> Enrich.chat gives AI agents verified work emails and mobiles. To use it from an agent, read https://enrich.chat/agents.md . This is the Markdown version of https://enrich.chat/tools/tech-stack-lookup/

> **Note for agents:** this tool is a web form that people use in a browser, so you cannot submit it. Use the Enrich.chat API instead, as described in https://enrich.chat/agents.md .

# Tech stack lookup: a free BuiltWith alternative

Enter a company website to list the technologies it runs that are visible from the outside, each with a category such as CRM, payments or CDN. Then find the right people at that account with the same API.

By Enrich.chat Editorial. Updated October 15, 2026.

## What you get

- The technologies visible on a company's website
- A category for each one, such as CRM, payments or CDN
- The same lookup from your AI agent through /v1/company/tech

Your 10 free lookups are shared across Enrich.chat's free tools. A lookup with no match does not use one.

**Short answer:** A tech stack lookup finds the software a company uses by matching public traces, such as script URLs, JavaScript variables, HTTP headers, cookies and DNS records, against known [technology fingerprints](https://github.com/enthec/webappanalyzer). [BuiltWith's paid plans](https://builtwith.com/plans) start at $295 a month. Enrich.chat's free lookup gives you 10 checks with no signup, and its API also finds the right contacts at that account.

## Key takeaways

- A tech stack lookup matches script URLs, JavaScript variables, HTTP headers, cookies and DNS records against known fingerprints.
- Of the 7,628 open fingerprints we counted, 3,889 match on script URLs and only 140 use DNS records.
- Back-office tools such as ERP rarely leave public traces, so a website scan cannot list them.
- BuiltWith starts at $295 a month and leads on historical lead lists. Wappalyzer starts at $250 a month.

## Three steps, a few seconds

1. **Enter the website.** Type the company's website, such as acme.com. One domain per lookup.
2. **Run the lookup.** The tool lists each technology it can see on the domain, with its category, such as CRM or payments.
3. **Act on the stack.** Keep the accounts that fit, then find the right people there with the lead list builder or your AI agent.

## How does a tech stack lookup work?

A tech stack lookup loads a company's website and compares what it finds with a library of fingerprints. Each fingerprint names the script, header, cookie or DNS record that gives a product away. A match becomes one technology with a category, such as CRM, payments or CDN.

The best public example of this method is Wappalyzer's fingerprint format. Wappalyzer itself [went private in August 2023](https://github.com/enthec/webappanalyzer), but the community fork enthec/webappanalyzer keeps the files open. Its README says the patterns inspect HTML code, JavaScript variables, response headers and more. The signals fall into three groups.

- **Page code.** Script URLs, JavaScript variables, meta tags and page elements. The open [HubSpot fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json) matches scripts served from hs-scripts.com and a JavaScript variable named _hsq. The [Stripe fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json) matches scripts loaded from js.stripe.com.
- **HTTP response.** The headers and cookies the server sends back. The [Server header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server) describes the software that handled the request. The [X-Powered-By header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Powered-By) names the framework: Express apps usually send `X-Powered-By: express`. The [Cloudflare fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/c.json) matches a Server value of cloudflare or a cf-ray header. A cookie named _shopify_y [points to Shopify](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json).
- **DNS records.** Public records that reveal email and SaaS vendors. An MX record of aspmx.l.google.com means the domain's mail runs on [Google Workspace](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/g.json). SPF records are published as TXT records. Their include mechanism, defined in [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html#section-5.2), names outside domains that may send mail for the company. [Google's SPF guide](https://support.google.com/a/answer/10685031) shows include:servers.mcsv.net for a domain that also sends through Mailchimp. Verification records such as [hubspot-domain-verification](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json) give away more vendors.

**Figure 1: Where a tech stack lookup finds evidence.** Three sources of evidence, each with two real fingerprint patterns. Page code: a script URL from js.stripe.com means Stripe, and a JavaScript variable named _hsq means HubSpot. HTTP response: a Server header of cloudflare means Cloudflare, and a _shopify_y cookie means Shopify. DNS records: an MX record of aspmx.l.google.com means Google Workspace, and an SPF include of servers.mcsv.net means Mailchimp.

