The QR Code in the E-Invoice: Fields, TLV Encoding & Verification

When you pay at any Saudi store today, a small square of black dots appears on your receipt. That square is the QR code, a mandatory field on the e-invoice under the requirements of the Zakat, Tax and Customs Authority (ZATCA). It is not just decoration on the receipt; it is an encoded data package that condenses the invoice’s full identity into a single code any phone can read in a second.

Many business owners confuse the QR code, the cryptographic stamp, and the invoice verification process. The three are related, but they are not the same thing. This guide focuses on the QR code alone: which fields it carries, why the Authority mandated it on simplified invoices, how you read and verify it, and how it differed between Phase One and Phase Two. To go deeper into the cryptographic stamp itself and the full verification steps, we point you to the dedicated guides at the end of each section.

Qoyod’s e-invoicing software issues a QR code that matches the Authority’s specification on every invoice automatically, so you never need to generate or encode it by hand.

What is the QR code on the invoice?

The QR code is a two-dimensional code that stores text data readable by a phone camera. On the Saudi e-invoice, the code carries neither a link nor an image; it carries the invoice data itself, encoded in a standard format called TLV and then converted into Base64 text.

TLV stands for three words: Tag, Length, and Value. Each field on the invoice is written as three consecutive segments: the tag number, then the number of characters in the value, then the value itself. These fields are combined into a single string, then converted to Base64, then rendered as a QR square. This format is standardized for every business in Saudi Arabia, so any compatible reader can decode the code and display its contents.

The practical benefit is simple. Instead of an Authority officer or a buyer reading the invoice line by line, they scan the code and the invoice’s core data appears instantly. The code makes the invoice verifiable in the field without connecting to any external system in the basic cases.

The deeper purpose of the code is to close the door on tampering. A paper invoice is easy to forge or to alter its amounts after issuance. When an invoice’s essential data is condensed into a standard code that any party reads the same way, any conflict between what is printed and what is encoded becomes an immediate red flag. This serves three parties: the Authority in oversight, the buyer in protecting their rights, and the business itself in proving the integrity of its invoices.

Which fields does the QR code encode?

The content of the QR code is not arbitrary. The Authority defined the mandatory fields precisely and set their order by tag numbers. On the simplified tax invoice (B2C), the code carries five mandatory core fields.

• Seller name (Tag 1): the legal name of the business issuing the invoice.
• Seller’s VAT number (Tag 2): the 15-digit VAT registration number.
• Timestamp (Tag 3): the invoice’s issue date and time in a standard format.
• Invoice total including VAT (Tag 4): the final amount the buyer paid.
• VAT amount (Tag 5): the tax value calculated on the invoice.

These five fields are the minimum any QR code on a simplified invoice must carry from Phase One onward. In Phase Two, three additional technical fields are added, relating to the signature, the public key, and the stamp, which we explain in the section dedicated to the difference between the two phases.

Note that the code does not carry the invoice’s line-item details, nor the buyer’s name, nor the payment method. Its job is to display the essential data that proves the invoice’s identity, value, and tax, not to replace the full invoice.

How is the QR content encoded technically?

Building the code goes through three clear stages, and the invoicing system performs them automatically in fractions of a second.

First, the system gathers the values of the mandatory fields from the invoice. Second, it writes each field in TLV format: the field’s tag, then the value’s length in bytes, then the value itself. Third, it merges the fields into a single string and converts it to Base64 encoding, then renders the result as a QR matrix.

The importance of the TLV format is that it makes the code machine-readable without ambiguity. The reader knows where each field starts and ends from the length segment, so it needs no separators or guesswork. This is what lets the Authority’s app decode any QR code issued by any system in Saudi Arabia and display it in the same way.

The important message for a business owner: never handle this encoding manually. Any error in the order of the tags or in calculating the length makes the code unreadable or non-compliant. A compatible accounting system handles it entirely.

Why did the Authority choose the TLV format specifically?

