Documenso vs DocuSeal

Documenso and DocuSeal are the two self-hosted tools people find when they want DocuSign without a per-envelope bill: upload a PDF, place signature and form fields, send it out, and get back a signed PDF with a record of who did what. Both are AGPL-3.0, both ship an official Docker image, and both run a paid tier alongside the free code. The differences that matter are how much setup each one asks for, which features each free edition keeps, and how the finished PDF gets its digital signature.

Same licence, different paid edges

Documenso is open core. The repository is AGPL-3.0 except for packages/ee/, which is under the Documenso Commercial License and may only be used in production with "a valid Documenso Enterprise Edition subscription". The FEATURES file lists what that covers: the organisation authentication portal (SSO with SAML and OIDC), passkey and 2FA re-authentication for document actions, 21 CFR Part 11, custom email domains, and the embedded authoring editor with its white-label option. The admin panel also marks HIPAA and QES signing as Enterprise flags. Enterprise pricing is not published; the docs send you to sales.

DocuSeal is AGPL-3.0 with one extra term under section 7(b): a covered work "must retain the original DocuSeal attribution in interactive user interfaces". Paid features come from a Pro licence. DocuSeal's on-premises page prices it at $240 per user per year, plus $0.20 per document signed via API or embedding.

Both licences let a company run the software internally for free. If you plan to change the code and offer it to other people over a network, the AGPL source-disclosure rules apply to both. Documenso's docs add that calling its API from your own application "does not create a derivative work".

What the free self-hosted edition keeps

This is the biggest practical difference, and it mostly favours Documenso.

Documenso's Community Edition includes templates, direct signing links, multiple recipients with roles and signing order, the REST API, webhooks and API tokens. Its field types are signature, initials, name, email, date, text, number, radio, checkbox and dropdown. On a self-hosted instance, features are per-organisation flags an admin sets in /admin. Several flags are not marked Enterprise: embedded signing (React, Vue, Angular, Svelte, Solid and Preact SDKs), white-label for embedded signing, signing reminders, custom branding and hiding the Documenso branding. What needs a licence is the list above: SSO, the embedded editor, custom email domains and the compliance modes.

DocuSeal's free edition includes a WYSIWYG PDF field builder with 12 field types, multiple submitters per document, SMTP email, storage on disk or on S3, Google Cloud Storage or Azure, PDF signature verification, users, webhooks and a basic API. Its pricing table also marks these as free on-premises: unlimited storage and templates, the audit log, shared-link and in-person signing, witnesses, attachments, automatic field detection and custom email messages. Pro adds your company logo and white-labelling, user roles, automated reminders, SMS invitations and verification, conditional fields and formulas, bulk send from CSV or XLSX, SSO/SAML, templates built from HTML or tagged PDF/DOCX over the API, and the embedded signing form and form builder.

So on the free editions, embedding a signing form in your own app, reminders and custom branding are available in Documenso and paid in DocuSeal. DocuSeal does not bill per seat for its free on-prem edition; its Pro licence does.

The signing certificate

Each tool seals the completed PDF with an X.509 digital signature, which shows whether the file changed after signing. They handle the certificate very differently.

Documenso ships no certificate. Its requirements page says that without one "the application starts normally but all document signing will fail". You make a password-protected .p12 with OpenSSL (a certificate without a password fails with "Failed to get private key bags"), put it at /opt/documenso/cert.p12 owned by UID 1001, and set the passphrase in .env. The docs say a self-signed certificate is enough where "your industry has no special signing regulations". Adobe Acrobat will then warn that the signature cannot be verified. For Acrobat's green checkmark you need a certificate from an Adobe Approved Trust List vendor; for that case the docs also suggest a Google Cloud HSM or another external HSM. Qualified signatures through a CSC trust service provider need an Enterprise licence.

DocuSeal generates the certificate for you. Its /setup step, which creates the first admin, also stores a newly generated signing certificate. DocuSeal's pricing table lists the free edition's certificate as "Self-signed" and a "Trusted signing certificate" as a Pro feature.

On legal weight, neither tool can promise more than its own docs do. Documenso's compliance page lists ESIGN, UETA and eIDAS simple electronic signatures as compliant and eIDAS advanced and qualified as planned. It adds that "the legal validity of SES depends on the specific transaction and jurisdiction". DocuSeal's pricing lists "legally-binding signing" on every plan. Both attach an audit log. Documenso's records when the document was sent, viewed and signed, with IP addresses and timestamps. If a document type needs a specific signature level, check the law that applies to it, not a vendor's marketing page.

Footprint and setup

DocuSeal is the easier install. The README's quickest path is one docker run that keeps SQLite and files under a mounted directory. The production path is upstream's Compose file: the app, PostgreSQL 18 and Caddy, which requests a Let's Encrypt certificate for the HOST you pass. MySQL also works through DATABASE_URL. The images are tagged by release, so you can pin one. DocuSeal publishes no RAM requirement. Our 1 GB is an estimate for the app plus PostgreSQL.

Documenso takes more work. It needs PostgreSQL 14 or later; the docs say MySQL and SQLite are not supported. It also needs a signing certificate, an SMTP server and a reverse proxy for TLS. The production Compose file runs two services (the app and PostgreSQL 15). It refuses to start until the eleven variables it marks required are set, including three secrets and the SMTP sender. Documents are stored in PostgreSQL by default, and upstream recommends S3 for larger volumes. New signups are ordinary users, so you grant ADMIN by updating the user row in the database. Upstream lists 1 GB of RAM as the minimum for testing, 2 GB for production, and at least 2 GB available for the Compose deployment.

We rate DocuSeal 1 out of 5 to deploy and Documenso 3 out of 5. Neither has been install-tested on this site.

Which to choose

Choose DocuSeal if you want signing running today with little setup. One Compose file handles HTTPS and generates the certificate for you, and you can start on SQLite and move to PostgreSQL or MySQL later. The free edition's field builder, audit log and webhooks cover a small team sending its own documents. Budget for Pro if you need reminders, SSO, bulk send, your own branding or embedding.

Choose Documenso if you want more features free: embedded signing in your own app, reminders and custom branding, all as admin toggles. It also suits you if you want to choose the signing certificate yourself, whether that is an AATL-listed certificate or an HSM-backed key. Plan for the setup: PostgreSQL, SMTP, a .p12 certificate, a reverse proxy and one manual database update for the first admin.

Choosing between DocuSeal and Documenso

Starting from DocuSeal, the reason to move is usually a paywall. If you need reminders, embedding or white-labelling and do not want per-seat pricing, Documenso's free edition has them. The cost is a longer install.