How the ZATCA QR code scanner works
It reads the QR printed on the invoice and splits it into its fields: seller name, VAT number, issue time, total and VAT, plus the invoice hash and digital signature when they are present.
If you upload a PDF, it looks inside for the embedded electronic invoice file. When a tax invoice is shared as a PDF, ZATCA requires the PDF/A-3 format with the electronic invoice file embedded. You can also upload the XML file directly if you have it.
With that file, the checker recomputes the invoice hash from its content, compares it with the signed hash, and confirms that the printed QR and the visible amounts match the file.
The result comes as two separate cards: invoice authenticity, and the seller's VAT registration.
Why a QR code on its own proves nothing
The signature in the QR covers the invoice hash, not the readable text in the QR. Anyone can copy the hash, signature and key fields from a genuine invoice, change the seller or the total in the first fields, and the signature still checks out.
In a test on a genuine cleared invoice, the QR total was raised by ten thousand while the signature fields were kept, and the signature still verified. What exposed the change was comparing the QR with the electronic invoice file, whose hash no longer matched the new amount.
That is why the checker gives no verdict on an invoice from its QR code alone. It shows the data stored in the QR so you can compare it with the invoice in front of you; proof comes from the original PDF or ZATCA's app.
XML and PDF/A-3: where is the e-invoice?
ZATCA defines an e-invoice as a tax invoice generated in a structured electronic format through electronic means. A paper invoice turned into a file by copying or scanning is not an e-invoice.
In Phase 2 the structured format is the XML file: it is the file that is signed, hashed, and cleared by or reported to ZATCA. PDF/A-3 is an archival PDF format that can carry embedded files, so one file holds both a page people can read and the XML itself.
ZATCA requires tax invoices to be shared with the customer as XML, or as PDF/A-3 with the XML embedded. That is why the original PDF gives the most complete result in this checker, while a photo or scan of an invoice carries only its QR code.
| File | What can be checked |
|---|---|
| PDF/A-3 with the XML embedded | The signature, the invoice hash, and that the printed QR and visible amounts match the file |
| XML file | The signature, the invoice hash, and that the QR data matches the file |
| PDF without an embedded XML | The QR code data only |
| Photo or scan of the invoice | The QR code data only |
What is inside a ZATCA invoice QR code
| Tag | Content | Appears on |
|---|---|---|
| 1 | Seller name | All invoices |
| 2 | Seller VAT number (15 digits, starting and ending with 3) | All invoices |
| 3 | Issue date and time | All invoices |
| 4 | Invoice total including VAT | All invoices |
| 5 | VAT total | All invoices |
| 6 | Invoice hash (SHA-256) | Phase 2 |
| 7 | Digital signature over the hash | Phase 2 |
| 8 | Public key of the signer | Phase 2 |
| 9 | ZATCA's signature on the seller's device certificate | Simplified invoices only |
The number of tags tells you the invoice type: 5 tags is a Phase 1 invoice with no signature, 8 tags is a tax invoice ZATCA stamped at clearance, and 9 tags is a simplified invoice signed by the seller's device with a ZATCA-issued certificate.
What each result means
- Cleared by ZATCA
- A tax invoice stamped with ZATCA's known key. The hash recomputed from the file matches the stamp, and the QR data matches the file.
- Signed by a ZATCA-registered device
- A simplified invoice signed by a device whose certificate ZATCA issued for the same VAT number, with content unchanged since signing.
- Device signature sound, certificate issuer not confirmed
- A simplified invoice whose file was uploaded: a device whose certificate carries the seller's VAT number signed it, its content is unchanged and the printed QR matches the file, but the certificate issuer is not one the checker knows. The final confirmation is ZATCA's app.
- QR code read
- The checker shows the data stored in the QR code so you can compare it with the invoice in front of you. A QR alone can be copied, so it does not prove the invoice comes from the seller.
- Phase 1 only
- A 5-tag QR with no digital signature, so the invoice's origin cannot be proven.
