The QR code on Saudi invoices: what it contains and how to verify an invoice

The QR code on a Saudi invoice is a mandatory field whose specification is set by the Zakat, Tax and Customs Authority (ZATCA) — and it is nothing like the marketing QR codes that open a web page. It carries the invoice's own data inside it, in a structured format that any compatible reader can decode and verify. It has been mandatory on simplified tax invoices since December 4, 2021, and its contents were extended in Phase 2 with cryptographic elements that make the invoice self-verifiable.

What does the QR code on a Saudi invoice contain?

The code holds the invoice's core data encoded in TLV (tag–length–value) format: the seller's name, their VAT registration number, the date-time stamp, the invoice total including VAT, and the VAT amount. Phase 2 added cryptographic fields: the invoice hash, the digital signature, and the public key. These fields are concatenated into a single byte string, Base64-encoded, and rendered as the QR square printed on the invoice.

In plain language: TLV means every piece of information is stored as a triplet — a tag number identifying what it is, its length in bytes, then its value — so readers can parse the fields in a fixed, unambiguous order.

What are the nine fields in detail?

Tag	Content	Phase
1	Seller's name	Phase 1
2	VAT registration number	Phase 1
3	Invoice date-time stamp	Phase 1
4	Invoice total (with VAT)	Phase 1
5	Total VAT amount	Phase 1
6	Hash of the invoice XML	Phase 2
7	Digital signature (ECDSA)	Phase 2
8	Seller's public key	Phase 2
9	ZATCA's signature over the public key (simplified invoices)	Phase 2

Fields 1 to 5 make the invoice data machine-readable; fields 6 to 9 make it provable: the hash reveals any modification made to the invoice after issuance, and the signature proves it really came from the seller's system as registered with ZATCA.

Why does the QR code matter to both consumers and businesses?

Because it turns every customer into a verifier. A consumer can scan the code and compare what is inside it (seller name, VAT number, amounts) with what is printed on the invoice; any mismatch is a red flag. For a business, the code matters from two angles:

• Compliance: a simplified invoice without a QR code — or with one that does not match the specification — is simply non-compliant;
• Trust: the signed Phase 2 code proves to your customers that your invoices come from a compliant system integrated with the Fatoora platform.

How do you verify an invoice using its QR code?

1. Scan the code with any QR reader that can display raw text (no special app is needed to read the raw content); you will get a Base64 string.
2. Decode it with a TLV decoding tool — free ones exist — to display the fields: seller name, VAT number, timestamp, amounts.
3. Compare the extracted values against the printed or digital invoice: they must match exactly.
4. Check the VAT number: a Saudi VAT registration number has 15 digits and both starts and ends with the digit 3.
5. For developers and systems: ZATCA's technical guidelines specify how to generate and validate the code, and systems must pass compliance checks before they receive a production cryptographic stamp certificate.

What are the common mistakes when generating the code?

• Wrong text encoding: text fields (including Arabic names) must be UTF-8 encoded before lengths are computed, or decoding breaks;
• Counting length in characters instead of bytes — a single Arabic character occupies more than one byte;
• Embedding a URL instead of TLV data: a code that opens a web page does not match the specification;
• Not regenerating the code after amending an invoice with a credit note — every document has its own code.

Compliant systems — Efatora among them — generate the code automatically to the correct specification with every invoice, so business owners never need to deal with encoding details.

The bottom line

The Saudi QR code is the invoice's identity card: five identification fields since Phase 1, and four cryptographic fields in Phase 2 that make tampering detectable. Scanning it and comparing it against the invoice is the simplest integrity check for any invoice you receive.

Sources

• ZATCA — Guide to developing a FATOORA-compliant QR code (PDF)
• ZATCA — Detailed Guidelines for E-Invoicing (PDF)
• ZATCA — E-invoicing Detailed Technical Guidelines (PDF)