The ZATCA QR code: what is inside it and how to check yours

Every simplified tax invoice printed in Saudi Arabia carries a QR code. Most merchants have never looked inside one. It is worth five minutes, because a malformed QR is one of the easiest compliance failures to have and one of the easiest to detect.

It is not a link

Scanning a ZATCA QR with a normal camera app usually shows a long string of characters, not a website. That is correct behaviour. The QR encodes aBase64-encoded TLV structure — tag, length, value — carrying the invoice's key facts.

Phase 1: five fields

The original five, each with a numeric tag:

Each is written as its tag byte, then a length byte, then the value. The whole sequence is Base64-encoded and that string becomes the QR payload.

Phase 2: three more

Phase 2 adds the cryptographic proof:

And, for standard invoices, tag 9 carries the authority's own stamp.

This is the change that matters. In Phase 1 the QR was a summary. In Phase 2 it isevidence: anyone can take the printed receipt, decode the QR, hash the referenced invoice and verify the signature against the public key. A receipt whose QR does not verify is a receipt that says something is wrong.

How to check your own

You do not need special software.

1. Scan the QR on a printed receipt with any scanner app that shows raw text
2. Copy the Base64 string
3. Decode it with any Base64 tool
4. You should see your seller name and VAT number as readable text, with binary segments between them

What to look for:

• Your seller name appears, spelled correctly, in Arabic
• Your VAT registration number is 15 digits and is yours
• The timestamp matches the sale
• The totals match the printed totals exactly, to the halala
• After tag 5, there are further binary fields — if the string ends after the VAT total,you are producing a Phase 1 QR on a Phase 2 obligation

That last check is the valuable one, and it takes thirty seconds.

The three failures we see most

1. The QR is cut off by the printer. A 58mm printer rendering a QR sized for 80mm paper produces a square that cannot be scanned. Print a receipt, scan it with a phone, and confirm it reads on the first try from 20cm away.

2. Arabic seller name mangled. The seller name must be encoded as UTF-8. Systems that assume single-byte characters produce a length byte that does not match the actual bytes, and the whole TLV structure becomes unparseable after that field.

3. Totals rounded differently in the QR and on the face of the receipt. The QR says 115.50 and the printed total says 115.49. Both are your system's output and they disagree, which is exactly the kind of inconsistency an audit looks for.

Why print quality matters more than it sounds

Thermal receipts fade. A QR that is scannable on day one and unreadable after four weeks in a customer's glovebox is a practical problem when that customer needs to prove a purchase.

Practical measures: use good thermal paper, keep the print head clean, set the QR to the largest size the paper allows, and keep the error-correction level at the higher setting so a scuffed receipt still scans.

What Wameed does

The QR is generated on the device from the same signed XML that is reported, so the two cannot diverge. It is sized to the paper width in use, rendered at high error correction, and the receipt template is previewed before it goes live so you see what a customer will see.

More on theZATCA page. For the wider picture, read thecomplete Phase 2 guide.

Not tax advice — confirm your obligations with ZATCA.