ZATCA QR code decoder
Paste the base64 string from a Saudi tax invoice QR code and read what is actually inside it: seller, VAT number, timestamp, totals, and whether the invoice is signed under Phase 2.
Everything on this page runs in your browser. Nothing you paste or type is uploaded, logged or stored — an invoice QR carries a seller's VAT number, totals and signature, and that belongs to you.
What is actually in a ZATCA QR code
It is not a link. The QR on a compliant Saudi invoice holds a compact binary structure — tag, length, value — encoded as base64. Each field has a numbered tag: 1 is the seller name, 2 the VAT registration number, 3 the timestamp, 4 the total including VAT, 5 the VAT amount.
Phase 2 documents add four more: a hash of the invoice XML, the digital signature, the public key, and the certificate stamp. That is why the presence of tags 6 to 9 tells you which phase the document was produced under.
What this tool can and cannot tell you
It reads the fields and shows you what the invoice claims: who issued it, when, for how much, and how much of that is VAT. If those figures disagree with the printed invoice in your hand, that is worth asking about.
It does not verify the signature. Confirming that a signature is valid and that the certificate behind it is genuine is something only ZATCA can do authoritatively, and any tool claiming otherwise is overstating what it knows.
Common questions
Is the QR payload I paste uploaded anywhere?
No. The decoding happens in your browser, and nothing you paste is uploaded, logged or stored. That is deliberate rather than incidental: an invoice QR carries a seller's VAT number, totals and signature, and that information belongs to you. The page does not even host a form that could post it.
What is actually inside a ZATCA QR code?
It is not a link. The QR on a compliant Saudi invoice holds a compact tag-length-value structure encoded as base64, where tag 1 is the seller name, 2 the VAT registration number, 3 the timestamp, 4 the total including VAT and 5 the VAT amount. Phase 2 documents add four more: a hash of the invoice XML, the digital signature, the public key and the certificate stamp.
Does this prove the invoice is genuine?
No. The tool reads the fields and shows you what the invoice claims — who issued it, when, for how much, and how much of that is VAT. It does not verify the signature: confirming that a signature is valid and that the certificate behind it is genuine is something only ZATCA can do authoritatively, and any tool claiming otherwise is overstating what it knows. If the decoded figures disagree with the printed invoice in your hand, that is worth asking about.
How can I tell whether an invoice was issued under Phase 1 or Phase 2?
By which tags are present. A payload carrying only the first five fields is the Phase 1 shape; the presence of tags 6 to 9 — the XML hash, signature, public key and certificate stamp — tells you the document was produced under Phase 2. The decoder shows which of them it found.
Why does it say my payload will not decode, or ends mid-field?
Two different problems. If it does not decode as a ZATCA payload at all, the usual cause is that the text came from a link the reader followed rather than from the QR itself, or that only part of the string was copied — it should look like random letters and digits. If it decodes but ends mid-field, the scan was cut short or the text was truncated when it was copied, so re-scan and paste the whole string.