How to read the QR code on any tax invoice
Three ways in, one result: the five fields exactly as the issuer encoded them.
Get the payload
Scan the code with your camera, upload an image of the invoice containing it, or paste the Base64 string if you already have it.
Read the five fields
The decoder shows the seller name, VAT number, timestamp, total including VAT and the VAT amount, alongside the raw TLV records.
Review the checks
Three checks run: VAT number format, timestamp format, and whether the VAT amount is consistent with the total. The last one derives the implied rate and compares it against the rates used in the Gulf.
What the code should contain
A Phase 1 QR carries five fields, tagged 1 to 5, encoded as TLV then Base64. Any compliant reader must be able to extract all of them.
- Tag 1: seller name
- Tag 2: VAT number (15 digits)
- Tag 3: ISO 8601 timestamp
- Tag 4: total including VAT
- Tag 5: VAT amount
Why decoding sometimes fails
The most common cause is how the Arabic name was encoded. The TLV length byte counts bytes, not characters, and an Arabic letter costs two bytes in UTF-8 — so a tool that counts characters writes a wrong length and the rest of the string becomes unreadable.
Other causes: a Base64 string truncated on copy, a code printed too small or at too low a quality for the camera, or a payload that was never TLV to begin with.
Tags above 5 indicate a Phase 2 code carrying signature data; the decoder surfaces those rather than dropping them.
What "pass" means here
These checks are about format only: that the VAT number matches the required shape, that the timestamp is a real date, and that the VAT amount is plausible against the total. They do not prove the invoice was really issued by that business.
A Phase 1 QR carries no cryptographic signature, so no tool — this one included — can establish authenticity from the code alone. For official verification, use ZATCA’s own validation service.
Frequently asked questions
Is the image or the invoice data uploaded anywhere?
No. The image is read inside your browser, and camera frames are never recorded or transmitted. The decoder works offline once the page has loaded.
Does it work with Phase 2 codes?
It decodes their contents and shows the extra tags they carry, but it does not verify the cryptographic signature — that requires ZATCA’s own tooling.
Why does the seller name show as strange characters?
Usually because the issuer encoded the name as something other than UTF-8, or measured the field length in characters rather than bytes. When a value cannot be read as text the decoder shows it as hex rather than as mangled symbols.
This content is technical guidance and does not replace accounting or legal advice.