KSeF KOD I: What the Invoice QR Code Contains

An invoice issued in Poland's National e-Invoice System (KSeF) exists as an XML file in the system. People, however, usually receive a printed or PDF version, the visualisation. To tie the two together, the visualisation carries a QR code. That code, called KOD I, is the topic of this guide. The facts here come from the Ministry of Finance's KSeF documentation as read on 6 October 2026; check ksef.podatki.gov.pl for the current text.

A QR code that is a link

KOD I is the graphic form of a web address. The address has four parts after the base: /invoice/{NIP}/{date}/{hash}. The base is the QR service of the environment: qr.ksef.mf.gov.pl for production, qr-demo.ksef.mf.gov.pl for the demo environment and qr-test.ksef.mf.gov.pl for tests. The NIP is the seller's tax number. The date is the issue date, the invoice's P_1 field, written day-month-year with dashes. The hash is the SHA-256 digest of the invoice file, encoded in Base64URL without padding, which gives 43 characters.

Why the hash matters

The hash is computed over the exact bytes of the XML file. That makes it a fingerprint: anyone who has the file can recompute it and compare. It also means that opening the XML in an editor and saving it again can change the hash, even if nothing visible changed, for instance through different line endings or character encoding. When a code and a file disagree on the hash, the usual explanation is that the file is not the one that was sent to KSeF.

What goes under the code

The visualisation prints the KSeF number of the invoice under the QR code. A KSeF number has the form NIP, date and a long identifier with a check part, for example 5265877635-20250709-0100E01D6840-3C. When the number is not known, which is the case for an invoice issued in offline mode that has not yet been sent, the caption OFFLINE is printed instead. An offline invoice that has since been sent and has received its number carries the number under the code too.

KOD II is something else

A second code, KOD II, exists for offline invoices. It confirms the identity of the issuer with a certificate: its link has a different path (/certificate/…) and ends with a digital signature made with the issuer's private key. It is created in the issuer's invoicing software, which holds the key. A web tool should never ask for such a key, and the KSeF QR Code Generator & Checker does not create or check KOD II.

Checking a code yourself

• Is the host one of the three KSeF hosts? A link that only looks like KSeF is a red flag.
• Does the NIP pass the NIP check digit, and does it match the seller on the invoice?
• Does the date equal the invoice's issue date?
• If you have the XML, does its SHA-256 (Base64URL) equal the hash in the link?

These checks can be done in your browser with the KSeF QR Code Generator & Checker, which can also place a code on a PDF visualisation. To read an invoice file, the KSeF FA(3) XML Viewer shows its contents. A well-formed link says nothing about whether the invoice is in KSeF; only the system itself can say that.