# Best tech stack lookup tools in 2026: what each one can see Published October 8, 2026, updated October 20, 2026 by runsonwhat Research Team. Source: https://www.runsonwhat.com/blog/best-tech-stack-lookup-tools > runsonwhat, BuiltWith, Wappalyzer, TheirStack, Bloomberry, WebReveal and Apify compared on where they look, what they miss, proof per match and price. The best tech stack lookup tool depends on what you need to see. runsonwhat finds companies by the tools they run, including tools that never appear on a website. BuiltWith has the biggest website crawl, Wappalyzer the most-used browser extension, and TheirStack reads job posts. ## Key takeaways - The seven tools differ most in where they look: website code, job posts, or infrastructure records such as DNS, email and certificates. - About a quarter of the matches in our data have no trace in website code, so a scanner that reads only web pages misses them. - Email, identity, collaboration and AI tools live in DNS and email records; marketing and payment tools live on the website. - runsonwhat keeps the public record behind every match, so you can check why a company is on a list. - Entry prices for list building run from tens of dollars a month for single-site scanners to $295 a month for BuiltWith. - Job posts show what a company hires for, not what it runs today, and they skip companies that aren't hiring. ## Which tech stack lookup tool should you use? Use runsonwhat to find companies by the tools they run, with proof and with the tools a website never shows. Use BuiltWith for very large lists of website technologies synced to a CRM, Wappalyzer for one-click checks in the browser, and TheirStack for tools named in job posts. The other three fill narrower jobs. In one line each: - **runsonwhat:** lists of companies on any tool it tracks, including tools behind the website, with the record behind each match. It reads DNS, email records, certificate logs, website code, a real-browser crawl and subprocessor lists. - **BuiltWith:** the largest website-technology database, with CRM sync, from its own web crawler. - **Wappalyzer:** browser-extension lookups, lead lists by technology and website alerts. - **TheirStack:** technologies named in job posts, which double as a hiring signal. - **Bloomberry:** adoption and churn for a fixed list of B2B products, from DNS, subdomains, certificate logs and script configurations. - **WebReveal:** free scans of one website at a time. - **Apify:** community scrapers for developers who want to build their own pipeline. The headline figures below describe runsonwhat's own data as of October 8, 2026. - **14.6M** tool matches on runsonwhat, each backed by a public record - **26.5%** of matches have no trace in website code (from a random sample of 143,424 matches) - **15,299** adoption dates proven by certificates, back to 2010 - **7** tech stack lookup tools compared on public pages ## What is a tech stack lookup tool, and who uses one? A tech stack lookup tool tells you which software a company runs, or which companies run a given piece of software. Sales teams use it to find prospects on a competitor's product, marketers to size a market, investors to track adoption, and engineers to see how a peer built its site. The two directions matter. A lookup by domain answers "what does this company use?", which any of the seven tools can do for a website. A lookup by tool answers "who uses this?", which needs a database built ahead of time. BuiltWith, Wappalyzer, TheirStack, Bloomberry and runsonwhat sell that second kind of answer. WebReveal and most Apify scrapers only do the first. The data behind the answer is where they really part ways. A tool can only list what its sources can see, so the method decides which tools show up at all, how fresh the list is, and whether you can check a match yourself. ## Where do these tools look for a company's software? They look in six kinds of public records. Website code shows marketing, analytics and frontend tools. DNS and email records show mail providers, security tools and verified SaaS accounts. Certificate logs show subdomains and when they appeared. Job posts show tools a company hires for, and subprocessor lists show vendors a company declares. Here is who reads what: - **Website code** (HTML, scripts, headers, cookies, tag managers): runsonwhat, BuiltWith, Wappalyzer, WebReveal, Bloomberry and most Apify scrapers. - **A real browser**, for tags that load only after the page runs: runsonwhat through HTTP Archive's monthly Chrome crawl of homepages, Wappalyzer's extension, and some Apify scrapers. - **DNS and email records** (verification tokens, SPF, MX, DKIM, DMARC): runsonwhat and Bloomberry in depth, BuiltWith partly, WebReveal for nameservers only. - **Certificate transparency logs and subdomains**, which reveal help centers, status pages and login