How to Check a ZATCA Invoice QR Code (Saudi e-Invoice)

A QR code is mandatory on simplified tax invoices, the kind shops and restaurants give to consumers. In Phase 1 it was optional on standard tax invoices between businesses; in Phase 2 those carry one too, created by ZATCA when it clears the invoice.

The code holds no web link or readable text, but a Base64 string of TLV records (tag, length, value), one per field. ZATCA's QR code guide lists a link or plain text as incorrect content. The five basic fields are:

• Tag 1: the seller's name.
• Tag 2: the seller's VAT registration number.
• Tag 3: the date and time of the invoice.
• Tag 4: the invoice total including VAT.
• Tag 5: the VAT total.

Phase 1, the generation phase, began on 4 December 2021 with the five fields above. Phase 2, the integration phase, has applied since 1 January 2023 in waves of taxpayers, and its QR code adds a cryptographic stamp:

• Tag 6: the hash of the invoice's XML file.
• Tag 7: the ECDSA digital signature.
• Tag 8: the public key of the stamp.
• Tag 9: on simplified invoices, ZATCA's signature of that public key.

The extra data makes a Phase 2 code visibly denser, and the reader labels the result "Phase 1 — five fields" or "Phase 2 — with the cryptographic stamp". A Phase 1 code is not wrong in itself: ZATCA notifies businesses of their Phase 2 wave in advance, and the code cannot show which wave a seller is in.

1. 1Open the ZATCA QR Code Reader. It runs in your browser, and the invoice is not uploaded.
2. 2Tap "Scan with the camera" and point your phone at the printed code, or upload a photo, screenshot or PDF of the invoice (the first three pages of a PDF are searched). On a computer you can also paste a screenshot with Ctrl+V, or paste the Base64 text.
3. 3If no code is found, try a sharper photo or crop closer to the code.
4. 4Read the banner at the top, then the fields: seller, VAT number, date and time, total including VAT, VAT, and the amount before VAT.
5. 5Compare every field with the printed invoice, then read the checks below them.

Lay the invoice flat in good light and fill the on-screen square with the code. Dense Phase 2 codes on small receipts need a close, sharp picture.

"Valid ZATCA QR code" means every format check passed; "check the warnings" flags something unusual; "with problems" means a check failed; "Not a ZATCA invoice QR code" means the content is something else, such as a web link. The checks:

• Structure: the TLV records must read cleanly; data cut short points to a damaged or badly made code.
• Required fields: tags 1 to 5 present and readable as text, and a seller name that is not empty.
• VAT number: 15 digits. Saudi VAT numbers begin and end with 3; one that does not gets a warning.
• Date and time: ISO 8601 form, for example 2026-09-26T15:30:00Z.
• VAT: no larger than the total, and checked as a percentage of the amount before VAT. The standard 15% passes; another rate gets a warning (fine on an invoice that mixes rates); zero VAT is noted as zero-rated or exempt.
• Phase 2 stamp: whether tags 6, 7 and 8 are present, and whether tag 9 is there. A partial stamp gets a warning.
• Extras: a Phase 1 string longer than the 500 characters ZATCA allows, or unknown tags, get a warning.

Some differences are only formatting. The code usually writes amounts with two decimals and no thousands separator (1150.00 for 1,150.00), and the time can be exactly three hours off if the system wrote it in UTC rather than Saudi time (UTC+3).

A different seller, VAT number, total or VAT, or a code that will not read, is worth raising. Ask the seller for a corrected invoice, and keep the original.

ZATCA's own services help too. Its free E-Invoice Validation service, on its website and mobile app, checks an e-invoice by scanning its QR code. Its VAT registration check lets you look up a VAT number. Its Reporting VAT Violations service takes reports of problems such as an incorrect VAT number, VAT collected by someone who is not registered, or VAT charged above or below 15%, and you can attach the invoice.

A clean result means the code is well-formed and its fields are consistent. It does not prove that:

• The invoice is genuine. Anyone can make a well-formed Phase 1 code with any name and any amounts.
• A Phase 2 signature is valid. That can only be verified against the invoice's XML file, which ZATCA does on the Fatoora platform; the reader only reports whether the stamp is present.
• The VAT number is registered, or the invoice was reported to or cleared by ZATCA.
• The items and prices are right. The QR code holds only the totals.

ZATCA does not supply QR codes; your invoicing system generates them. Desktora's ZATCA QR Code Generator makes a Phase 1 code with the five basic fields, as PNG or SVG. It suits a business not yet notified for Phase 2, testing, or seeing what your system should encode. It cannot make a Phase 2 code.

Phase 2 codes must come from an e-invoicing solution onboarded and integrated with Fatoora. For simplified invoices, the solution stamps each invoice and builds the nine-tag code; for standard tax invoices, Fatoora returns the code when it clears the invoice.

Before printing, check a sample invoice with the reader against the printed seller name, VAT number, date and totals.