ZATCA QR Code: E-Invoice Requirements for Phase 1 and Phase 2

This article is general guidance, not legal or tax advice. Technical specifications are updated from time to time, so always check the latest e-invoicing documents on the ZATCA e-invoicing (Fatoora) portal before building or changing an invoicing system.

What is the ZATCA QR code?

The ZATCA QR code is the square barcode printed on electronic invoices in Saudi Arabia. It is not a link to a website. It carries a compact, encoded copy of key invoice data that anyone can scan to confirm who issued the invoice, when, and how much VAT it includes. ZATCA introduced it with the first phase of e-invoicing (the "Generation" phase) on 4 December 2021, and expanded its content in the second phase (the "Integration" phase), which has been rolled out to taxpayers in waves since 1 January 2023.

For a business, the QR code is one of the most visible signs of e-invoicing compliance. A customer, an auditor or a ZATCA inspector can check it in seconds, so a wrong or unreadable code is easy to spot.

Which invoices need a QR code?

• Simplified tax invoices (mainly B2C sales, such as receipts from a shop, restaurant or pharmacy POS) and their credit and debit notes: the QR code has been mandatory since Phase 1.
• Standard tax invoices (mainly B2B and B2G sales) and their notes: the QR code was optional in Phase 1. ZATCA's invoicing guideline lists it as a required element of standard invoices from January 2023, in line with Phase 2.

In Phase 2, standard invoices must be cleared by ZATCA before they are shared with the buyer, while simplified invoices are reported to ZATCA within 24 hours of issue. The QR code must match the final, signed invoice in both cases. Our ZATCA Phase 2 guide explains clearance and reporting in more detail.

What a Phase 1 QR code contains

A Phase 1 QR code holds five fields:

Tag	Field	Example value
1	Seller's name	Example Store
2	Seller's VAT registration number	300000000000003
3	Invoice date and time (timestamp)	2026-11-09T14:25:00Z
4	Invoice total including VAT	1150.00
5	VAT total	150.00

How TLV and Base64 encoding work

The fields are not written as plain text. Each one is encoded as TLV (Tag-Length-Value): one byte for the tag number, one byte for the length of the value in bytes, then the value itself in UTF-8. The TLV blocks are joined with no separators, and the whole byte string is converted to Base64. That Base64 text is what the QR image stores.

In the example above, tag 1 has a length of 13 bytes, tag 2 has 15, tag 3 has 20, tag 4 has 7 and tag 5 has 6. The resulting Base64 string is:

AQ1FeGFtcGxlIFN0b3JlAg8zMDAwMDAwMDAwMDAwMDMDFDIwMjYtMTEtMDlUMTQ6MjU6MDBaBAcxMTUwLjAwBQYxNTAuMDA=

Note that length is counted in bytes, not characters. An Arabic seller name uses two bytes per letter in UTF-8, so a four-letter Arabic name has a length of 8. Getting this wrong is a common reason a code fails to decode.

Extra fields in a Phase 2 QR code

Once a business is integrated with ZATCA's Fatoora platform, its e-invoicing solution must produce a signed XML invoice, and the QR code gains cryptographic fields that tie it to that XML:

Tag	Field	Purpose
6	Hash of the XML invoice	Proves the QR belongs to this exact invoice
7	ECDSA signature	The invoice's digital signature from the seller's solution
8	ECDSA public key	Lets a verifier check the signature
9	ZATCA's signature of the cryptographic stamp's public key	Applies to simplified invoices and their notes; links the device certificate to ZATCA

The cryptographic stamp is issued to each invoicing device or solution during onboarding with ZATCA. Because the hash and signature are calculated from the final XML, the QR code must be generated after the invoice is signed, and the printed invoice must not be changed afterwards. Any correction is made with a credit or debit note, which gets its own QR code.

How customers verify the QR code

ZATCA provides an official mobile app (search for the ZATCA app on Google Play or the App Store) with an e-invoice verification service. ZATCA's verify e-invoice service page describes the steps:

1. Open the app and go to the Zakat, Tax and Customs services section.
2. Choose the e-invoice verification service.
3. Scan the QR code on the printed or PDF invoice.
4. Compare the decoded details (seller, VAT number, date, totals) with what is printed on the invoice.

If the details do not match, or the code cannot be read, the customer has a reason to question the invoice. That is why retailers and restaurants should test codes with the app on their real printers before going live.

Common QR code mistakes to avoid

• Encoding a URL or plain text instead of TLV data in Base64.
• Writing tag and length as text characters (for example "01") instead of single bytes.
• Counting characters instead of bytes, which breaks Arabic seller names.
• Totals that do not match the invoice because of rounding differences between line items and the grand total.
• A seller name or VAT number that differs from the details registered with ZATCA.
• Wrong timestamp format, or the time of printing instead of the time of issue.
• Generating the Phase 2 QR before signing, so the hash and signature do not match the XML.
• Codes printed too small or faded on thermal receipts, so phones cannot scan them.
• Using a free QR generator instead of a compliant e-invoicing solution once Phase 2 applies to you.

Generate compliant QR codes automatically

The safest approach is to let your billing system build the QR code from the same data that produces the invoice, so the totals, VAT and signatures can never drift apart. AxoOne Cloud POS issues ZATCA Phase 2 simplified and standard invoices with the QR code generated by the system, and works with AxoOne Inventory & Accounting for your books and VAT reports. Restaurants can also see our restaurant POS.

Want invoices your customers can verify with confidence? Explore AxoOne Cloud POS or book a free demo with our Riyadh team.

Frequently asked questions