portals pointed at a vendor: runsonwhat and Bloomberry. - **Job posts:** TheirStack. - **Subprocessor and DPA pages:** runsonwhat. A single method gives a partial picture. Job posts lag reality, and website code misses everything behind the site. Combining methods, and keeping the record each match came from, is what makes a list both complete and checkable. ## What can website scanners not see? Website scanners can't see tools that run behind the website: email providers, identity and security tools, collaboration suites, AI model providers and most back-office software. In runsonwhat's data, 26.5% of all tool matches have no trace in website code at all, so a scanner that only reads pages would miss them. That figure comes from a random sample of 143,424 listed matches taken on October 8, 2026. A match counted as invisible when none of its evidence came from the website, the tag managers or the browser crawl. For some of the most-searched tools the share is total, as the chart shows. **Share of each tool's matches with no trace in website code** | | % | | --- | ---: | | [Atlassian](https://www.runsonwhat.com/reverse/atlassian) | 100 | | [Anthropic](https://www.runsonwhat.com/reverse/anthropic) | 100 | | [OpenAI](https://www.runsonwhat.com/reverse/openai) | 100 | | [Zoom](https://www.runsonwhat.com/reverse/zoom) | 100 | | [Slack](https://www.runsonwhat.com/reverse/slack) | 100 | | [Notion](https://www.runsonwhat.com/reverse/notion) | 100 | | [SendGrid](https://www.runsonwhat.com/reverse/sendgrid) | 79 | | [Microsoft 365](https://www.runsonwhat.com/reverse/microsoft-365) | 59 | | [Google Workspace](https://www.runsonwhat.com/reverse/google-workspace) | 55 | | [Zendesk](https://www.runsonwhat.com/reverse/zendesk) | 35 | | [Salesforce](https://www.runsonwhat.com/reverse/salesforce) | 30 | | [HubSpot](https://www.runsonwhat.com/reverse/hubspot) | 20 | | [Cloudflare](https://www.runsonwhat.com/reverse/cloudflare) | 15 | | [Stripe](https://www.runsonwhat.com/reverse/stripe) | 11 | _runsonwhat matches found only in DNS, email, certificate or subprocessor records, from a random 2% sample of listed matches on 8 October 2026. A scanner that reads only web pages would miss these._ None of the sampled matches for [Atlassian](https://www.runsonwhat.com/reverse/atlassian), [Anthropic](https://www.runsonwhat.com/reverse/anthropic), [OpenAI](https://www.runsonwhat.com/reverse/openai), [Zoom](https://www.runsonwhat.com/reverse/zoom), [Slack](https://www.runsonwhat.com/reverse/slack) or [Notion](https://www.runsonwhat.com/reverse/notion) came from website code. Companies show up for these tools because they verified their domain with the vendor in DNS, route email through it, or point a subdomain at it. A few well-known tools show the split: - [Microsoft 365](https://www.runsonwhat.com/reverse/microsoft-365): 692,979 companies on runsonwhat, 59% with no website evidence. - [Google Workspace](https://www.runsonwhat.com/reverse/google-workspace): 392,452 companies, 55% with no website evidence. - [SendGrid](https://www.runsonwhat.com/reverse/sendgrid): 188,522 companies, 79% with no website evidence. - [Zendesk](https://www.runsonwhat.com/reverse/zendesk): 39,396 companies, 35% with no website evidence. - [Salesforce](https://www.runsonwhat.com/reverse/salesforce): 32,743 companies, 30% with no website evidence. - [HubSpot](https://www.runsonwhat.com/reverse/hubspot): 86,506 companies, 20% with no website evidence. - [Stripe](https://www.runsonwhat.com/reverse/stripe): 23,675 companies, 11% with no website evidence. The pattern is consistent. Marketing and payment tools live on the website, so scanners see most of them. Email, identity, collaboration and AI tools live in DNS and infrastructure records, so anyone listing companies on Slack, [Okta](https://www.runsonwhat.com/reverse/okta) or an AI provider needs a tool that reads those records. ## How does each tool compare on data, proof and freshness? The seven tools split into databases you query and scanners you run. Below, each one in turn: what it reads, what it's good at, and what to know before you pay. ### runsonwhat runsonwhat lists the companies that use a tool and the tools a company uses, built entirely from public records. In early October 2026 it tracked 1,787,212 company domains and 1,418 tools, and every match keeps the record that proves it. It sees behind the website, which is how it lists 57,695 companies on Anthropic and 64,074 on Atlassian. Company pages name the kind of record behind each tool, and the [live lookup](https://www.runsonwhat.com/lookup) shows the raw records for any domain. Dates are a second strength. There are 15,299 "since" dates proven by the first certificate of the subdomain that points at a vendor, going back to 2010; [Fastly](https://www.runsonwhat.com/reverse/fastly) at stripe.com, for example, dates to