The choice of the TLV format was not arbitrary. The format is globally adopted for exchanging structured data because it is compact and free of ambiguity. Each field carries its own definition in its tag, so there is no need for a separate header explaining the order of the fields. This makes the code small enough to be printed on a narrow thermal receipt, while at the same time precise enough to be read by machine without error.

TLV also allows expansion without breaking compatibility. When the Authority added the three Phase Two fields, it did not need to change the entire structure of the code; it simply added new tags numbered 6, 7, and 8 after the first five tags. An old reader ignores what it does not recognize, and a new reader reads everything. This flexibility is what made the transition between the two phases smooth at the level of the code itself.

After building the TLV string, the system converts it to Base64. The purpose of this step is to represent the binary data with safe text characters that can be rendered in a QR code and transferred between systems without corruption. The final result is a single continuous string that is rendered as the square matrix you see on the receipt.

Why is the QR code mandatory on simplified invoices specifically?

The simplified tax invoice (B2C) is the invoice you issue to the final consumer at the point of sale. This is the case where the buyer is an individual, not a business, and does not need a full tax invoice with all their details. This is precisely why the Authority mandated the QR code on it.

The reason is fundamental. In a simplified invoice there is no immediate clearance with the Authority before handing it to the buyer; it is delivered instantly and then reported to the Authority within 24 hours. This leaves a time gap, so the QR code became the fast field-verification tool that proves the invoice is genuine and that its data is consistent at the moment of issuance.

On the full tax invoice (B2B) for transactions between businesses, the situation differs. This invoice goes through a clearance process with the Authority before being sent to the buyer in Phase Two, so verification happens centrally. That is why the QR code was not mandatory on it in Phase One, and became required as part of the Phase Two requirements.

This difference explains why the discussion of the QR code focuses on the point of sale and retail specifically. The volume of simplified invoices is enormous, daily, and instantaneous, and it cannot tolerate a clearance delay at every purchase. The code is the solution that balances speed of delivery with the ability to verify later, so the invoice is delivered instantly to the buyer and remains inspectable at any time via its code.

From another angle, the code eases the burden on the buyer. They no longer need to keep a perishable paper receipt to prove their purchase, since reading the code is enough to extract the invoice data. This is a leap in the Saudi consumer experience, as it tied every retail sale to documented tax data that can be read instantly.

In short, the QR code is the trust tool in the case where the invoice does not go through prior central verification, namely the simplified invoice. To learn the full difference between the types of e-invoices and when each type is issued, review the dedicated guide.

Where is the QR code placed on the invoice, and what are its printing requirements?

The code’s position is not just a design matter; it is part of the invoice’s verifiability. The Authority required the code to be clear and scannable, so practical rules apply that you must pay attention to.

• The code is printed at a size large enough to be scanned by an ordinary phone camera, as a code that is too small cannot be read.
• A white margin is left around it, because a code stuck to text or a border confuses the reader.
• The contrast is high: dark dots on a light background, not the reverse, and not faded colors.
• In digital invoices (PDF), the code remains part of the invoice file itself, not a separate image.

On thermal receipts at points of sale, be aware that thermal paper fades over time. For this reason, it is preferable that the business keep a digital copy of every simplified invoice carrying the full code, rather than relying on the paper receipt alone. A compatible accounting system saves these copies automatically within the invoice log.

Is the code the same on a business invoice and a consumer invoice?

The core idea is the same, but the context differs. On the simplified invoice directed at the consumer, the code is the primary verification tool because the invoice does not go through prior clearance. On the full invoice between businesses, the primary verification happens through clearance with the Authority, and the code remains a supporting element for quick reading. In both cases, in Phase Two the code carries the essential data and the stamp, but its weight in the trust process differs depending on the type of invoice.

How do you read and verify a QR code?

Reading the code is available to anyone without special tools, while official verification is done through the Authority’s app. There is a difference between the two that must be clear.

General reading: Any modern phone camera or QR reader app decodes the code and displays the text data. This is how a buyer can see the seller’s name, VAT number, and the invoice’s value and tax directly from the receipt.