*Three places a tech stack lookup finds evidence, shown with real fingerprint patterns. Sources: the open fingerprints in [enthec/webappanalyzer](https://github.com/enthec/webappanalyzer), [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server) and [Google's SPF guide](https://support.google.com/a/answer/10685031).*

Most fingerprints still rely on page code. We counted all 7,628 technology definitions in the [fork's technology files](https://github.com/enthec/webappanalyzer/tree/main/src/technologies) on October 15, 2026. Of those, 3,889 match on script URLs and 3,342 on JavaScript variables. Only 669 use HTTP headers, and just 140 use DNS records.

**Figure 2: Signals used by 7,628 open technology fingerprints.** A bar chart of how many of the 7,628 technology definitions in enthec/webappanalyzer use each signal type: script URLs 3,889 (51%), JavaScript variables 3,342 (44%), page elements 1,622 (21%), inline script code 793 (10%), meta tags 757 (10%), HTTP headers 669 (9%), cookies 375 (5%), HTML patterns 348 (5%) and DNS records 140 (2%).

*How many of the 7,628 technology definitions in the open Wappalyzer-format fingerprints use each signal type, counted on October 15, 2026. Smaller types such as XHR hosts and certificates are not shown. Source: [enthec/webappanalyzer on GitHub](https://github.com/enthec/webappanalyzer/tree/main/src/technologies).*

The lookup at the top of this page returns the technologies visible for a domain, each with its category. Each check uses 1 of your 10 free lookups, and a lookup that finds no match does not count. To see how stack data differs from size and industry data, read our guide to [firmographic vs technographic data](https://enrich.chat/blog/firmographic-data/).

## What can't a tech stack checker see?

A tech stack checker sees only what a company shows the public internet. Back-office software, trimmed headers and recent changes are its blind spots. Treat every result as evidence, not proof.

- **Back-office tools.** ERP, HR and finance systems run behind a login and leave nothing on the public website. Vendors that track them use other inputs. [HG Insights' Technology Discovery site](https://discovery.hginsights.com/) lists products such as SAP S/4HANA, JD Edwards and Deltek. HG says its data comes from [over 20 billion second- and third-party data points](https://hginsights.com/).
- **Hidden headers.** [MDN warns](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server) that a detailed Server header can make known flaws easier to find, so many sites trim it. MDN adds that server software can still be fingerprinted in other ways.
- **Pages the scan never loads.** A tag that fires only at checkout or after cookie consent can slip past a homepage scan. [Wappalyzer's lookup API](https://www.wappalyzer.com/docs/api/v2/lookup/) follows internal links by default to cover more pages for this reason.
- **Stale results.** A database shows what it saw on its last crawl. [BuiltWith's Domain API](https://api.builtwith.com/domain-api) returns a first-detected and last-detected date for each technology. [Wappalyzer's API](https://www.wappalyzer.com/docs/api/v2/lookup/) returns cached results unless you ask for a live scan. [Similarweb says](https://www.similarweb.com/technology/) it updates its tech stack data weekly.
- **False positives.** Short or generic patterns can match the wrong product. The open fingerprint format has a [confidence tag](https://github.com/enthec/webappanalyzer) for less reliable patterns that may cause false positives.
- **DNS shows mail senders, not every vendor.** SPF lists only services that send email as the domain, and [RFC 7208 caps](https://www.rfc-editor.org/rfc/rfc7208.html#section-4.6.4) DNS-querying terms such as include at 10 per check.

When a deal depends on one tool, open the page source or ask the buyer. To see a domain's MX records and mail provider on their own, use the [catch-all checker](https://enrich.chat/tools/catch-all-checker/).

