Skip to content

Your technology partner. Delivery guaranteed.

Englishالعربية
Talk to us

ZATCA QR decoder

What is inside this e-invoice QR code?

Every ZATCA e-invoice QR is Base64 wrapping a short tag-length-value record. Paste the text or scan the image and this reads each tag, names it, checks the structure against the ZATCA standard, and tells you whether it is a Phase 1 or a Phase 2 code.

Runs in your browser. The QR text, any image you choose and every camera frame stay on this device. Checks the code’s structure, not ZATCA’s acceptance of the invoice.

The text a QR scanner app shows for the code — usually starts with “AQ” or “AR” for a tag-1 seller name. Whitespace and line breaks are ignored.

Or read it from an image

Tag definitions read from ZATCA’s Security Features Implementation Standards, v1.2 (PDF) · read on 2026-09-03 · Not integrated yet? Find your wave

Questions this tool gets asked

What is inside a ZATCA e-invoice QR code?
A Base64 string of at most 700 characters. Decoded, it is a sequence of fields, each one a tag byte, a length byte and the value: the seller name (1), the seller’s VAT number (2), the invoice timestamp (3), the total with VAT (4) and the VAT total (5). Phase 2 codes add the XML hash (6), an ECDSA signature (7), the public key (8) and, for simplified invoices, the signature of the ZATCA-issued stamp (9).
How do I tell a Phase 1 QR from a Phase 2 QR?
By the tags. A Phase 1 code carries tags 1–5 only. A Phase 2 code carries 1–8, and 9 as well on a simplified invoice. If an invoice was issued after the taxpayer’s integration date and its QR has only five tags, the invoicing system is not producing what the integration phase requires.
Does this tool verify the signature or check with ZATCA?
No. It checks structure: which tags are present, whether their lengths add up, whether text fields are valid UTF-8, whether the timestamp and amounts are in the expected form. Verifying the ECDSA signature needs the invoice XML and the certificate chain, and whether ZATCA accepted the invoice is recorded on the Fatoora platform, not in the QR.
Where does the QR I paste or upload go?
Nowhere. The decoder runs entirely in your browser; an image is read by the browser’s own barcode detector and never uploaded. Our analytics records that a decode happened and whether the result was Phase 1, Phase 2 or invalid — never the seller, the VAT number, the amounts or the image.
Why can’t my browser read the image?
Image scanning uses the browser’s built-in BarcodeDetector, which Chrome, Edge and Android browsers have had for years and Safari added in version 17. Firefox does not provide it. On any browser you can scan the code with your phone’s camera app and paste the text it shows.

This is a developer aid, not a compliance verdict. The tag definitions are read from ZATCA’s published standard and re-checked on the date shown above; ZATCA can revise them. A structurally valid QR is necessary for compliance, not sufficient — the XML invoice, its signature and its clearance or reporting are where compliance is decided.