---
title: "Documenso vs LibreSign — Electronic Signature Legal Validity"
aliases: [documenso-libresign, esignature-comparison, aes-ses-esignature, self-hosted-esignature]
tags: [documenso, libresign, esignature, legal, homelab, selfhosted, nextcloud]
sources:
  - "daily/2026-05-01.md"
created: 2026-05-01
updated: 2026-05-01
---

# Documenso vs LibreSign — Electronic Signature Legal Validity

Documenso and LibreSign are both open-source self-hosted electronic signature solutions, but they serve fundamentally different use cases. Documenso provides AES (Advanced Electronic Signature) via email authentication with a full audit trail — legally valid for external client contracts in the UK and EU. LibreSign provides SES (Simple Electronic Signature) using self-signed PKI certificates via Nextcloud accounts — only practical for internal documents where all signatories already have Nextcloud accounts.

## Key Points

- **Documenso = AES** — email link authentication + IP/timestamp/QR audit trail = legally valid Advanced Electronic Signature for UK/EU client contracts
- **LibreSign = SES** — self-signed certificate via Nextcloud account = Simple Electronic Signature, weaker than AES and requires all parties to have Nextcloud accounts
- **For external client contracts**, Documenso is the correct tool; clients sign via browser link with no account required
- **For internal documents** (policies, staff sign-offs) where all parties are already in Nextcloud, LibreSign works adequately
- **Documenso's signing certificate** includes: signatory name + email, timestamp (sent/viewed/signed), IP address + device, unique signature ID (hash), and a QR code for independent verification

## Details

### Electronic Signature Tiers (EU eIDAS / UK)

| Tier | Abbr | Mechanism | Legal weight |
|------|------|-----------|-------------|
| Simple Electronic Signature | SES | Any electronic signature (typed name, click) | Lowest — can be challenged |
| Advanced Electronic Signature | AES | Uniquely linked to signatory, capable of detecting changes | High — widely accepted for business contracts |
| Qualified Electronic Signature | QES | Government-issued PKI certificate | Highest — legally equivalent to handwritten |

Documenso with email authentication meets AES requirements: the email link is uniquely linked to the signatory (they must access their email), and the audit trail detects any post-signing changes.

### Documenso Signing Certificate

After each signing, Documenso generates a Signing Certificate page that contains:

```
Signatory: Name + email address
Sent:      2024-03-15 09:00:00 UTC
Viewed:    2024-03-15 09:05:00 UTC
Signed:    2024-03-15 09:07:00 UTC
IP Address: 203.0.113.42
Device:    Chrome / macOS
Signature ID: sha256:a3b8...
QR Code:   Links to Documenso verification endpoint
Authentication Level: Email
```

This audit trail is what elevates the signature from SES to AES — independent verification is possible via the QR code without any Documenso account.

### LibreSign Limitations for External Use

LibreSign integrates with Nextcloud and uses Nextcloud accounts for authentication. Signatories must:

1. Have a Nextcloud account on the same instance
2. Log in to Nextcloud to view and sign documents
3. Use a PKI certificate (which is self-signed by the Nextcloud instance)

These requirements make LibreSign impractical for external client contracts: clients won't create Nextcloud accounts just to sign an agreement. The self-signed PKI certificate also has lower external trust than email-authenticated signing.

### Decision Matrix

| Scenario | Tool | Reason |
|----------|------|--------|
| Client contract (UK/EU) | Documenso | AES via email auth; client needs no account |
| Vendor NDA with external party | Documenso | Same — external party can't use Nextcloud |
| Internal policy sign-off (staff only) | LibreSign | All staff have Nextcloud accounts |
| Intra-team approval | LibreSign | Internal workflow; Nextcloud integration convenient |
| Legally sensitive high-value contract | DocuSign / Adobe Sign | QES via government-issued certificate |

### Self-Hosted Setup Comparison

| Feature | Documenso | LibreSign |
|---------|-----------|-----------|
| Auth method | Email link | Nextcloud account |
| Audit trail | Full (IP, device, timestamps, QR) | Basic |
| External signatories | Yes (no account needed) | No (Nextcloud account required) |
| Legal tier | AES | SES |
| UK/EU client contracts | ✅ Valid | ❌ Impractical |
| Internal documents | ✅ Valid | ✅ Valid |
| Self-hosting complexity | Docker-based, standalone | Nextcloud app |

## Related Concepts

- [[wiki/concepts/authentik-homelab-tradeoffs]] — Nextcloud/Authentik integration context for self-hosted services
- [[wiki/homelab/_index]] — homelab service stack where both Documenso and LibreSign would run

## Sources

- [[daily/2026-05-01.md]] — Documenso Signing Certificate reviewed (AES with email auth); LibreSign identified as SES suitable only for internal Nextcloud users; decision: Documenso for client contracts, LibreSign for internal documents only
