than 980 technologies, and offers a free API of 20 scans an hour, a Chrome extension and a bulk scanner from $19.99 a month.

The scanner reads HTML, scripts, stylesheets, meta tags, response headers, JavaScript globals and DNS nameservers or CNAME targets, and returns results in a few seconds. You can compare two sites side by side.

What to know: WebReveal's own blog says it has no prebuilt lists of websites by technology and no historical data, and its API returns tool names and versions without the evidence. It is a scanner, not a database of companies.

WebReveal fits anyone who needs a quick, free answer for a single site. See runsonwhat vs WebReveal.

Apify: best for developers building their own detection pipeline

Apify is a web scraping platform with a marketplace of about 84,000 "Actors", around 100 of which detect website technologies. Most are built by independent developers, and one is BuiltWith's official Actor. The platform has a free tier with $5 of usage a month; paid plans start at $19 a month, and Actors charge per site or per result.

Apify's strength is flexibility: schedule runs, call them by API, send results to webhooks, Make, Zapier or Google Sheets. The official BuiltWith Actor returns BuiltWith's database records for $2 per 1,000 results. Community detectors range from 45 to more than 7,600 fingerprints, and a few return evidence and confidence scores.

What to know: quality varies by Actor and most have few or no reviews. Most check the homepage only, several don't run JavaScript, and lists of companies by technology are rare: the one reverse-lookup Actor covers the top 300,000 sites, and the BuiltWith Actor doesn't support reverse lookup.

Apify fits developers who want to assemble and maintain their own pipeline. See runsonwhat vs Apify.

How much do BuiltWith, Wappalyzer, TheirStack, Bloomberry, WebReveal and Apify cost?

Their published prices range from free single-site lookups to about $1,000 a month. WebReveal and Apify cost tens of dollars a month for bulk use. TheirStack's API starts at $49 a month. Bloomberry starts at $199, Wappalyzer at $250 and BuiltWith at $295 a month for list building.

Prices were checked on each vendor's public pricing page on 8 October 2026; links are in the sources at the end.

Which tool is best for each use case?

For sales prospecting by technology, runsonwhat lists companies with proof and filters by industry, size and country. For e-commerce and frontend lists at the largest scale, BuiltWith. For browser lookups, Wappalyzer. For hiring intent, TheirStack. For churn on named competitors, Bloomberry. For a quick scan of one page, WebReveal. For custom pipelines, Apify.

How can you check what software a company uses?

Type the company's domain into runsonwhat's lookup. It reads the site's DNS, email records, subdomains, certificate logs and website code live and shows each tool with the record that gave it away. You can do part of this by hand: the steps below are what the lookup automates.

1. Read the email records. dig MX example.com names the email provider (Google Workspace, Microsoft 365, Proofpoint), and dig TXT example.com shows the SPF record (sending services such as SendGrid or HubSpot) and verification tokens left by SaaS tools.
2. Check common subdomains. help., status., jobs. and login. often point at a vendor (Zendesk, Atlassian Statuspage, Greenhouse, Okta) through a CNAME record.
3. Search certificate logs. crt.sh lists every public certificate issued for a domain, which reveals subdomains and when they first appeared.
4. View the page source. Scripts and tag-manager containers name analytics, ads and chat tools.
5. Read the subprocessor list. Many companies publish the vendors they share data with on a subprocessor or DPA page.

How we compared these tools

We compared the seven tools on 8 October 2026 using each vendor's public website, pricing page, documentation and browser-store listing, without logging in to any paid product. Ratings come from public review pages where they could be read. runsonwhat figures come from its database on the same day; the 26.5% figure comes from a random 1% sample of 143,424 listed matches.

Where a vendor's own pages disagree with each other, we say so and quote the specific page. Feature names follow each vendor's own wording. Counts of companies on runsonwhat are companies with direct public evidence of a tool, so they are lower bounds, not market sizes. The full method is on the methodology page.

Sources

• runsonwhat: database queries on 8 October 2026; methodology; dataset
• BuiltWith: plans, about, data coverage, all features, API, CRM integrations, G2 reviews
• Wappalyzer: pricing, technologies, lists FAQ, extension FAQ, lookup API, Chrome Web Store, G2 reviews
• TheirStack: pricing, about, how tech stack data is sourced, company data, job data
• Bloomberry: home, pricing, Bloomberry vs BuiltWith, API docs, Okta data page
• WebReveal: home, API documentation, bulk scanner, BuiltWith pricing alternatives
• Apify: pricing, about, BuiltWith official Actor, websites using technology Actor, Actors in Store