December 2014. Each company is rechecked, DNS weekly and websites about monthly, and a start or stop counts only between two checks done the same way. It is built for AI-era tools: 30,944 companies on OpenAI and 14,537 running [ChatGPT Ads](https://www.runsonwhat.com/reverse/chatgpt-ads). Every tool page lists its companies with industry, size, country and LinkedIn filters and a CSV export. The same data is available through [the runsonwhat API](https://www.runsonwhat.com/docs), and [the Chrome extension](https://www.runsonwhat.com/extension) shows any site's stack, with where each tool was found, from the browser toolbar. ### BuiltWith BuiltWith is the oldest and largest website-technology database. It was founded in 2007 and is based in Sydney, according to [its about page](https://builtwith.com/about), and it sells lists of websites by technology from its own crawler. [BuiltWith's plans page](https://builtwith.com/plans) says it has "Data from 491.9 million domains" and tracks "127,883 different web technologies." Single-site lookups are free; lists, exports and CRM sync are paid. Its strengths are scale and reach into sales tools: [its CRM integrations page](https://builtwith.com/crm-integrations) names Salesforce, HubSpot, Pipedrive, Zoho and Microsoft Dynamics 365. Lists are built from what its crawler sees on websites. For tools behind the website, see [runsonwhat vs BuiltWith](https://www.runsonwhat.com/blog/runsonwhat-vs-builtwith). ### Wappalyzer Wappalyzer is the most-installed technology profiler. Its [Chrome Web Store listing](https://chromewebstore.google.com/detail/wappalyzer-technology-pro/gppongmhjkpfnbhagpmjfkannfbllamg) shows 3,000,000 users, and [its technologies page](https://www.wappalyzer.com/technologies/) lists 8,166 web technologies. It is quick for one-off checks: open a site, click the extension, and see its CMS, analytics, frameworks and widgets. Paid plans add lead lists built by technology or keyword, APIs and CRM enrichment, and every account can track technology changes on a few websites through alerts. What to know: [its pricing page](https://www.wappalyzer.com/pricing/) says credits included in plans "expire after 60 days," so unused lookups don't carry over for long. See [runsonwhat vs Wappalyzer](https://www.runsonwhat.com/blog/runsonwhat-vs-wappalyzer). ### TheirStack TheirStack infers technology from job posts. It was "born in 2021" in A Coruña, Spain, per [its about page](https://theirstack.com/en/about-us), and links each detection to the posts it came from with a low, medium or high confidence score. Job posts are good at revealing back-end and data tools that never appear on a website, such as databases, ERPs and programming languages. On [its pricing page](https://theirstack.com/en/pricing), TheirStack lists "225M records" of job data and technographic APIs, webhooks and datasets. The limit is built into the source. [TheirStack's own documentation](https://theirstack.com/en/docs/data/technographic/how-we-source-tech-stack-data) says "A technology that is not mentioned is not a technology that is absent," and a company that isn't hiring won't appear under a technology. See [runsonwhat vs TheirStack](https://www.runsonwhat.com/blog/runsonwhat-vs-theirstack). ### Bloomberry Bloomberry tracks which companies start and stop using a fixed set of B2B products. [Its homepage](https://bloomberry.com/) says it covers "1,700+ products across 190 categories," read from new subdomains, DNS records, certificate transparency logs and the configuration inside script files. Its focus is timing: it reports which companies "just started or stopped paying" for a product, confirms churn by checking that an endpoint is really dead, and alerts when a renewal is approaching. Coverage is limited to its product list, and new vendors come through coverage requests on its Enterprise plans. App plans are priced by the number of vendors you track. See [runsonwhat vs Bloomberry](https://www.runsonwhat.com/blog/runsonwhat-vs-bloomberry). ### WebReveal WebReveal is a free website technology scanner that checks one site at a time. [Its homepage](https://webreveal.io/) claims "980+ Technologies Tracked" and says it reads HTML markup, scripts, stylesheets, meta tags and response headers. It also has a free Chrome extension. It is a scanner, not a company database. WebReveal's own [BuiltWith alternatives article](https://webreveal.io/blog/builtwith-pricing-alternatives.html) says it "does not offer a pre-built database of all websites organised by technology," and its comparison table marks historical data as unavailable. See [runsonwhat vs WebReveal](https://www.runsonwhat.com/blog/runsonwhat-vs-webreveal). ### Apify Apify is a web scraping platform, not a technographic database. [Its about page](https://apify.com/about) lists 93,188 ready-made Actors in its store, a small