## How do sales teams use tech stack data?

Sales teams use tech stack data to choose accounts, time a pitch and write a first line that fits. Four plays cover most of it.

| Play | What you look for | Example |
| --- | --- | --- |
| Account targeting | Companies on a platform you integrate with | Shopify stores, if you sell a Shopify app |
| Competitive displacement | Accounts running a rival product | Sites using a competitor's chat widget |
| Integration fit | The CRM or email tool the account runs | HubSpot or Salesforce, so your sync works on day one |
| Personalization | A detail for the first line of an email | A note that the store moved its checkout to Stripe |

Timing matters most for displacement. [BuiltWith's plans](https://builtwith.com/plans) include usage alerts when a list of websites starts or stops using a technology, a common trigger for outreach.

The stack tells you which account to call. It does not tell you who to call. Figure 3 shows the full path from a domain to a verified contact.

**Figure 3: From tech stack to target account to contact.** A three-step flow. First, the company endpoint returns the tech stack for acme.com: HubSpot, Salesforce and Stripe. Second, you or your agent keep the account if it has integration fit, a rival product to replace and the right size. Third, the company people endpoint and the person endpoint return the buyer, Jane Doe, head of RevOps, with a verified work email.

*An account-based workflow from tech stack to verified contact. Endpoints from Enrich.chat's [agent docs](https://enrich.chat/agents.md). The company and person are examples.*

Start from a list of domains, or build one with the [lead list builder](https://enrich.chat/tools/lead-list-builder/) or the [companies using directory](https://enrich.chat/companies-using/). Check each stack, keep the accounts that fit, then find the buyer. The [email finder](https://enrich.chat/tools/email-finder/) handles one person at a time, and your AI agent can run the whole list.

## What is the best BuiltWith alternative?

The best BuiltWith alternative depends on what happens after the lookup. If you want the tech stack and the right contacts at the same account through one API, Enrich.chat fits best. If you need historical web-tech lead lists, BuiltWith itself is still the stronger tool.

*Prices from each vendor's own page, checked October 15, 2026. Plans change often, so check before you buy.*

| Tool | Price | Free option | Best for |
| --- | --- | --- | --- |
| **Enrich.chat** | Monthly plans: Growth $29, Scale $90, Pro $299. A tech stack found uses 5 credits | 10 lookups on the website tools, plus 10 a day for agents | Tech stack and contacts at the same account, from an AI agent or code |
| [BuiltWith](https://builtwith.com/plans) | Basic $295 a month, Pro $495, Team $995 | Free single-site lookups | Historical lead lists and trends |
| [Wappalyzer](https://www.wappalyzer.com/pricing/) | Pro $250 a month, Business $450, Enterprise from $850 | Free account with 50 lookups a month | Browser research and lead lists. API needs Business |
| [HG Insights](https://hginsights.com/pricing/) | Not published. Standard contract is two years | No free trial | Enterprise installs, IT spend and back-office tech |
| [Similarweb Sales Intelligence](https://www.similarweb.com/packages/sales/) | Individual $99 a month billed yearly, or $129 monthly. Business and Enterprise by quote | Free trial | Web traffic data next to the stack |
| [webappanalyzer (open source)](https://github.com/enthec/webappanalyzer) | Free under GPL-3.0 | Run it yourself | Developers scanning sites in their own code |

Enrich.chat is built for people who work from an AI agent or their own code. The same API that returns the stack also returns the company's size, industry and location, then the people there, with each work email returned with a status. Plans start at $29 a month for 100,000 credits, include unlimited seats and bill monthly with no annual contract. Credits are spent only on matches, so a lookup that finds nothing uses 0 credits.

Wappalyzer and Similarweb also put contact details next to technographics. [Wappalyzer's lookup API](https://www.wappalyzer.com/docs/api/v2/lookup/) can return company details and email addresses, but it needs the $450 Business plan. [Similarweb's Business plan](https://www.similarweb.com/packages/sales/) adds API and MCP access at a quoted price. Both are monthly subscriptions.

Two limits to know about Enrich.chat. It has no browser extension, so you can't check a site as you browse. And the tech stack is a plain list of technologies by category, with no trend charts, usage alerts or first-seen dates.

## When is BuiltWith the better choice?

BuiltWith is the better choice when you need history, or a list of every site that uses a technology. Those are BuiltWith's core strengths, and Enrich.chat is not built for them.