Official verification: The Authority released the Fatoora Platform app, dedicated to scanning QR codes on invoices. The app reads the code and displays the data in an organized way, and on Phase Two invoices it verifies the validity of the cryptographic stamp embedded in the code.

The practical reading steps are simple:

• Open your phone camera or the Authority’s Fatoora Platform app.
• Point the camera at the QR code on the receipt.
• Wait for the data to appear: seller name, VAT number, timestamp, total, tax.
• Compare the displayed amount with the amount printed on the invoice to confirm they match.

Verifying the code is part of a broader process of verifying the validity of the full invoice, which includes confirming the cryptographic stamp and the invoice sequence. The full verification process has its own separate steps. And the identity of the cryptographic stamp itself is tied to the Cryptographic Stamp Identifier (CSID) certificate registered with the Authority, and you can refer to its guide to understand how the stamp links the invoice to your approved business.

The difference between the QR code in Phase One and Phase Two

The role of the QR code evolved between the two phases of e-invoicing. The difference is not cosmetic; it is in the number of fields and in the function of the code itself.

The QR code in Phase One (Generation)

In Phase One, which began on 4 December 2021, the QR code was mandatory on simplified invoices only, and it carried the five core fields: seller name, VAT number, timestamp, total including VAT, and tax amount. The code carried no digital signature, because Phase One did not require the cryptographic stamp at all. The code’s role here was to display the invoice data in a standard, readable format. For more on the scope of this phase, review the guide to Phase One of the e-invoice.

The QR code in Phase Two (Integration)

In Phase Two, which began on 1 January 2023 in waves, the content of the code changed fundamentally. Three technical fields were added on top of the five fields:

• The invoice’s cryptographic stamp (Tag 6): the digital signature that proves the invoice was not altered.
• The public key (Tag 7): the key that allows the signature’s validity to be verified.
• The signature stamp issued by the Authority (Tag 8): the stamp tied to the approved business’s certificate.

With this addition, the code transformed from a mere data display into a security-verification tool. The Authority’s app could now read the code and confirm the signature’s validity without referring back to the seller’s system. The QR code also became mandatory on the simplified tax invoice as part of the Phase Two requirements in its expanded form. The details of the rest of the obligations are in the guide to Phase Two requirements.

What does the QR code mean for the reliability of your invoices?

For a business owner, the QR code is not merely a regulatory burden; it is a tool that strengthens customer trust and protects your records. When a buyer sees a valid code displaying the same data printed on the invoice, they are reassured that the business operates within the system and that their invoice is documented with the official body.

At the level of records, every sale becomes documented with machine-verifiable data. This simplifies any later review, whether an internal review or one by the Authority, because the essential data of every invoice is saved in a standard format. With this, the old problems of paper invoices disappear: loss, fading, or undocumented alteration.

Most importantly, the code links the invoice directly to the business’s tax identity through the VAT number embedded in it. This reduces the chances of invoices being impersonated in your business’s name, and makes any forged invoice easy to detect when compared against the code’s data. In this sense, the code is part of an integrated protection system, not just a sticker on the receipt.

Common QR code errors and how to avoid them

Most QR code problems arise from trying to generate it manually or from a non-compatible system. Here are the most prominent:

• A code that will not read: Usually due to an error in the TLV encoding or in calculating the field lengths. The solution is to use an approved system that generates the code automatically.
• Mismatched data: An amount appearing in the code that differs from what is printed on the invoice. This indicates a flaw in building the invoice that must be addressed immediately.
• Missing technical fields in Phase Two: A code carrying only five fields while the business is in Phase Two. This makes the invoice non-compliant.
• A code with distorted printing: Printing at low resolution makes scanning impossible. Ensure clear printing and a sufficient size for the code.

The practical rule is that the QR code is not an element you intervene in manually. As long as your system is compatible with the Authority’s requirements, it handles generating, encoding, and stamping the code without any intervention from you.

