Free tool · no account · no payment
Open a PDF, place your signature where you want it and sign with the certificate on your own token (ePass2003, SafeNet, YubiKey and others). The PDF never leaves your computer: it is opened, signed and saved inside your browser. Nothing is uploaded to OneSign.
A small free Windows app that lets this page talk to your token. Run it once; it sits in the system tray. It needs the .NET 8 Desktop Runtime.
Use the token your CA issued you, with its normal driver installed. Your certificate must be valid and issued to you.
Open a PDF below, drag the signature box into place, press Sign, pick your certificate and enter the token PIN. The signed PDF downloads straight away.
Chrome or Edge 141+ will ask to allow local network access the first time: choose Allow so the page can reach OneSignerBridge on your PC. The signature is a standard PAdES/PKCS#7 signature that Adobe Acrobat and Foxit show as valid when your CA is trusted.
Yes. The signing page and OneSignerBridge are free to use, with no account, no limit on documents and no payment. You sign with your own certificate, which you got from your CA.
No. The PDF is read and signed in your browser and the signed file is saved to your computer. The page does not upload the document, your certificate or your PIN anywhere. OneSignerBridge only listens on your own machine (localhost).
No. Every signature on this page is made by your token, with your certificate, after you enter your PIN. OneSign does not hold or provide any signing certificate for this tool.
Any USB token or smart card whose certificate shows up in Windows: Feitian ePass2003, SafeNet eToken, YubiKey and similar. In the certificate picker you can optionally type the token PIN so OneSignerBridge signs through the token's own PKCS#11 module; leave it empty to enter the PIN in the token's own window.
Check that OneSignerBridge is running (icon in the system tray), allow local network access in Chrome/Edge, and if your browser warns about the local certificate, open https://localhost:9505 once and accept it. Then press reconnect.
That is what OneSigner does: a Windows service that signs PDFs and code with your tokens unattended, over an API or watched folders. See how it works.