ZATCA E-Invoice QR Code Decoder & Checker

The tags. Following the ZATCA security-features implementation standards, each record is a tag byte, a length byte and the value. Tag 1 is the seller name, tag 2 the VAT registration number, tag 3 the invoice timestamp (ISO 8601), tag 4 the invoice total with VAT and tag 5 the VAT total. Tags 1 to 5 are the Phase 1 content. Phase 2 adds tag 6 (SHA-256 hash of the invoice XML), tag 7 (ECDSA signature), tag 8 (ECDSA public key) and, for simplified invoices, tag 9 (the signature of the ZATCA technical CA\'s stamp). The decoder reports which layout it found, shows text values as text and binary values in hex, and for the public key says which algorithm and curve it carries.

Structural checks. The Base64 must decode; every record must fit inside the data; tags 1 to 5 must be present; the VAT number should have 15 digits starting and ending with 3; the timestamp should be a real ISO 8601 date and time; the totals should be plain decimals, the VAT total not larger than the invoice total; no tag should repeat; the whole payload should stay within the 700 characters the standard allows. Unknown tags are listed and flagged.

What is not verified. ZATCA signs with ECDSA on the secp256k1 curve, which the Web Crypto API of browsers does not support, and checking a certificate chain would need current ZATCA certificates that cannot be maintained safely inside a web page. So tags 6 to 9 are shown but their signatures are not verified. For validation use ZATCA\'s own tools or your accounting software.

Input. An image, a PDF (every page up to the first 40 is searched) or the Base64 text pasted from a scanner app. The QR is decoded in your browser and nothing is sent anywhere.

PDF (up to 50 MB), PNG, JPEG and WebP images (up to 30 MB), or Base64 text. The QR must hold a ZATCA TLV payload in Base64. Signatures and certificates are not verified.

1. Drop the PDF or image of the invoice, or paste the Base64 text from the QR code.
2. Read the decoded tags and the layout that was detected (Phase 1, Phase 2 or simplified).
3. Look at the findings: missing tags, odd VAT numbers, timestamps or amounts.
4. For signature validation, use ZATCA's tools: this decoder only inspects the structure.

• Checking that the QR on a received invoice carries the same seller, VAT number and total as the printed invoice
• Seeing which tags a billing program writes in Phase 1 and Phase 2
• Finding out why a QR does not scan in an app
• Reading the timestamp and VAT amount from a simplified invoice QR
• Learning what the nine tags mean

This is a structural decoder, not an official ZATCA validator, and it does not claim an invoice is ZATCA approved. It cannot say whether an invoice was reported, cleared or accepted, and a well-formed QR can belong to an invalid invoice. Signature verification needs the secp256k1 curve and ZATCA certificate chains, which a browser tool cannot support safely, so signatures are only described.

The tag layout follows the ZATCA standard version 1.2 (19 May 2023) as published; ZATCA can issue newer versions and the tool should be compared with the current ZATCA documentation. Length bytes limit a value to 255 bytes, as in the standard.