The QR code in the practical reality of small businesses

Many small-business owners deal with the QR code for the first time when they transition from paper invoices. The questions that recur in practice are similar, and understanding them saves time and prevents violations.

A store that sells directly to the consumer, such as a cafe or a retail shop, issues simplified invoices all day long. Every receipt must carry a QR code with at least the five fields. Here the shop owner needs no manual action as long as the point-of-sale system is connected to a compatible invoicing system, since the code is printed within the receipt automatically on every sale.

A business that sells to both individual customers and companies issues two types of invoices: simplified for individuals, and full for companies. It must make sure its system distinguishes between the two cases and places the code in its correct form on each type. Confusing the two types is a common error that field verification detects easily.

As for a business that entered under one of the Phase Two waves, it must make sure the code on its invoices now carries all eight fields, not just the five. Settling for the five fields after entering Phase Two makes the invoice non-compliant, even if it looks fine to the eye.

The practical takeaway is that the real burden is not in understanding the details of the code, but in choosing a system that handles generating it correctly according to the invoice type and the business’s phase. Then the code becomes a detail that works in the background without occupying you.

How does Qoyod help you with the QR code and compliance?

Qoyod generates the QR code on every simplified invoice in the TLV format matching the Authority’s specification, and it embeds the five mandatory fields and the three Phase Two fields automatically according to your business’s phase. You write nothing, arrange no tags, and calculate no lengths.

Alongside the code, Qoyod issues Phase Two-compliant invoices that are cryptographically stamped, adds a unique identifier (UUID) to them, and stores the invoice hash chain to guarantee their sequence. It also handles integration with the Fatoora Platform for immediate clearance on business invoices and reporting within 24 hours on simplified invoices.

It remains for the business to register its own cryptographic stamp certificate with the Authority, and Qoyod guides you through this step. As for generating, stamping, and encoding the code, it is done entirely without any burden on you.

Frequently asked questions

Is the QR code mandatory on all invoices?

The QR code is mandatory on the simplified tax invoice (B2C) from Phase One. On the full tax invoice between businesses, it became required as part of the Phase Two requirements.

Which fields does the QR code carry?

Five core fields: seller name, VAT number, timestamp, total including VAT, and tax amount. In Phase Two, three fields are added: the cryptographic stamp, the public key, and the signature stamp.

How do I read the QR code on the invoice?

Point your phone camera or the Authority’s Fatoora Platform app at the code, and the invoice’s core data appears directly. To verify the validity of the stamp in Phase Two, use the Authority’s dedicated app.

What is the difference between the QR code and the cryptographic stamp?

The cryptographic stamp is the digital signature that proves the invoice’s integrity, while the QR code is the container that carries the invoice data, and it includes the stamp itself among its fields in Phase Two.

Do I need to generate the QR code manually?

No. Any accounting system compatible with the Authority’s requirements generates, encodes, and stamps the code automatically. Manual generation is error-prone and makes the invoice non-compliant.

What happens if the QR code is unreadable?

An unreadable code means a flaw in the encoding or the printing, and it makes the invoice invalid for verification. Address the problem immediately through a compatible system that ensures clear printing and correct encoding.

Does the QR code carry all the invoice line items?

No. The code carries only the essential data: the seller’s identity, the invoice’s value and tax, and its timestamp, in addition to the stamp fields in Phase Two. The details of the line items and product names remain in the body of the invoice, not in the code.

Does the QR code differ from one accounting system to another?

The content and format of the code are standardized for every business by the Authority’s specification, so its essence does not differ from one system to another. What differs is the system’s accuracy in generating it. A compatible system adheres to the correct fields, order, and encoding, while a non-compatible one may produce a distorted or incomplete code.

Do I need the internet to read a QR code?

Reading the text data from the code does not require a connection, because it is embedded in the code itself. As for verifying the validity of the cryptographic stamp through the Authority’s app in Phase Two, it may require a connection to confirm the certificate’s approval.