OneSigner 2026.10.10: Tokens Sign With the Saved PIN, Plus Free PDF Signing at onesign.sg/sign

OneSigner 2026.10.10 and OneSignerBridge 1.1.0 are out, together with a new free page, onesign.sg/sign, where anyone can sign a PDF in the browser with their own USB token. The theme of this release is simple: the PIN you saved should be the PIN the token gets, with no PIN window popping up on an unattended machine.

1. USB tokens now sign through the vendor's PKCS#11 module

Many certificate authorities ship tokens whose Windows driver installs two things: a classic CSP and a newer Key Storage Provider (KSP). Windows and .NET prefer the KSP, and some KSPs ignore a PIN supplied by an application. The result on a signing server is the worst kind of failure: a PIN dialog on a desktop nobody is watching, and a request that hangs. We reproduced this on a real token from a certificate authority.

The same driver packages also contain a full PKCS#11 module, the industry-standard interface for tokens and HSMs. From 2026.10.10 OneSigner uses it first: it logs in to the token with the PIN saved in your signing profile (C_Login) and signs there, so no vendor PIN window appears. This applies to keys held by third-party token providers, such as Feitian ePass/EnterSafe and Bit4id tokens. Tokens that already worked through Microsoft's smart-card stack, SafeNet eToken and YubiKey keep their existing path.

OneSigner finds the right module on its own, in this order:

1. the module path set in the signing profile, if you set one;
2. the module that belongs to the certificate's own driver (a driver whose CSP is X_s.dll leads to its PKCS#11 module X.dll);
3. a built-in list of modules from token vendors (Feitian, SafeNet, Bit4id, Gemalto, Luna, nCipher, Yubico and others);
4. OpenSC, if it is installed.

It only logs in to the token that actually holds the certificate you are signing with, so other tokens plugged into the same machine are left alone.

2. A wrong PIN stops after one attempt

Tokens lock themselves after a few wrong PINs, and an automated service that keeps retrying can lock a token in seconds. If the token rejects the PIN, OneSigner now stops immediately with an error saying the token rejected the PIN (or that the PIN is locked or expired). It does not try the same PIN again through another provider, so one mistake in the profile costs one attempt, not several.

3. New "PKCS#11" field in the signing profile

Auto-detection covers the common tokens, but if your token uses a module we have not seen, open the signing profile in the Config app: next to the token PIN there is a new PKCS#11 field with a browse button. Leave it empty for auto-detect, or point it at your vendor's DLL. For troubleshooting, setting ONESIGNER_CLI_LOG=info makes the signing log show which module was used.

4. OneSignerBridge 1.1.0: optional PIN in the certificate picker

OneSignerBridge is the small free Windows app that lets a web page reach the USB token on your own PC (it powers "Sign visually" in the portal and the eSign ceremony). The certificate picker now has an optional Token PIN field:

• PIN entered: the Bridge signs through the token's PKCS#11 module, without the vendor's PIN window. The PIN is used for that one signature and is never stored.
• Left empty: nothing changes, and the token driver asks for the PIN in its own window as before.

5. New: free PDF signing at onesign.sg/sign

You do not need a OneSigner license to sign a single document with your own token. onesign.sg/sign is a free public page: install OneSignerBridge, plug in your token, open a PDF, drag the signature box into place and sign. There is no account and no payment, and the PDF never leaves your computer: it is opened, signed and saved inside your browser, and nothing is uploaded to OneSign. OneSign does not sign for you; every signature is made by your own token with your own certificate.

When one document becomes hundreds, that is what OneSigner is for: a Windows service that signs PDFs and code with your tokens unattended, over an API or watched folders.

Tested on real tokens

Before release we signed with two real Feitian ePass2003-based tokens issued by two different certificate authorities. Both signed with the saved PIN and no PIN window; a deliberately wrong PIN stopped after one attempt, and the correct PIN afterwards worked normally. A PDF signed eleven times in a row kept all eleven signatures valid. The Bridge was tested on the same two tokens, both for PDF (CMS) signatures and raw hash signatures.

How to update

• OneSigner: the Config app shows an update banner, or download OneSigner 2026.10.10. It is a free update for licenses within their update period, and your existing settings are kept. Installer and executables are signed by One Sign Pte. Ltd.
• OneSignerBridge: download OneSignerBridge 1.1.0, close the old Bridge from the system tray and run the new one.
• Free signing: onesign.sg/sign.