E-signatures · Alternative
A Dropbox Sign alternative built around certified PDFs
Dropbox Sign, formerly HelloSign, sells reusable templates, bulk send and a developer API on top of unlimited signature requests. OneCraft signing sells the opposite shape: no templates and no API, but every completed PDF certified and every event hash chained, and this page sets the two side by side.
Updated , competitor details checked . Dropbox Sign and HelloSign are trademarks of their owner. OneCraft is not affiliated with or endorsed by Dropbox, and every cell cites a public page or a source file.
Nuwan Madhusanka · Co-founder
3 min read · Published
The short verdict
Dropbox Sign suits a business that sends the same documents repeatedly, needs bulk send, SMS identity checks or a developer API, and wants a long compliance certification list behind it. OneCraft signing suits a sender with a handful of agreements a month who cares most about the evidence attached to the finished file and about the documents and forms that produced it.
| Feature | Dropbox Sign | OneCraft |
|---|---|---|
| Price per user | Essentials at $15 USD a month billed monthly or $10.05 billed yearly for 1 user; Standard at $25 USD per user a month or $17.50 billed yearly for 2 or more checked 2026-09-20 | A free plan at $0 with 100 AI credits a month, then $8, $25 and $125 a month, priced per account rather than per signer seat |
| Signature request allowance | Unlimited signature requests with no hidden fees; the comparison table lists no per plan request cap checked 2026-09-20 | No envelope allowance is published on any plan; one envelope holds up to 25 recipients and up to 500 fields between them |
| Reusable templates | 5 templates on Essentials, 15 on Standard and unlimited on Premium, with a Template Gallery checked 2026-09-20 | There are no reusable templates. Every envelope is prepared from its own PDF, or arrives already laid out from a generated document |
| Bulk send | Bulk send is listed on the Standard and Premium plans, sending individual requests to a large list with a single click checked 2026-09-20 | No bulk send. One envelope goes to its own recipients, and a repeat send is prepared again |
| Signer verification | Two factor authentication, signer access codes and advanced SMS authentication, the latter listed on Standard and Premium checked 2026-09-20 | 3 methods per recipient: the email link alone, an access code shared out of band, or a 6 digit emailed code that expires in 10 minutes |
| Guessing protection | Not itemised on the features page beyond the authentication options themselves checked 2026-09-20 | Access codes are salted scrypt hashes compared in constant time, 5 failed attempts lock the recipient for 15 minutes, and at most 5 codes issue per 10 minute window |
| Certification of the signed PDF | Qualified electronic signatures meeting eIDAS standards with identity verification are listed among advanced signature types checked 2026-09-20 | PAdES CMS certified at DocMDP P equals 1 so later edits break the seal; RFC 3161 timestamping is implemented but off in every deployed configuration |
| Audit evidence | Audit trails are associated with transactions to ensure actions are tracked and time stamped checked 2026-09-20 | 18 audit event types in a hash chained log where each row seals the one before, and the envelope page reports whether the chain verifies |
| Certificate after completion | Not itemised on the features page, which names audit trails rather than a certificate document checked 2026-09-20 | A three section certificate of completion listing the envelope and hashes, each signer with method, time, IP and consent, and the full event log |
| Field types | Advanced signer fields including dropdowns, radio buttons and clickable links, with conditional logic that shows fields based on signer input checked 2026-09-20 | 10 field types: signature, initials, date signed, name, email, title, company, text, checkbox and a signature block. There is no conditional logic |
| In-person signing | Capture handwritten signatures in person on any mobile device checked 2026-09-20 | The owner hosts an in person session when it is that recipient's turn, the emailed check is waived for the session, and an in person started event is recorded |
| API and integrations | A separate Dropbox Sign API product with SDKs in six languages, OAuth 2.0 and a test mode, plus Google Drive, Microsoft Word, HubSpot and Salesforce integrations checked 2026-09-20 | No public API. Envelopes start from a PDF upload of up to 25 MB, from a generated document, or from a submitted form response in the same account |
Where Dropbox Sign is better
Templates and bulk send
Five templates on Essentials, fifteen on Standard and unlimited on Premium, with bulk send from Standard upward. Nothing here reuses a prepared envelope, so an HR team onboarding a cohort or a landlord with a standard lease prepares each one again.
SMS and qualified signatures
Two factor authentication, one time codes to a mobile and advanced SMS authentication on the paid team plan, plus qualified electronic signatures meeting eIDAS with identity verification. The strongest check here is a six digit code to the signer's email, which is a lower bar when identity genuinely has to be proven.
A real developer API
The Dropbox Sign API is its own product, with SDKs in six languages, OAuth 2.0 and a test mode, alongside Google Drive, Microsoft Word, HubSpot and Salesforce integrations. There is no public API here at all, so signatures cannot be wired into another system.
Conditional fields
Dropbox Sign lists dropdowns, radio buttons, clickable links and conditional logic that reveals fields based on what a signer picks. The ten field types here are fixed and always shown, and a placed checkbox is typed into rather than ticked, so branching paperwork is genuinely better prepared there.
A published compliance list
Their features page names eIDAS, GDPR, ISO 27001, SOC 2 Type II, the US ESIGN Act and HIPAA support. No equivalent certification list is published here, and buyers who have to tick those boxes in a procurement questionnaire should weigh that plainly before switching.
