The ZATCA QR code on an invoice: what is inside it and how to check it

The ZATCA QR code is a QR printed on a Saudi tax invoice that carries five facts about it — the seller's name, the seller's VAT registration number, when it was issued, the total including VAT, and the VAT amount — so the invoice can be checked by scanning it. ZATCA (the Zakat, Tax and Customs Authority) introduced it with e-invoicing, known as FATOORA.

A phone camera that scans one usually shows a long string of letters rather than a web page. That is expected: the five values are packed into a compact binary format and then written as text. The sections below show exactly how, so you can check one yourself.

1. 1

   Each field becomes a TLV record

   TLV means tag, length, value: one byte for the tag (1 to 5), one byte for the length of the value in bytes, then the value itself as UTF-8 text. "Al Noor Trading" is 15 bytes, so its record starts 01 0F.

2. 2

   The five records are joined

   They are written one after another in tag order, making a single run of bytes.

3. 3

   The bytes are base64-encoded

   Base64 turns the bytes into plain letters, digits, + and /, which is what the QR stores.

4. 4

   The text is drawn as a QR code

   Any standard QR library can render it. Scanning gives the base64 text back; decoding the base64 and reading the TLV records gives the five values.

ZATCA brought e-invoicing in two phases. Phase 1, which began on 4 December 2021, required invoices to be generated electronically and introduced the five-field QR described above. Phase 2, rolled out to groups of taxpayers in waves from 1 January 2023, requires invoices to be produced by compliant software that is integrated with ZATCA's FATOORA platform, and adds cryptographic data — a hash of the invoice and a cryptographic stamp — to what the QR carries.

If the VAT figure looks wrong, check the arithmetic first with the VAT calculator, and see how to calculate VAT for the rounding rule that keeps net, VAT and total reconciling.

The Invoice Generator adds this five-field QR automatically once the seller name and a VAT number are filled in, using the invoice's own totals. With no VAT number there is no QR, because the code would claim a registration that does not exist. The same builder runs on the free page and in the workspace, so the code is identical in both.

• The time stamp is the invoice's issue date, encoded at 00:00 UTC; the builder records a date, not a time of day.
• Seller names longer than the 255-byte limit are shortened to fit rather than producing a broken code.
• It is a Phase 1 style QR. BuzPulse is not integrated with ZATCA's FATOORA platform and does not add the Phase 2 cryptographic stamp, so it is not a substitute for a Phase 2 compliant solution once your wave has started.

For everything else a Saudi tax invoice needs — the supply date, the buyer's VAT number when the buyer is registered, the commercial registration — see what to put on an invoice.