What the code contains
ZATCA’s Security Features Implementation Standards (version 1.2, May 2023) define the code: each field is a one-byte tag, a one-byte length and the value in UTF-8, all joined and encoded in Base64, at most 700 characters. The seller’s name is often in Arabic, so decoding it by hand with a Base64 tool gives unreadable bytes; the scanner decodes the UTF-8 and shows the name as written.
Checks the page runs
- VAT number: the XML Implementation Standard’s rules require 15 digits, the first and last being 3.
- VAT rate: the VAT divided by the amount before VAT; 15% is the standard rate from 1 July 2020 under the VAT Implementing Regulations.
- Timestamp: it must be a valid ISO 8601 date and time.
- Phase: tags 6 to 9 present means a Phase 2 code with a cryptographic stamp.
When the code and the invoice disagree
A QR code that shows a different seller, total or VAT from the paper invoice is a sign of an altered or reused invoice. Ask the seller for a corrected invoice before you use it for your records or a VAT claim. For a batch of receipts, scan them one after another: the list under the results keeps every code, and Export CSV saves them all for a spreadsheet.