Email links that let each recipient sign in the browser
Documenso is a TypeScript web app for collecting signatures, billed in its repository as "The Open Source DocuSign Alternative." You upload a PDF, drop fields on it, and each recipient gets an email link to sign in the browser. Once everyone has signed, the instance signs the PDF with its own X.509 certificate and generates an audit log and a certificate of completion.
DocuSeal covers the same ground in Ruby on Rails, and OpenSign in Node.js on MongoDB. @signpdf sits one layer down: it is a Node.js library that signs a PDF, with no interface and nothing sent to signers.
The open source e-signature comparison looks at what each tool puts in the PDF and what that is worth legally.
PAdES signing with LTV timestamps and optional HSM keys
- PAdES signatures: the default subfilter is
ETSI.CAdES.detached, andadbe.pkcs7.detachedremains available for older readers. Editing the PDF after signing breaks the signature, and PDF readers flag it. - Timestamps and long-term validation: point
NEXT_PRIVATE_SIGNING_TIMESTAMP_AUTHORITYat a timestamp authority and each signature gets a trusted time, long-term validation (LTV) data and an archival timestamp. - Key in a
.p12file or in Google Cloud HSM, where it never leaves the hardware. - A controlled signing flow: enforced signing order, an access code before the document opens, and an event log with timestamps and IP addresses that downloads as a PDF.
- REST API v2 with an OpenAPI reference, webhooks, and SDKs to embed signing in React, Vue, Svelte, Angular, Solid or Preact apps.
Instance-sealed simple signatures; AES and QES need Enterprise
The signature belongs to the instance, not the signer. The platform applies the certificate and seals each signer's drawn signature and fields into the document. That certificate proves the PDF came from that instance and hasn't changed since. A signer's identity rests on receiving the email link, plus an access code if you require one. Under eIDAS, that is a simple electronic signature (SES); the docs state compliance with the US ESIGN Act and UETA.
No certificate ships with it. Without a password-protected .p12, the app starts but every signing attempt fails. A self-signed certificate is enough to prove integrity, though Acrobat shows a warning. Adobe's green checkmark requires a certificate from an authority on the Adobe Approved Trust List.
Advanced (AES) and qualified (QES) signatures need the Enterprise license. Since v2.13.0 (June 18, 2026), csc mode hands signing to a trust service provider that speaks the Cloud Signature Consortium API, and each recipient authenticates with that provider. The code sits in packages/ee under a commercial license: without an Enterprise key, the instance refuses to start in csc mode, and it accepts a single provider. The docs' "Signature Levels" page still lists AES and QES as "Planned."
Other Enterprise-only features include organisation SSO (SAML and OIDC), passkey or 2FA re-authentication before document actions, 21 CFR Part 11 compliance, custom email sending domains and the embeddable document editor. Pricing isn't published. The free cloud plan stops at 5 documents a month.
Everything else is AGPL-3.0. If you modify Documenso and expose it over a network, you must publish your changes. According to the docs, running it unmodified for internal use, or calling its API from closed-source software, stays within the free Community Edition.
PostgreSQL 14+ is the only supported database. You also need an SMTP server and a reverse proxy for HTTPS. By default, Postgres holds the documents and the job queue; S3 storage and Redis are optional. The docs recommend 2 GB of RAM or more in production.
External pull requests stopped in June 2026. Documenso merges only those from a small group of contributors it invites; everyone else files issues. v2.19.0, released September 29, 2026, is its sixteenth minor release of 2026.