share of which detect website technologies, mostly built by independent developers. The strength is flexibility: schedule runs, call them by API, and send results to webhooks or spreadsheets. BuiltWith publishes an [official Actor](https://apify.com/builtwith/builtwith-official-technology-scraper) at "$2.00 / 1,000 results" that takes a list of domains as input. Quality varies by Actor, and lists of companies by technology are rare. See [runsonwhat vs Apify](https://www.runsonwhat.com/blog/runsonwhat-vs-apify). ## How much do tech stack lookup tools cost? Published prices run from free single-site lookups to about a thousand dollars a month. WebReveal and Apify cost tens of dollars a month for bulk use, TheirStack's API starts lower than the list-building databases, and Bloomberry, Wappalyzer and BuiltWith sit in the hundreds. These are the vendors' own figures, checked on October 20, 2026. - **BuiltWith:** free lookups for single sites; Basic is $295 a month for two technologies, and Pro is $495 with unlimited technologies, per [its plans page](https://builtwith.com/plans). - **Wappalyzer:** a free account includes 50 lookups a month; Pro is $250 a month, per [its pricing page](https://www.wappalyzer.com/pricing/). - **TheirStack:** API plans start at $49 a month for 1,500 credits, per [its pricing page](https://theirstack.com/en/pricing), and app credits are sold as one-time packs. - **Bloomberry:** app and API Starter plans are both $199 a month, with app access covering two vendors, per [its pricing page](https://bloomberry.com/pricing.html). - **WebReveal:** free scans on the site; the bulk scanner is $19.99 a month for 1,000 scans, per [its bulk scanner page](https://webreveal.io/bulk-scanner.html). - **Apify:** the free plan includes $5 of usage a month and Starter is $19, per [its pricing page](https://apify.com/pricing), plus whatever each Actor charges. The models differ more than the sticker prices. BuiltWith and Wappalyzer sell subscriptions with limits on technologies or credits, Bloomberry prices by tracked vendor, TheirStack and Apify by usage. Count how many tools and how many companies you actually need before comparing. ## Which tool is best for each use case? For sales prospecting by technology, runsonwhat lists companies with proof and filters them by industry, size and country. For the largest lists of sites on a frontend or ecommerce technology, BuiltWith. For browser lookups, Wappalyzer. For hiring intent, TheirStack. For churn on named competitors, Bloomberry. For a quick scan, WebReveal. For custom pipelines, Apify. - **Build a list of companies on a tool:** runsonwhat, with filters, CSV export and proof for each match. - **Find companies on email, identity, collaboration or AI tools:** runsonwhat, because it reads the DNS, email and certificate records where these tools show up. - **Know when a company adopted a tool:** runsonwhat, with certificate-proven adoption dates going back years. - **Spot who left a competitor:** runsonwhat or Bloomberry. Both track starts and stops; runsonwhat covers every tool it tracks. - **Hiring intent for engineering and data tools:** TheirStack. - **The widest list of sites on a frontend or ecommerce technology:** BuiltWith. - **Check a site while browsing:** Wappalyzer or [the runsonwhat extension](https://www.runsonwhat.com/extension), which adds DNS, email and certificate findings. - **Pull technographic data into your own systems:** the [runsonwhat API](https://www.runsonwhat.com/docs), or Apify if you want to build the scraper yourself. ## How can you check what software a company uses yourself? Type the company's domain into runsonwhat's [lookup](https://www.runsonwhat.com/lookup), which reads the site's DNS, email records, subdomains, certificate logs and website code live and shows each tool with the record that gave it away. You can do part of this by hand, and the steps below are what the lookup automates. 1. **Read the email records.** An MX lookup names the email provider, and the TXT records show the SPF record, which lists sending services, plus verification tokens left by SaaS tools. 2. **Check common subdomains.** Help, status, jobs and login subdomains often point at a vendor such as Zendesk, Atlassian Statuspage, Greenhouse or Okta. 3. **Search certificate logs.** crt.sh lists every public certificate issued for a domain, which reveals subdomains and when they first appeared. 4. **View the page source.** Scripts and tag-manager containers name analytics, ads and chat tools. 5. **Read the subprocessor list.