How to Verify PDF E-Signatures Programmatically with Node.js & Python (2026)

const fs = require('fs');
const forge = require('node-forge');

function verifyPdfSignature(pdfFilePath) {
  const pdfBuffer = fs.readFileSync(pdfFilePath);
  const pdfString = pdfBuffer.toString('binary');

  // 1. Locate the ByteRange [Start1 Length1 Start2 Length2]
  const byteRangeRegex = /\/ByteRange\s*\[\s*(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s*\]/g;
  const match = byteRangeRegex.exec(pdfString);
  if (!match) {
    throw new Error('No ByteRange match found. Document might not be signed.');
  }

  const byteRange = [
    parseInt(match[1], 10),
    parseInt(match[2], 10),
    parseInt(match[3], 10),
    parseInt(match[4], 10)
  ];

  // 2. Reconstruct the signed data segment
  const signedContent = Buffer.concat([
    pdfBuffer.subarray(byteRange[0], byteRange[0] + byteRange[1]),
    pdfBuffer.subarray(byteRange[2], byteRange[2] + byteRange[3])
  ]);

  // 3. Extract the CMS signature block (/Contents)
  const signatureHexOffset = byteRange[0] + byteRange[1];
  const signatureHexLength = byteRange[2] - signatureHexOffset;
  const signatureHex = pdfBuffer.subarray(signatureHexOffset, signatureHexOffset + signatureHexLength)
    .toString('binary')
    .replace(/^<+/, '')
    .replace(/>+$/, '')
    .replace(/\s/g, ''); // strip spaces and newlines

  const signatureBuffer = Buffer.from(signatureHex, 'hex');

  // 4. Parse the PKCS#7 envelope using node-forge
  const p7Asn1 = forge.asn1.fromDer(signatureBuffer.toString('binary'));
  const p7 = forge.pkcs7.messageFromAsn1(p7Asn1);

  // Attach original signed bytes to verify signature validity
  p7.content = forge.util.createBuffer(signedContent.toString('binary'));

  // 5. Run verification
  const isVerified = p7.verify();

  // 6. Extract Certificate Information
  const signerCert = p7.signerInfos[0].certificate;
  const commonNameAttr = signerCert.subject.getField('CN');
  const commonName = commonNameAttr ? commonNameAttr.value : 'Unknown Signer';

  return {
    verified: isVerified,
    signerCommonName: commonName,
    validFrom: signerCert.validity.notBefore,
    validTo: signerCert.validity.notAfter
  };
}

// Example usage:
// const result = verifyPdfSignature('./signed_contract.pdf');
// console.log(`Verified: ${result.verified}, Signer: ${result.signerCommonName}`);

from pyhanko.pdf_utils.reader import PdfFileReader
from pyhanko_certvalidator import ValidationContext
from pyhanko.sign import fields
from pyhanko.sign.validation import validate_pdf_signature, SignatureValidationSpec

def verify_python_pdf_signature(pdf_path):
    with open(pdf_path, 'rb') as f:
        reader = PdfFileReader(f)
        
        # Enumerate signature fields in the PDF document
        for sig_field in fields.enumerate_sig_fields(reader):
            field_name = sig_field.field_name
            print(f"Validating field: {field_name}")
            
            # Setup a validation context (can inject custom trust anchors here)
            validation_context = ValidationContext(trust_roots=[])
            
            status = validate_pdf_signature(
                sig_field,
                spec=SignatureValidationSpec(
                    validation_context=validation_context
                )
            )
            
            # Check document integrity
            print(f"Signature Intact: {status.intact}")
            print(f"Signature Valid: {status.valid}")
            
            # Extract certificate metadata
            cert = status.signing_cert
            print(f"Signed by: {cert.subject.human_friendly}")
            print(f"Issuer: {cert.issuer.human_friendly}")
            print(f"Valid from: {cert.validity['not_before']}")
            print(f"Valid to: {cert.validity['not_after']}")

# Usage
# verify_python_pdf_signature('NDA_signed.pdf')