Standards/spain-verifactu-qr
Spain VeriFactu QR
Overview
The VERI*FACTU QR code, officially the código «QR» tributario, is the QR Code that Spain requires on invoices and tickets issued with billing software. Its payload is a plain URL QR pointing at a checking service of the Agencia Tributaria (AEAT), with four parameters: the issuer's NIF, the invoice series and number, the issue date and the total 3 5.
The legal basis is the Reglamento de sistemas informáticos de facturación (RRSIF), approved by Real Decreto 1007/2023, and its technical order, Orden HAC/1177/2024 2 3. It is a tax code, not a payment code: it pays nothing Spain report.
Dates as of 30 October 2026. The dates in force are before 1 January 2027 for corporate income tax payers and before 1 July 2027 for other businesses and the self-employed 2 4. The Ministry of Finance announced on 5 October 2026 that it plans to move the pending obligations to October 2028, but that is a forecast, not a law: see Status 1.
History
- July 2021. Ley 11/2021, the anti-fraud act, added article 29.2.j to the Ley General Tributaria, which requires billing software to guarantee the integrity, traceability and inalterability of records. It also set the article 201 bis infringement 2.
- December 2023. Real Decreto 1007/2023 (BOE 6 December) approved the RRSIF. It also added article 6.5 to the invoicing regulation (Real Decreto 1619/2012), which requires the QR, and article 7.5, which extends it to simplified invoices. The original deadline was before 1 July 2025 2.
- March to October 2024. The AEAT's QR document started as version 0.1.0 on 5 March 2024, before the order existed 5. Orden HAC/1177/2024 is dated 17 October, was published on 28 October and took effect on 29 October 2024 3.
- April 2025. The AEAT's services, including QR checking, went into production on 23 April 2025 13. Real Decreto 254/2025 (BOE 2 April) moved the deadlines to 1 January 2026 for corporate tax payers and 1 July 2026 for everyone else 10.
- July 2025. Software producers' nine-month period ended on 29 July 2025. From then on they had to supply only adapted systems, apart from existing maintenance contracts 13.
- December 2025. Real Decreto-ley 15/2025 (BOE 3 December, in force 4 December) moved the deadlines to the current dates 4.
- October 2026. The Ministry's note announced the planned move to October 2028 1.
Technical specification
The rules come from three layers: articles 20 and 21 of the order, then AEAT's technical document, version 0.5.0 of 10 December 2025 3 5.
Symbol
| Property | Rule |
|---|---|
| Symbology | QR Code under ISO/IEC 18004 3 |
| Size | Between 30 × 30 mm and 40 × 40 mm 3 6 |
| Error correction | Level M 3 |
| Quiet zone | At least 2 mm of blank space on all four sides; 6 mm recommended 5 |
| Contrast | High enough to guarantee legibility 5 |
Placement and captions
- The code goes at the start of the invoice, before the content the billing system generates, unless an obstacle is justified. It must then still stand out clearly 5.
- It should be the first QR on the invoice, and on a multi-page invoice it appears once, on the first page 5.
- In portrait layout it sits at the top, preferably centred, otherwise top left. In landscape it sits on the left, preferably near the top-left corner 5.
- The caption «QR tributario:» must always sit above the code 5.
- Invoices from systems that report to the AEAT also carry, just below the code, either «Factura verificable en la sede electrónica de la AEAT» or «VERI*FACTU» 3 5.
- AEAT's annex shows layouts for narrow formats, including 40 × 40 mm codes on paper 57 mm and 44 mm wide 5.
URL
The base URL depends on the system's mode and on the environment 5:
| Mode | Environment | Base URL |
|---|---|---|
| Verifiable (VERI*FACTU) | Production | https://www2.agenciatributaria.gob.es/wlpl/TIKE-CONT/ValidarQR |
| Not verifiable | Production | https://www2.agenciatributaria.gob.es/wlpl/TIKE-CONT/ValidarQRNoVerifactu |
| Verifiable | External test portal | https://prewww2.aeat.es/wlpl/TIKE-CONT/ValidarQR |
| Not verifiable | External test portal | https://prewww2.aeat.es/wlpl/TIKE-CONT/ValidarQRNoVerifactu |
The code's URL must carry "únicamente" these four parameters 5:
| Parameter | Content | Format | Length |
|---|---|---|---|
nif |
Issuer's NIF | NIF format | 9 |
numserie |
Invoice series plus number | Text, ASCII 32 to 126 | Up to 60 |
fecha |
Issue date | DD-MM-AAAA, hyphens |
10 |
importe |
Invoice total | Decimal point, not a comma | Up to 12 integer and 2 decimal digits |
Parameter values must be URL-encoded as UTF-8, and text may only use the printable ASCII codes 32 to 126 5. AEAT's own sample uses a series containing &, which must become %26; the unencoded form is its example of a wrong URL 5.
