DocuSeal

Multi-signer PDF forms that work on phones too

DocuSeal is a Ruby on Rails app for getting PDFs filled in and signed. You drop fields onto a document in a visual editor (signature, date, checkbox, file upload and so on) and email it to one or more signers, who complete their part in the browser, phones included. DocuSeal then renders the completed PDF, signs it with an X.509 certificate, and keeps an audit log with the IP address, browser and time of each step.

Documenso covers the same ground on a TypeScript stack, and OpenSign on Node.js and MongoDB. @signpdf handles only the final step, embedding the signature into the PDF from Node.js, and leaves the interface and the sending to the app around it.

The open source e-signature comparison sets the signature DocuSeal puts on a PDF against what the other tools produce.

Local field detection inside a single Docker container

• One container to get going: docker run is all it takes. Leave DATABASE_URL empty and data goes to SQLite; leave REDIS_URL empty and the Puma server starts its own Redis and runs Sidekiq inside its process. The repo's docker-compose.yml adds PostgreSQL 18 and Caddy for HTTPS.
• Field detection on your own hardware: a computer vision model shipped inside the Docker image spots the fillable areas of a PDF. The 2.2.0 release notes say it needs at least 1 GB of RAM.
• Page editor: since 3.1.0 you can add, remove, rotate and crop pages, and redact passages.
• REST API and webhooks in the free edition: the API lists, clones and updates templates, creates signing requests and tracks each signer. An MCP server, added in 2.3.7, lets an AI agent build a template from the URL of a PDF or DOCX and send it out.
• Bring your own certificate and timestamp server: upload a .p12 or .pfx certificate, point DocuSeal at an RFC 3161 timestamp server, and check the signature of any PDF from the settings page.
• French interface: seven UI languages including French, and fourteen for the signing page.

Self-signed certificate by default, AGPL with an attribution clause

The default certificate is self-signed. On first boot, a self-hosted instance generates its own certificate chain, valid for 100 years, named "DocuSeal Self-Host Autogenerated". That authority is created on your own server, so no PDF reader knows it in advance. DocuSeal's documentation page on signing certificates calls only the Cloud certificate trusted by Adobe. On your own server, the options are to upload your own certificate or to buy Pro for "DocuSeal Trusted Signature": the instance sends the PDF's checksum to DocuSeal, which signs it, and according to the settings screen the document stays on your server.

What Pro keeps back. Logo and white-label, user roles, automatic reminders, SMS identity verification, conditional fields and formulas, bulk send from a CSV or XLSX file, SSO and SAML, template creation through the API from HTML, PDF or DOCX, and embeddable forms for React, Vue, Angular or plain JavaScript. The free edition's REST API has no route for creating a template from a file, so templates get built in the web UI. Without SMS, signers can still be sent a one-time code by email. On-premises Pro costs $20 per user per month, billed yearly at $240, plus $0.20 per document signed through the API or embedding.

AGPL-3.0 with an attribution clause. The repo adds one term to the AGPLv3 under its section 7(b): any covered work must keep the original DocuSeal attribution in its interactive user interfaces. White-label sits on the Pro list. On top of that, running a modified version as a network service means offering its source to the people who use it.

Sizing is in the docs. DocuSeal's documentation puts 500 KB documents at 1 vCPU and 1 GB of RAM, and 100 MB files at 2 vCPUs and 4 GB. Below 1,000 documents a year, SQLite, MySQL and PostgreSQL all fit; above that, and for production API or embedding work, the docs recommend PostgreSQL.

Weekly releases, two main authors. The repo lists 173 releases since July 2023, 40 of them in 2026, nearly all published on a Monday; 3.3.1 came out on 5 October 2026. Two accounts author 3,146 of the 3,154 commits on the main branch. The 3.3.0 notes, which mention security hardening, recommend that every self-hosted deployment update, and the repo's docker-compose.yml pulls the latest image.