Where OneCraft is different
Every completed PDF is certified
The finished file carries a PAdES CMS signature certified at DocMDP level one, so any later edit breaks a seal a PDF reader will report. Certification is not an upgrade: a failure sets the envelope to failed and emails the owner rather than releasing an unsealed file.
An audit trail that can be verified on screen
Eighteen event types are written into a hash chained log, each row sealing the one before it with a sorted key digest, and the envelope page shows either that the chain verifies or the exact event where it broke. That is evidence a reader can test rather than a list to take on trust.
The document and the envelope share an account
An envelope starts from an uploaded PDF, from a document generated in the same account, or from a submitted form response. A generated document carries its signature block parties across as recipients automatically, and a form response becomes one envelope per submission.
Identity checks with real throttles
Access codes are stored as salted scrypt hashes and compared in constant time, five failed attempts lock a recipient for fifteen minutes, and no more than five one time codes issue in any ten minute window. Each code is six digits, expires in ten minutes and is redeemable once.
A finished example
Sign an NDA onlineMade with OneCraft, exactly as the generator and editor left it. Open the page for the full breakdown.Pricing in plain terms
The Dropbox Sign pricing page, checked 20 September 2026, lists Essentials for one user at $15 USD a month billed monthly or $10.05 billed yearly, Standard for teams of two or more at $25 USD per user a month or $17.50 billed yearly starting at $420 a year, and Premium for five or more users on a custom quote. Templates run 5, 15 and unlimited across those tiers. OneCraft's pricing page lists Free at $0 with 100 AI credits a month, Starter at $8, Pro at $25 and Pro Plus at $125, priced per account, with no envelope allowance stated on any plan.
Moving across
Templates cannot migrate, because there is nothing here to migrate them into. Moving means uploading the PDF you already send, placing fields on it, adding recipients with their verification method and sending. PDFs must be under 25 MB, and rotated or password protected files are refused at upload with the reason given.
What could not be checked
The pricing comparison table states unlimited signature requests but does not break allowances down per plan, so that cell repeats the claim as written. The features page names audit trails but does not describe a separate certificate document, and does not itemise brute force protection beyond the authentication options, so both rows say so rather than assuming parity. Prices were served in US dollars.
How the OneCraft side was verified
Every cell names a row in an internal ledger checked against the signing service's source code: the 25 recipient and 500 field caps, the ten field types and the four signature block lines, the three verification methods with scrypt hashing and the five attempt lockout, the six digit code and its ten minute expiry, the eighteen event hash chain, the certificate of completion and the DocMDP certification level. The absences are ledger entries too.
Who should stay with Dropbox Sign
Stay with Dropbox Sign if templates and bulk send carry your volume, if signers need SMS codes or qualified signatures, if a developer API or a Salesforce integration is part of the workflow, or if a published certification list is a procurement requirement. What is offered here instead is certified output and verifiable evidence for a smaller number of envelopes.
Questions people ask
Can I save an envelope as a template?
No. There are no reusable templates, so every envelope is prepared from its PDF with fields placed fresh. The partial offset is that a document generated in the same account carries its signature block parties into the envelope automatically, so the repetitive part can live in the generator prompt instead of a template.
How strong is the identity check?
Three levels: the emailed link alone, an access code you share with the signer separately, or a six digit code emailed at signing time that expires in ten minutes and can be used once. Five failed attempts lock that recipient for fifteen minutes. There is no SMS code and no photo ID check.
What makes the finished PDF tamper evident?
It is certified with a PAdES CMS signature at DocMDP level one, written into the document permissions, so an edit after certification breaks a seal any standard PDF reader reports. If certification fails the envelope is marked failed and the owner is emailed, rather than an uncertified file being sent out.
Is there a timestamp on the signature?
Not currently. The RFC 3161 timestamping code is complete, the token would attach to the signer information as an unsigned attribute, but the timestamp authority URL is empty in every deployed configuration, so signed PDFs carry no timestamp token today. The certificate names the algorithm without a timestamp when none was attached.
Can signatures be requested from another system?
No public API exists. Envelopes are created in the app from an uploaded PDF, or automatically from documents and form responses in the same account, where the internal handover stages the rendered PDF before creating the envelope. Anything that needs signing wired into a CRM or a product should use the Dropbox Sign API.
What happens if a signer never responds?
Every envelope expires 30 days after it is created, a nightly sweep marks outstanding recipients expired, and the link then returns a clear expiry message. There are no automatic reminders, so chasing means pressing resend, which rotates the signing link, kills the old one and records a resent event.
Try the signing flow side of OneCraft
The button opens the generator with a starting prompt already filled in. Change the wording to match your own work before you run it.
Send a document for signingMore comparisons
- A DocuSign alternative for small businessOneCraft e-signature as a DocuSign alternative for small business: fields, signing order, identity checks, audit trail and certified PDFs, with the gaps named.
- A signNow alternative for small teamsA signNow alternative for small teams: 25 recipients an envelope, three identity checks, a certificate of completion, and the templates and bulk send it lacks.
- A SignWell alternative with built in document generationA SignWell alternative where the document is written first and then signed: certified PDFs, three identity checks, and the templates and API SignWell includes.
What the module actually does, feature by feature: the E-signature software page, and the e-signatures maker page.
Step by step in the builder: Send a PDF for e-signature, then Add e-signatures with multiple signers.
Written and checked by the OneCraft team. Last checked .