I have been looking for a legitimate open source e-signature tool for about three years. I wanted something that did not cost $10 per user per month, did not lock my signed documents into a vendor’s cloud, and did not silently degrade into “you need the Business plan” the moment I asked for a feature. OpenSign is the first one I have found that actually competes with DocuSign on the workflows a small business runs every week. It is not a stripped-down proof of concept, it is not a half-finished GitHub repo, and the self-host option is real.
The pricing problem with commercial e-signature
DocuSign’s cheapest plan is $10 per month per user, and that tier only covers the basics. The next plan up is $40 per user per month if you want branding and bulk send. Adobe Sign starts at $13 per month. HelloSign sits around $15. For a five-person operations team that signs 20 contracts a month, you are paying $600 to $1,200 per year for the privilege of clicking a “send” button. The actual product is just an envelope tracker, an email notifier, and a way to render a PDF with a signature drawn on it. None of that costs $10 per month per user to operate.
A small business also ends up paying for features it does not need. Most teams I have worked with do not need bulk send, do not need conditional routing, do not need advanced identity verification. They need: send a contract, sign it, store the signed PDF, and produce a “this was signed” audit trail. The commercial vendors price that workflow as if it were a load-bearing feature of an enterprise contract lifecycle management platform. It is not. It is two HTTP calls and a PDF write.
What I wanted was a tool that did the basic workflow, did it well, and let me self-host if I needed to. OpenSign is that tool. It is open source under an MIT license, has a cloud-hosted free tier, and has a self-host option I can run on a $5 VPS. The signing flow is the same flow DocuSign has, the audit trail is the same, and the storage is plain PDF in object storage. There is no magic.
What OpenSign actually delivers
OpenSign is a full-featured document signing platform, not a toy. The core feature set covers what small businesses need daily. You get secure PDF e-signing with hand-drawn signatures, uploaded signature images, typed signatures, and saved signatures for repeat use. The interface is a web app you can use from any modern browser. There is also a mobile-friendly view for signers, which matters because a meaningful share of signatures happen on a phone.
The self-host option is the part that matters to me. I can run OpenSign on a small server I control. My signed documents live in my own S3-compatible object storage, the audit trail is in my own Postgres database, and there is no third party touching the envelope. For industries with document retention rules, this is the difference between “we use DocuSign” and “we have a document signing system we own.” Both are valid, but the latter has different liability characteristics.
Multi-signer support is real. Sequential signing, parallel signing, shareable signing links, and email OTP (one-time password) verification for guest signers. The OTP piece is a small detail that does a lot of work. When I send a contract to an external party, OpenSign emails them a link, they sign in their browser, and the OTP step confirms they are the person whose email I sent it to. This is the same identity flow DocuSign uses. The difference is that with OpenSign, the OTP code generation, the email, and the verification log are all in my infrastructure.
Installation patterns I have landed on
For teams that want to test the water first, the cloud-hosted free tier is the right starting point. Sign up, send 10 envelopes, see if the workflow matches what the team needs. The free tier has no per-document limit and no per-user limit. The only cost is the storage, which is included.
For teams that want to self-host, the install path I have used is straightforward:
- A small VPS (2 vCPU, 4 GB RAM is enough for a team of 20)
- Docker Compose for the OpenSign stack
- Postgres for the envelope and audit data
- An S3-compatible bucket for the signed PDFs (Backblaze B2, MinIO, or AWS S3 all work)
- A reverse proxy (Nginx or Caddy) for HTTPS
- A real domain with a valid TLS certificate
The whole stack starts in about 15 minutes on a fresh VPS. I have done it twice. The first time I made the mistake of putting Postgres on the same volume as the application, which made backups annoying. The second time I put Postgres on a separate volume with a daily snapshot job, which is the pattern I would recommend.
The harder question is “where do I put the signed documents?” The answer depends on your threat model. If you are signing NDAs with vendors, local Postgres plus local S3-compatible storage is fine. If you are signing contracts where the signed PDF itself is the asset (real estate, financial services), you may want to write the PDFs to immutable storage with a write-once-read-many retention policy. OpenSign does not enforce that, but the integration point is just an S3 bucket, so you can wire it up.
What I gave up
OpenSign is not as polished as DocuSign. The web UI works but it is not the design-forward experience DocuSign ships. The mobile signing flow works on modern phones but the older the browser, the rougher it gets. The audit trail is comprehensive, but the export is plain JSON, not a formatted PDF report like DocuSign produces. If your legal team is used to attaching a “DocuSign Certificate of Completion” PDF to every contract record, you will need to build that yourself, or change the workflow to attach the JSON.
The community is smaller. DocuSign has a forum, a knowledge base, a certification program, and a sales team you can call. OpenSign has a GitHub repo, a Discord, and a maintainer who is responsive. For a small business that does not need 24/7 vendor support, the support gap is not a problem. For a large enterprise with a procurement team that requires vendor-backed SLA, it is a non-starter.
I gave up the polished UI, the polished mobile experience, and the SLA-backed support. In exchange, I saved about $1,200 per year per user, I own my signed documents, and I have an open source tool I can read, modify, and never lose access to. For a small business that is the right trade.
Trade-offs
OpenSign is not free in time. Self-hosting means you own the upgrade, the backup, the security patching, and the on-call when something breaks at 2 AM. A team that does not have a sysadmin will pay that cost in hours, not in dollars. Cloud-hosted solves the operational cost but does not give you data ownership. Pick based on which cost you can absorb.
The migration from a commercial vendor is not zero. Existing envelopes in DocuSign do not move. You keep using DocuSign for in-flight contracts, and OpenSign takes new ones. Over six months, the migration completes itself. I would not try to mass-export 200 old envelopes and re-import them. The signed PDFs are what matters, and those you already have in your own storage.
Pricing comparison: DocuSign Standard at $10 per user per month for a five-person team is $600 per year. DocuSign Business at $40 per user per month is $2,400 per year. OpenSign self-hosted on a $5 VPS is $60 per year plus a few hours of setup. OpenSign cloud free is $0 per year. The savings are not subtle.
If your team signs fewer than 20 documents per month and you do not have a self-hosting person, the cloud free tier is the right call. If you sign more than 100 documents per month and you have someone who can manage a small server, the self-host option is a clear win. If you need 24/7 vendor support, an enterprise procurement pipeline, and a polished mobile experience, stick with DocuSign.
What I would tell past me
If I could send a message back to the version of me that paid the first DocuSign invoice, I would say three things.
- The basic signing workflow is two HTTP calls and a PDF write. You are not getting $10 per month per user worth of value from the envelope tracker and the email notifier. You are paying for the brand and the SLA.
- Self-hosting an open source signing tool is not as hard as it looks. A 2 vCPU VPS, Docker Compose, Postgres, and an S3 bucket is a weekend of work. The hard part is the integration with your existing contract storage, not the tool itself.
- The audit trail is the part that matters for legal. A signed PDF in object storage is good. A signed PDF plus a JSON audit log is better. OpenSign gives you both, and you own both. DocuSign gives you both, and they own both. The difference shows up the day you need to prove a signature to a court.
If you only do one thing from this article, set up an OpenSign cloud account and send one envelope to yourself. The cost is zero, the time is five minutes, and you will know within that five minutes whether the tool fits your workflow.