ZATCA QR code generator

A simplified tax invoice in Saudi Arabia, the receipt a consumer takes away, has to carry a QR code. In Phase 1 of e-invoicing that code holds five plain values about the invoice and nothing else. This generator builds that code from the five values you type, gives you the picture to print and the text behind it, and checks the numbers on the way.

It is useful in three situations: a business that issues invoices from a template or a simple till and needs a correct code to go with each one, a developer checking that their own system's code matches the specification, and an accountant who wants to see what a correct code for a given invoice looks like before comparing it with one received.

The five values

• Seller name, as it appears on the invoice. Arabic names are kept exactly, because the values are stored as UTF-8 text.
• The seller's VAT registration number, 15 digits.
• The date and time of the invoice.
• The invoice total including VAT.
• The VAT total.

The five fields, their order and their encoding come from ZATCA's guide to compliant QR codes. ZATCA, Guide to Developed FATOORA Compliant QR Code

How the code is built

1. Each value is written as Tag-Length-Value: one byte for its tag number (1 to 5), one byte for the length of the value in bytes, then the value itself as UTF-8 text.
2. The five sets are joined end to end in tag order, with nothing between them.
3. The joined bytes are encoded as Base64. That line of text is what the QR code holds.
4. The text is drawn as a QR code. A phone camera reads it back as the same line of Base64.

Because each length is a single byte, no value can be longer than 255 bytes. Arabic letters take two bytes each in UTF-8, so a very long Arabic name can hit that limit; the generator tells you rather than cutting the name short, because a code that scans but carries half a name is worse than no code.

Getting the values right

• Write amounts as plain decimals with two places and no thousands separators, the way ZATCA's examples do: 1150.00, not 1,150. The generator does this for you, and accepts Arabic-Indic digits as input.
• The total is the amount the customer pays, VAT included. The VAT total is the VAT inside it. If you only know the total, the button under the VAT field works out 15 per cent VAT from it: total times 15, divided by 115.
• The timestamp follows ZATCA's examples, ISO 8601 ending in Z. The generator writes the date and time you type in that form; use the same time that is printed on the invoice.
• The seller name and VAT number must match what is printed on the invoice. A code that disagrees with its own invoice is the most common fault a reader will catch.

Two soft checks run as you type. One looks at the VAT number: Saudi VAT numbers are 15 digits that start and end with 3. The other divides the VAT by the amount before VAT; anything other than 15 per cent or zero is worth a second look, because it usually means the total was typed without VAT or the two fields were swapped.

Phase 1 and Phase 2

Phase 1 is the generation phase: invoices are issued electronically and simplified invoices carry the five-value code. Phase 2 is the integration phase: the business's invoicing system is connected to ZATCA's Fatoora platform, and the QR code on a simplified invoice gains four more values, an invoice hash, a digital signature, a public key and a certificate signature. Those can only be produced by a system that holds the business's cryptographic stamp, so no standalone generator, this one included, can make a Phase 2 code.

ZATCA moves businesses to Phase 2 in waves and notifies each business it selects. On 24 July 2026 it announced the twenty-fifth wave: businesses whose revenue subject to VAT was above SAR 187,500 in any one of 2022, 2023, 2024 or 2025 must integrate by 1 February 2027. That threshold reaches far down into small businesses, so if you have received a notification, your invoices need the code your integrated system produces from the date it gives.

The twenty-fifth wave, its revenue threshold, the years it looks at and its 1 February 2027 date are in ZATCA's announcement. ZATCA, twenty-fifth wave of the integration phase

The code is built in your browser. The values you type, the picture and the text never leave your device, and nothing is stored once you close the page.