** Many companies publish the vendors they share data with on a subprocessor or DPA page. ## How we counted We compared the seven tools using each vendor's public website, pricing page, documentation and browser-store listing, without logging in to any paid product, and rechecked every price and vendor claim on October 20, 2026. Feature names follow each vendor's own wording. runsonwhat figures come from its database on October 8, 2026, and the share of matches with no website trace comes from a random sample of listed matches. Counts of companies on runsonwhat are companies with direct public evidence of a tool, so they are lower bounds, not market sizes. The full method is on the [methodology page](https://www.runsonwhat.com/methodology). ## Frequently asked questions ### What is the best alternative to BuiltWith? runsonwhat is the best BuiltWith alternative for building lists of companies, because it lists the companies on each of 1,418 tools with industry, size and country filters and CSV export, and it also finds tools that live behind the website. BuiltWith remains the biggest website-only database, with list plans starting at $295 a month on its own plans page. ### What is the best alternative to Wappalyzer? runsonwhat is the best Wappalyzer alternative when you need tools behind the website or lists with proof. It reads DNS, email and certificate records, which is how it finds companies on Slack, Okta, Atlassian and OpenAI, and it keeps the record behind every match. Its Chrome extension shows the same findings while you browse, while Wappalyzer's extension reads the page itself. ### How do I find all companies that use a specific software? Open the tool's page on runsonwhat, for example companies that use HubSpot, which lists 86,506 companies with industry, size and country filters and CSV export. Each match is backed by a public record, and the same lists are available through the runsonwhat API. BuiltWith, Wappalyzer, TheirStack and Bloomberry also sell lists of companies by technology. ### Can tech stack lookup tools see back-end software like email or SSO? Website scanners mostly can't, because email, identity and single sign-on tools don't load on a website. runsonwhat and Bloomberry read DNS, email and certificate records, which reveal email providers, identity tools and verified SaaS accounts. TheirStack finds back-end tools when a company names them in job posts. In runsonwhat's data, 59% of Microsoft 365 matches have no website trace. ### Can I see when a company started using a tool? Yes, on runsonwhat, where 15,299 adoption dates are proven by the first certificate of the subdomain that points at the vendor. Stripe, for example, has used Fastly since at least December 2014. Bloomberry also attaches dates to the starts and stops it reports for its product list, and job posts give TheirStack a rough sense of timing. ### Which tool is best for finding companies that use AI tools? runsonwhat is the best tool for finding companies on AI tools, because model providers are found through DNS verification records rather than website code. It lists 57,695 companies on Anthropic and 30,944 on OpenAI, none of them from website evidence in our sample. It also tracks AI ad platforms such as ChatGPT Ads and coding tools such as Cursor. ## Other comparisons - [runsonwhat vs BuiltWith](https://www.runsonwhat.com/blog/runsonwhat-vs-builtwith) - [runsonwhat vs Wappalyzer](https://www.runsonwhat.com/blog/runsonwhat-vs-wappalyzer) - [runsonwhat vs TheirStack](https://www.runsonwhat.com/blog/runsonwhat-vs-theirstack) - [runsonwhat vs Bloomberry](https://www.runsonwhat.com/blog/runsonwhat-vs-bloomberry) - [runsonwhat vs WebReveal](https://www.runsonwhat.com/blog/runsonwhat-vs-webreveal) - [runsonwhat vs Apify](https://www.runsonwhat.com/blog/runsonwhat-vs-apify) ## Sources - runsonwhat: database queries on October 8, 2026; [methodology](https://www.runsonwhat.com/methodology); [dataset](https://www.runsonwhat.com/data/tool-counts.csv); [API docs](https://www.runsonwhat.com/docs); [Chrome extension](https://www.runsonwhat.com/extension) - BuiltWith: [plans](https://builtwith.com/plans), [about](https://builtwith.com/about), [CRM integrations](https://builtwith.com/crm-integrations) - Wappalyzer: [pricing](https://www.wappalyzer.com/pricing/), [technologies](https://www.wappalyzer.com/technologies/), [Chrome Web Store](https://chromewebstore.google.com/detail/wappalyzer-technology-pro/gppongmhjkpfnbhagpmjfkannfbllamg) - TheirStack: [pricing](https://theirstack.com/en/pricing), [about](https://theirstack.com/en/about-us), [how tech stack data is sourced](https://theirstack.com/en/docs/data/technographic/how-we-source-tech-stack-data) - Bloomberry: [home](https://bloomberry.com/), [pricing](https://bloomberry.com/pricing.html) - WebReveal: [home](https://webreveal.io/), [bulk scanner](https://webreveal.io/bulk-scanner.html), [BuiltWith pricing alternatives](https://webreveal.io/blog/builtwith-pricing-alternatives.html) - Apify: [pricing](https://apify.com/pricing), [about](https://apify.com/about), [BuiltWith official Actor](https://apify.com/builtwith/builtwith-official-technology-scraper)