OneSigner compared, honestly

The short answer

OneSigner is a Windows service you host yourself that turns USB hardware tokens (YubiKey, SafeNet, ePass2003) into a shared signing endpoint. It suits teams that already own signing certificates on hardware and want unlimited PDF and Windows code signatures without a per-signature or per-seat subscription. It is not a cloud service, so someone has to run and keep one Windows machine online.

OneSigner vs cloud code-signing services

Cloud signing services keep the private key in the provider's HSM and charge per signature, per year, or per seat. That model removes the hardware, and it is the right answer when nobody on your team can host anything. The trade-off is metering and custody: the key lives with the provider, and the running cost scales with how often you sign.

OneSigner inverts that. The key stays on the USB token in your building, the software is a one-time perpetual licence, and signature volume is unlimited because nobody is counting. You take on one obligation in exchange: keeping one Windows machine powered on with the token plugged in.

Pricing and feature details of other vendors change often — check their current terms rather than this page. What does not change is the architectural difference above.

A self-hosted DocuSign alternative for eSign

DocuSign, Adobe Acrobat Sign and Dropbox Sign are envelope products: you upload a document, place fields, add recipients, and the platform chases everyone for a signature. They are excellent at that, priced per user and per envelope, and the finished documents live on their servers.

OneSigner eSign covers the same core workflow on infrastructure you control: upload a document, drag signature, text, checkbox, radio and dropdown fields onto the pages, add recipients with an optional access code, and send. Signers open a link with no account, sign in order, and each signature is appended as its own PDF revision so earlier signatures stay valid. You get reminders, expiry, decline, templates, bulk send and an audit trail. Signers can sign electronically (draw or type, sealed with your organisation certificate) or with their own USB token through the free OneSignerBridge, in which case the PDF never leaves their computer.

Choose the hosted platforms when you need a large recipient network, mobile apps, deep CRM integrations, or a vendor to carry the compliance paperwork for you. Choose OneSigner eSign when documents must not leave your infrastructure, when per-envelope pricing does not fit your volume, or when the signature must come from a certificate your organisation owns.

Code signing in CI/CD without shipping your key to the cloud

Since the CA/Browser Forum required code-signing keys to live on hardware or an HSM, build pipelines lost the ability to hold a PFX file. Three practical options remain: plug a token into a build agent, subscribe to a cloud signing service, or run a signing endpoint of your own.

In practice a GitHub Actions, Azure DevOps, Jenkins or GitLab CI job calls OneSignTool (or AzureSignTool, because OneSigner emulates the Azure Key Vault API) with your server URL and a signing token. Nothing is installed on the runner, no certificate is exported, and each partner or pipeline can hold its own revocable signing code instead of a shared admin token.

OneSignTool sign -kvu https://sign.example.com -kva <signing-code> \
  -kvc my-codesign-cert -fd sha256 \
  -tr http://timestamp.digicert.com -td sha256 build\MyApp.exe

The step-by-step version lives in the OneSignTool CLI guide and step 8 of the setup wizard.

AzureSignTool without Azure Key Vault

AzureSignTool is the de facto way to sign Windows binaries from a pipeline, but it expects an Azure Key Vault holding the certificate. If your certificate is on a USB token — because your CA issued it that way — the vault route is closed.

OneSigner exposes an Azure Key Vault–compatible endpoint in front of your token: the same -kvu, -kva, -kvc arguments work, but the URL points at your own server and the signing operation happens on the token. Existing pipelines usually need one line changed. OneSignTool is our fork of AzureSignTool with clearer errors and queue retry, and either binary works.

Automating PDF signing

Three routes cover almost every case, and all of them apply a PAdES signature with an RFC 3161 timestamp from your own certificate:

• REST API — POST the file, get the signed file back. Bearer token auth, per-tenant scoping, and optional per-request signature coordinates when the position differs per document.
• Watched folder — drop files into unsigned\, collect them from signed\. The usual choice for accounting systems that can only write files.
• Browser portal — for people rather than systems, including drag-and-drop placement of the signature on the page.

Signature appearance, page, coordinates and multiple signature fields are configured per profile, and a profile can be bound to a tenant or a source folder so different departments sign with different certificates. Worked examples: signing over the REST API and folder-watch invoice signing.

When OneSigner is not the right tool

• You want zero infrastructure. OneSigner needs one Windows 10/11 or Server 2019+ machine that stays on. If nobody can own that, a hosted service is the honest answer.
• Your signing host must be Linux or macOS. Clients on any platform can call the API, but the service itself is Windows-only.
• Your qualified key is held remotely by a QTSP. OneSigner drives a certificate you hold — a qualified certificate on a QSCD token still signs at its own level through OneSigner — but a key that never leaves the provider's servers has nothing for us to drive.
• Your certificate is locked inside a CA's cloud signing service. There is no token or local certificate for OneSigner to drive.
• You sign twice a year. A perpetual licence pays for itself through volume; at very low volume the maths may not favour it.

If one of those describes you, we would rather say so now. If none of them do, the 30-day trial unlocks every feature without a card.

Reference facts

• Host: Windows 10/11 or Server 2019+, installed as a Windows service.
• Documents: PDF with PAdES signatures and RFC 3161 timestamps; visible signature appearance is configurable, including exact coordinates per request.
• Code: Authenticode for EXE, DLL, MSI, CAB, SYS, OCX, APPX, MSIX.
• Tokens: YubiKey (PIV), SafeNet eToken, Feitian ePass2003, or any token with a Windows CSP/KSP minidriver. A software certificate in the Windows store also works, though EV code-signing certificates are hardware-bound by CA policy.
• Interfaces: REST API, watched folders, browser portal, eSign envelopes, AzureSignTool/OneSignTool over HTTPS, CLI.
• Licence: one-time perpetual — Basic US$99 (1 tenant, 5 portal users), Pro US$299 (10 tenants, 25 portal users, custom domain), Advance US$499 (unlimited tenants and portal users), Enterprise on request. Unlimited signatures on every tier; one year of updates included.
• Vendor: One Sign Pte. Ltd., Singapore — support@onesign.sg.