- **Historical lead lists.** [BuiltWith's plans](https://builtwith.com/plans) include 18+ years of technology trend history and an Advanced Lookup of past technology use across a business. Its [API page](https://api.builtwith.com/) offers datasets of technology usage from 2000 to today, and a Lists API of websites that use a given technology.
- **Change triggers.** Usage alerts and a [Change API](https://api.builtwith.com/) report technologies that a site adds or removes. That suits displacement campaigns.
- **Agent access.** BuiltWith offers its [API endpoints as MCP tools](https://api.builtwith.com/). Enrich.chat has a [remote MCP server](https://enrich.chat/install/) too, with a `company_tech_stack` tool, so an agent can use either. The difference is scope: Enrich.chat's tool returns one company's technologies by category, not lists or history.

Other tools win in other cases. Pick HG Insights for back-office installs and IT spend at large companies, if a two-year contract fits your budget, as its [pricing guide](https://hginsights.com/pricing/) describes. Pick Wappalyzer if you research sites as you browse: it has [extensions for Chrome, Firefox, Edge and Safari](https://www.wappalyzer.com/apps/). Pick Similarweb when web traffic data matters as much as the stack. For a wider view of vendors, see our list of the [best data enrichment tools](https://enrich.chat/blog/best-data-enrichment-tools/).

## How do you get a tech stack and the right contacts from an AI agent?

Paste one prompt into ChatGPT, Claude, Cursor or any agent that can make web requests. The agent reads enrich.chat/agents.md, calls the company endpoint for the stack, then the people endpoint for the buyer. Or add the remote MCP server at enrich.chat/mcp, which needs no key, and use its `company_tech_stack` and `company_people` tools; the [install page](https://enrich.chat/install/) has one-click links. There is no SDK to install and no signup.

```text
Use www.enrich.chat to look up the tech stack for each company website in this list. Keep the companies that use HubSpot or Salesforce, then find the head of revenue operations at each one with a verified work email.
```

Behind the prompt, the agent makes requests like these:

```
GET https://enrich.chat/v1/company/tech?domain=acme.com
GET https://enrich.chat/v1/company/people?domain=acme.com&title=revops
```

Each IP address gets 10 free lookups a day. After that, monthly plans start at $29 for 100,000 credits. A tech stack found uses 5 credits, a person or company profile uses 5, and a work email found uses 10. A lookup with `found` false uses 0, and each response shows `credits_used`. See [pricing](https://enrich.chat/pricing/) for mobiles and every plan, the guide to [Enrich.chat for AI agents](https://enrich.chat/agents/) for setup, and the [people enrichment API](https://enrich.chat/api/person-enrichment/) to enrich a list you already have. New to the idea? Start with [what data enrichment is](https://enrich.chat/blog/what-is-data-enrichment/).

## Frequently asked questions

### Is there a free BuiltWith alternative?

Yes. Enrich.chat's tech stack lookup is free with no signup. You get 10 lookups shared across the website tools, and a lookup with no match does not count. [Wappalyzer's free account](https://www.wappalyzer.com/pricing/) includes 50 technology lookups a month. [BuiltWith](https://builtwith.com/plans) itself is free for single-site lookups. Developers can also run the open fingerprints from [enthec/webappanalyzer](https://github.com/enthec/webappanalyzer) in their own code at no cost.

### Is Wappalyzer still open source?

No. Wappalyzer went private in August 2023, according to [the community fork](https://github.com/enthec/webappanalyzer) that continues its fingerprint files under the GPL-3.0 license. [HTTP Archive keeps a fork](https://github.com/HTTPArchive/wappalyzer) of the last open-source version for its monthly crawl, and notes that the Wappalyzer website and browser extension are now closed source. The enthec fork keeps the same JSON format, so it is the easiest open option to build on.

