TLV Decoder & ZATCA (Fatoora) Fiscal QR Code Inspector
Decode, inspect, and validate TLV (Tag-Length-Value) structures and ZATCA Fatoora (Phase 1 & 2) e-invoicing QR codes directly in your browser.
What is TLV and How Does the ZATCA Fiscal QR Code Work?
The TLV (Tag-Length-Value) standard is a compact binary encoding scheme where each field is represented sequentially by its numerical identifier (Tag), byte length (Length), and raw payload (Value).
The Saudi Zakat, Tax and Customs Authority (ZATCA / GAZT) adopted this standard for the Fatoora national e-invoicing mandate. In Phase 1, the QR code encodes tags 1 to 5 (seller name, VAT ID, timestamp, invoice total, and VAT amount). In Phase 2 (Integration), tags 6 to 9 are added with invoice XML SHA-256 digests and ECDSA cryptographic signatures.
Anatomy of the 9 ZATCA (Fatoora) Fiscal Tags
Regulatory specification of official Saudi e-invoice QR code tags:
| Tag | Official Field | Format | Technical Definition | Canonical Example |
|---|---|---|---|---|
| 1 | Seller's Name | UTF-8 | Name or registered company trading name of the seller. | Modern Bakery Ltd |
| 2 | VAT Number | 15 digits | Tax identifier that must start with 3 and end with 3. | 310123456700003 |
| 3 | Timestamp | ISO 8601 | Exact invoice creation timestamp in YYYY-MM-DDTHH:mm:ssZ format. | 2026-09-11T08:00:00Z |
| 4 | Invoice Total | Decimal | Total amount payable including all taxes and deductions. | 115.00 |
| 5 | VAT Total | Decimal | Total value-added tax charged on the transaction. | 15.00 |
| 6 | Invoice Hash | SHA-256 (32B) | Cryptographic SHA-256 digest computed from the invoice XML body. | 4a1b2c3d... |
| 7 | ECDSA Signature | DER (64-72B) | Digital cryptographic signature generated by the device. | 3045022100... |
| 8 | Public Key | X.509 PubKey | Public key of the device's cryptographic stamping certificate. | 3059301306... |
| 9 | Stamp Signature | Binary | Cryptographic validation stamp issued by ZATCA authority. | Digital Stamp |
Deterministic Decoding & Verification Process
The inspection engine executes linearly over raw binary buffers with zero network calls:
- 1. Binary Extraction and Tag Unpacking: The Base64 or Hex payload is converted into a binary buffer and iterated sequentially. The parser reads the 1-byte Tag and 1-byte Length, extracting values with strict buffer-overflow boundary protection.
- 2. Tax and Cryptographic Rule Verification: Decoded fields are validated against ZATCA rules: 15-digit VAT number format (starts/ends with 3), mathematical consistency between Total and VAT, and ISO 8601 timestamp compliance.