AEAT's published sample (test values from the specification) 5:
https://www2.agenciatributaria.gob.es/wlpl/TIKE-CONT/ValidarQR?nif=89890001K&numserie=12345678-G33&fecha=01-09-2024&importe=241.4
The service also accepts two optional parameters. idioma sets the language of the result (gl, ca, eu, es, va, en; Spanish by default), and formato=json asks for a machine-readable answer. AEAT states that formato must never appear in the URL inside the QR 5.
What the code does not contain
There is no hash, signature or checksum in the URL: the specification allows only the four fields above 5. The tamper-evidence sits in the billing records behind the invoice:
- Each record carries a SHA-256 hash, written as 64 uppercase hexadecimal characters 12.
- For a new invoice record the input is
name=valuepairs joined with&, in UTF-8: issuer ID, series and number, issue date, invoice type, total tax, total amount, the previous record's hash, and the generation timestamp 12. - Including the previous hash chains the records together 12 13.
- In NO VERI*FACTU mode the security elements also include a signature on each record 13.
Symbol size in practice
Computed with segno 1.6.6 at level M with no error-level boost:
| Payload | Characters | Version | Modules | Module size at 30 mm |
|---|---|---|---|---|
| AEAT's production sample above | 129 | 8 | 49 × 49 | 0.61 mm |
60-character plain series, longest importe |
187 | 10 | 57 × 57 | 0.53 mm |
60 characters that all need %XX encoding, longest importe |
307 | 13 | 69 × 69 | 0.43 mm |
Checking a code
A recipient can scan with any device with a camera. AEAT advises its app, though it is not required, because it helps ensure the QR is genuine 6. Checking does not send the invoice to the AEAT and is not a duty on the recipient: the service compares the four values with the records it holds 6.
| Result | JSON resultado |
Meaning |
|---|---|---|
| Encontrada | 00 |
The AEAT holds a matching invoice 5 |
| No encontrada | 01 |
No match, or the invoice was cancelled. A technical delay in reporting is possible, so AEAT suggests retrying later 5 |
| No contrastable | 02 |
The invoice came from a system that does not report, so nothing can be compared 5 |
Validation errors are numbered: 1001 to 1004 for a missing parameter, 2001 to 2006 for a bad format or length, 3001 for a technical fault and 3002 for too many attempts in a day 5.
Discrepancies between sources
- ISO edition. The consolidated order in the BOE cites ISO/IEC 18004 with no year 3, while AEAT's document quotes the same article as ISO/IEC 18004:2015 5.
- Result label. The specification's screenshots and JSON say "No contrastable" 5; the FAQ says "Factura no verificable" 6.
- Caption size. The order asks for text similar to the invoice's other data 3; AEAT's document asks for equal or larger 5.
Use cases
- Consumer tickets. Simplified invoices carry the same content as full ones, and AEAT's leaflet says the code goes on "factura y ticket" 2 11. Customers can check tickets as well as invoices when the issuer uses VERI*FACTU 11.
- Business invoices. A buyer can confirm that a supplier's invoice reached the AEAT. Under the RRSIF, the recipient may also send the QR data voluntarily through the AEAT's channel 2 6.
- Structured e-invoices. An e-invoice needs no QR image; it carries the same URL in its own field 3 6. The public e-invoicing solution regulated by Orden HAC/1028/2026 has a QR group whose fields hold «VERIFACTU» or «TICKETBAI» and the URL 15.
- Accounts-payable automation.
formato=jsonlets a receiving system check an incoming e-invoice's URL by machine 5. - Point-of-sale systems. AEAT's developer FAQ works through till and back-office setups. The record must exist when the code is generated and the ticket is handed over, or at the same moment 13.
Implementations
No library below is official. The AEAT offers a free VERI*FACTU application for small businesses and the self-employed 8 11.
- mdiago/VeriFactu: C# / .NET, 338 stars, commits into late October 2026. Sends records to the AEAT and returns the QR image 19.
- invopop/gobl.es.verifactu: Go, 15 stars, last commit 8 October 2026. Converts GOBL invoices and sends them. Its file list includes
qr_code.go, and a recent merge uses the non-verifiable service in its QR codes 20. - josemmo/Verifactu-PHP: PHP, 112 stars, last commit 22 February 2026. Generates and sends records; its README does not mention the QR 21.
- zxing/zxing: Java, about 34,200 stars, commits in October 2026. A general decoder that reads the symbol; the fields are then ordinary URL parameters 22.
Comparison
Spain has two neighbouring regimes. Taxpayers with a tax domicile in the Basque Country or Navarra fall under their foral rules, and AEAT describes the Basque TicketBAI QR as similar in content 7.
| VERI*FACTU QR | TicketBAI QR (Álava annex) | |
|---|---|---|
| Size and error level | 30 to 40 mm, level M 3 | 30 to 40 mm, level M 16 |
| Payload | AEAT URL with four fields 5 | Foral URL with id, s, nf, i, cr 16 |
| Issuer identity | NIF in the clear 5 | NIF inside a 39-character TicketBAI code 16 |
| Link to a signature | None in the URL 5 | First 13 characters of the signature inside the code 16 |
| Error detection | None in the URL 5 | CRC-8 on the code and on the URL 16 |
| Position, portrait | Top 5 | Very bottom 16 |
A TicketBAI code therefore embeds a fragment of the signature and a checksum that software can test offline. A VERI*FACTU code has neither, so its only check is the AEAT lookup. The VERI*FACTU mode itself is also a choice inside the regime: a system can report every record to the AEAT, or keep the records and send them when required. Both print a QR, but only the first gets a verifiable answer 11 18.
