What a ZATCA e-invoice QR contains and how to read one

Why you’d do this

If you shop in Saudi Arabia, you have seen the small square QR code printed at the bottom of a receipt or invoice. It comes from the e-invoicing rules of the Zakat, Tax and Customs Authority (ZATCA). Most people never scan it, but there are good reasons to. You may want to check that the total and the VAT on a paper receipt match what the seller encoded, copy the seller’s VAT number for an expense report, or read the timestamp on an invoice you only have as a photo. If you run a small business, you may also want to see what your own system is putting into the code.

The code is not an encrypted secret. It is a short, structured piece of text, and once you know the layout it is easy to read.

How, with the named tool

Two tools work together here: the QR & Barcode Reader to scan, and the ZATCA invoice QR page to decode the fields.

What is inside. A simplified-invoice QR carries five fields, each stored as a tag, a length and a value, which is what “TLV” means:

1. Tag 1: the seller’s name.
2. Tag 2: the seller’s VAT registration number (15 digits).
3. Tag 3: the invoice timestamp.
4. Tag 4: the invoice total including VAT.
5. Tag 5: the VAT amount.

All of those bytes are then turned into Base64, a way of writing binary data using only letters, digits and a few symbols so it can travel as plain text. That Base64 text is what the QR code actually holds.

Scan it. Open the QR & Barcode Reader and tap Open camera, then point it at the code. There is no shutter: it reads on its own. You can also tap Upload an image or Paste an image for a photo or screenshot. If several codes are in the frame, the tool lists them and asks you to pick one. The result card labels the code as “ZATCA invoice QR”, and offers Open in the ZATCA decoder.

Decode it. On the ZATCA invoice QR page, stay on Decode. You can tap Paste text for the raw Base64 string, Upload for a photo of the code, or Scan to use the camera. The tool then shows Total (incl. VAT), VAT amount, Seller, VAT number and Timestamp, each with a copy button.

Check the arithmetic. Compare the VAT amount to the total. At the standard 15% rate, VAT is the total minus (total ÷ 1.15): a total of 115.00 SAR should show 15.00 SAR of VAT. If the numbers do not line up, the receipt may be for zero-rated or exempt items, or something is wrong.

Build one. The Generate tab takes the seller name, VAT number and invoice total. The timestamp arrives filled with the current time, and the VAT amount auto-fills at 15% until you edit it. You can save the live preview as PNG or SVG, or tap Copy Base64.

What to watch for

Decoding reads the fields; it does not verify them. The tool says so in its own disclaimer: fields decoded, but this does not verify the ZATCA stamp or the seller’s registration. A QR that decodes cleanly can still be forged or wrong, because anyone can build a QR with five plausible fields. Nothing here confirms the seller is actually registered.

Phase 1 and Phase 2 are different. The five fields above are the Phase 1 (generation) requirements for simplified invoices. Later phases, in general terms, add integration with ZATCA’s systems and extra cryptographic tags, such as a signature, in the QR. When a code has tags beyond the first five, the decoder lists them under “Cryptographic fields present”, with their tag numbers and sizes in bytes, but it does not check them. The generator makes only the Phase 1 fields, and the tool warns that full ZATCA compliance involves more than the QR, so confirm your own invoicing obligations with ZATCA.

Not every QR is an invoice. If the code is a normal QR, the tool says “QR is not a ZATCA e-invoice”. If part of it is unreadable you will see “Truncated data”, and the fix is a sharper photo with the whole code in the frame. If the VAT number is not 15 digits, the tool flags it.

Treat the scanner like any scanner. The reader never opens a link by itself, and for links it flags shortened, insecure or lookalike addresses first. Scans are kept on your device under Recent scans, and Clear all removes them. On some devices the reader is built in; on others it downloads a bundled reader of about 1 MB, which is cached after the first use. Either way, decoding happens on your device and invoice data is not uploaded.

Invoices contain business details. A decoded QR shows a seller’s name and VAT number, and the total. Be careful about pasting decoded text into chats or forms that you do not control.

FAQ

Is the QR code encrypted?

No. The Phase 1 fields are plain text, encoded as TLV and then Base64. Anyone can decode them, which is why decoding proves nothing about authenticity. Extra cryptographic tags in later-phase codes serve a different purpose and are listed but not verified by this tool.

Why do the total and VAT look different from the paper receipt?

Check the timestamp and amounts on the decoded fields first. If the code says one total and the printed receipt says another, that mismatch is exactly what you were looking for, and it is worth raising with the seller. Also remember some items carry no VAT, which changes the ratio.

Can I check that a seller is really VAT-registered with this?

No. The tool decodes the fields and can only warn when the VAT number is not 15 digits. Verifying registration is a separate step with ZATCA.