- Cannot verify
- The invoice could be neither proven nor disproven, for example an unknown stamp key. This does not mean the invoice is fake.
- Problems found
- A specific conflict was found, such as a printed QR that differs from the invoice file, a PDF amount that differs from the file, or a certificate that belongs to someone else.
The second card covers the seller's VAT number. A sound signature does not mean the seller is VAT-registered, so registration is shown separately and stays "Not checked" until you confirm it with an official source.
How to confirm the seller's VAT registration
Copy the VAT number from the check result.
Open the taxpayer lookup on ZATCA's website, paste the number and complete the lookup steps.
Read the registration status and business name, and compare them with the invoice.
Official check in the ZATCA app
The checker explains what the QR and the invoice file prove technically. The final word is ZATCA's own "Verify the validity of the e-invoice" service in its official app.
Download the ZATCA app from the App Store or Google Play.
Open Zakat, Tax and Customs services and choose Verify the validity of the e-invoice.
Scan the QR printed on the invoice and compare the result with the invoice.
Frequently asked questions
Is the ZATCA QR code scanner free?
Yes, free with no account needed. Your mobile number is requested before the result. On a phone you scan the invoice QR code with the camera; on a computer you upload a photo of the code, the invoice PDF or its XML.
Is scanning the QR code enough to trust an invoice?
No. The signature fields in a QR can be copied from a genuine invoice while the seller or amount is changed, and the signature still verifies. So the checker shows the QR data for you to compare with the invoice in front of you; proof needs the electronic invoice file, usually embedded in the PDF the seller sends, or ZATCA's app.
What is the difference between the XML and the PDF/A-3 of an e-invoice?
The XML is the e-invoice itself, in the structured format that is signed and cleared by or reported to ZATCA. PDF/A-3 is a readable copy that can carry the XML inside it, and ZATCA requires tax invoices to be shared in either form: XML, or PDF/A-3 with the XML embedded.
What is the difference between "Cleared by ZATCA" and "Signed by a ZATCA-registered device"?
Tax invoices between businesses are stamped by ZATCA itself at clearance, so the checker verifies ZATCA's stamp. Simplified invoices are signed by the seller's device with a ZATCA-issued certificate, so the checker verifies the issuer's signature on that certificate and that it belongs to the same VAT number. If the issuer is not one the checker knows, the result is "Device signature sound, certificate issuer not confirmed".
Does this replace the official ZATCA app?
No. The checker explains what the QR and the file prove technically, and ZATCA's official app is the final word. For full certainty, open the ZATCA app, choose Verify the validity of the e-invoice, and scan the QR.
Why doesn't the checker say an invoice is "valid"?
Because a check proves specific things only: who signed the invoice, that its content is unchanged, and that its numbers are consistent. It does not prove delivery, payment or VAT registration, so the checker shows what was proven and what was not instead of one verdict.
Does the checker confirm the seller's VAT registration?
Not automatically. The checker shows the VAT number with a copy button and a link to ZATCA's official taxpayer lookup, where you complete the lookup yourself.
Where do I get a PDF that contains the electronic invoice file?
Ask the seller for the original PDF exactly as their invoicing system produced it, not a scan or a printout. Many systems embed the invoice file automatically, and the checker finds it whatever it is named.
Why does the checker ask for my mobile number?
The number is requested before the result so the Haseem team can contact you about e-invoicing, with your consent. Only the number and the tool name are sent; nothing from your invoice goes with it.
Are my invoices stored?
No. Reading the QR and checking the signature and the invoice file all happen inside your browser. Your file is not uploaded to any server and not stored. Only your mobile number is sent.
What does "Cannot verify" mean?
The invoice could be neither proven nor disproven, for example when it is stamped with a key the checker does not know. It does not mean the invoice is fake.
Why might a genuine invoice show "Problems found"?
The cause may be an error in the seller's system, a PDF edited after it was issued, or a QR printed from another invoice. Open the technical details to see which check failed, and ask the seller for a fresh copy.