Fun facts
- Version 0.5.0 of AEAT's specification, dated more than a year after the order was published, still calls it "Orden XXXXXXX" in its introduction 5.
- Real Decreto-ley 15/2025 is mostly about local and regional budget surpluses. Its preamble and its rank-safeguard clause refer to "artículo 3" for the VERI*FACTU change, but the decree has two articles and the change is in its first final provision 4.
Status
Active standard, not yet generally mandatory. The technical specification is published and the AEAT's services have been in production since April 2025 5 13.
In force on 30 October 2026 2 4 9:
- Corporate income tax payers: adapted systems before 1 January 2027.
- All other taxpayers in scope: operational systems before 1 July 2027.
These replaced 1 January 2026 and 1 July 2026, which had replaced the original 1 July 2025 10. The AEAT's note, updated 13 October 2026, still gives the 2027 dates 9.
Announced, not enacted. The Ministry of Finance's press note of 5 October 2026 forecasts postponing the pending obligations of Real Decreto 1007/2023 "hasta octubre de 2028". The aim is to match the e-invoicing obligation for businesses with annual turnover up to €8 million. A later change would align scope and technical aspects with the EU's ViDA reporting rules 1. The note gives no day and names no legal instrument 1. The BOE's consolidated text, read on 30 October 2026, still lists Real Decreto-ley 15/2025 as the last change 2. The AEAT's main page links the note as a forecast 8.
A third-party source, the tax publisher Supercontable (9 October 2026), says the change would need a new real decreto or real decreto-ley, and that the general election called for 29 November adds uncertainty 17. We found no official text confirming how the change will be made.
Who is in scope. A business that uses billing software falls under the RRSIF unless one of these applies 7 2:
- It invoices only by hand.
- It is in the SII, the immediate VAT reporting system. SII and the RRSIF exclude each other, and a business joining SII should stop including the QR.
- Its tax domicile is in the Basque Country or Navarra, under foral rules.
- It holds a current exemption resolution, or is excluded by article 3 of the RRSIF.
Producers and sellers of software are also covered 7. Holding a non-certified or altered system carries a fixed fine of €50,000 per tax year, and producers face €150,000 per year of sales and per type of system 14. The QR applies in both modes, whichever the taxpayer chooses 6 11.
Sources
1 Previsión de modificación de los plazos de aplicación (nota informativa) — Ministerio de Hacienda, press office, 5 October 2026 2 Real Decreto 1007/2023, de 5 de diciembre, consolidated text — BOE, accessed 30 October 2026 3 Orden HAC/1177/2024, de 17 de octubre — BOE, 2024 4 Real Decreto-ley 15/2025, de 2 de diciembre — BOE no. 290, 3 December 2025 5 Detalle de las especificaciones técnicas del código «QR» de la factura y de la «URL» del servicio de cotejo, v0.5.0 — AEAT, 10 December 2025 6 FAQ: posibilidad de remisión de información de la factura por parte del receptor — AEAT, updated 21 October 2026 7 FAQ: cuestiones generales, ámbitos de aplicación — AEAT, updated 21 October 2026 8 Sistemas Informáticos de Facturación (SIF) y VERI*FACTU — AEAT, updated 13 October 2026 9 Nota informativa sobre la ampliación del plazo de adaptación — AEAT, updated 13 October 2026 10 Modificación del Reglamento que regula los sistemas informáticos de facturación — AEAT, 2 April 2025 11 VERI*FACTU: adapte su sistema informático de facturación (leaflet) — AEAT, 5 December 2025 (PDF creation date) 12 Detalle de las especificaciones técnicas para generación de la huella o hash de los registros de facturación, v0.1.2 — AEAT, 27 August 2024 13 Preguntas frecuentes de empresas de desarrollo — AEAT, 4 December 2025 14 Ley 58/2003, General Tributaria, consolidated text, article 201 bis — BOE, accessed 30 October 2026 15 Orden HAC/1028/2026, de 2 de octubre, solución pública de facturación electrónica — BOE no. 247, 5 October 2026 16 Especificaciones del código TicketBAI y del código QR (annex) — Diputación Foral de Álava, 14 March 2022 (PDF creation date) 17 Verifactu se aplaza a octubre de 2028, ¿estás seguro? — Supercontable (third party), 9 October 2026 18 FAQ: capacidad de remisión de los SIF — AEAT, updated 21 October 2026 19 mdiago/VeriFactu — GitHub, accessed 30 October 2026 20 invopop/gobl.es.verifactu — GitHub, accessed 30 October 2026 21 josemmo/Verifactu-PHP — GitHub, accessed 30 October 2026 22 zxing/zxing — GitHub, accessed 30 October 2026
Deployments
No country reports mention this standard by name.