### How accurate is a tech stack lookup?

No checker can promise one accuracy figure, because results depend on what each site exposes. A match on a unique script or header is strong evidence. Generic patterns can misfire, which is why the open fingerprint format has a [confidence tag](https://github.com/enthec/webappanalyzer) for less reliable patterns. [BuiltWith's API](https://api.builtwith.com/domain-api) scores each technology from 0 to 1 and lowers the score for one-off detections. Check the page source when a decision depends on one tool.

### Can you tell what CRM a company uses from its website?

Sometimes. A CRM shows up when it puts code on the site. The open [HubSpot fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json) matches its tracking script from hs-scripts.com, and the [Salesforce fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json) matches Salesforce TXT records in DNS. Many CRMs run only behind a login and leave no trace. For those, vendors such as [HG Insights](https://hginsights.com/) sell install data built from sources other than the website.

### How do I find all the companies that use a specific technology?

You need a reverse lookup: websites by technology, not technologies by website. [BuiltWith's Lists API](https://api.builtwith.com/) returns sites using a technology across the web, and [Wappalyzer's paid plans](https://www.wappalyzer.com/pricing/) build lead lists by technology. Our [companies using directory](https://enrich.chat/companies-using/) groups companies by technology. Once you have the accounts, the [lead list builder](https://enrich.chat/tools/lead-list-builder/) or your AI agent can find the right people at each one.

### How much does BuiltWith cost?

[BuiltWith's plans page](https://builtwith.com/plans) lists Basic at $295 a month, Pro at $495 and Team at $995, checked on October 15, 2026. Basic covers 2 technologies and 2 keywords. Pro and Team are unlimited, and Team adds unlimited Pro logins. Single-site lookups are free. The minimum term is one month on monthly plans and one year on yearly plans, and you can cancel at any time.

## Sources

1. [webappanalyzer: open Wappalyzer-format technology fingerprints (README)](https://github.com/enthec/webappanalyzer)
2. [HubSpot fingerprint, src/technologies/h.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json)
3. [Stripe, Salesforce and Shopify fingerprints, src/technologies/s.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json)
4. [Cloudflare fingerprint, src/technologies/c.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/c.json)
5. [Google Workspace fingerprint, src/technologies/g.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/g.json)
6. [Wappalyzer fork used for the HTTP Archive crawl](https://github.com/HTTPArchive/wappalyzer)
7. [Server header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server)
8. [X-Powered-By header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Powered-By)
9. [RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email](https://www.rfc-editor.org/rfc/rfc7208.html)
10. [Set up SPF](https://support.google.com/a/answer/10685031)
11. [BuiltWith plans and pricing](https://builtwith.com/plans)
12. [BuiltWith API](https://api.builtwith.com/)
13. [BuiltWith Domain API documentation](https://api.builtwith.com/domain-api)
14. [Wappalyzer plans and pricing](https://www.wappalyzer.com/pricing/)
15. [Wappalyzer technology lookup API](https://www.wappalyzer.com/docs/api/v2/lookup/)
16. [Wappalyzer apps and browser extensions](https://www.wappalyzer.com/apps/)
17. [HG Copilots pricing guide](https://hginsights.com/pricing/)
18. [HG Insights home page](https://hginsights.com/)
19. [HG Insights Technology Discovery](https://discovery.hginsights.com/)
20. [Similarweb Sales Intelligence plans and pricing](https://www.similarweb.com/packages/sales/)
21. [Similarweb website technology lookup](https://www.similarweb.com/technology/)

## Tech stack plus contacts in one API

Your AI agent gets the tech stack from /v1/company/tech and the right people from /v1/company/people. 10 free lookups a day, then monthly plans from $29, where a tech stack found uses 5 credits.

```bash
curl "https://enrich.chat/v1/company/tech?domain=acme.com"
```

## Try this prompt

Get the tech stack and the buyer

```text
Use www.enrich.chat to look up the tech stack for acme.com, tell me if it uses HubSpot or Salesforce, then find the head of revenue operations there with a verified work email
```

## Related

- [Firmographic vs technographic data](https://enrich.chat/blog/firmographic-data/)
- [Companies using a technology](https://enrich.chat/companies-using/)
- [AI lead list builder](https://enrich.chat/tools/lead-list-builder/)