# Spain VeriFactu QR > Source: https://docs.barcoder.ai/docs/standards/spain-verifactu-qr > research date 2026-10-30 · extracted at 2026-10-30 > Publisher: Barcoder — encyclopedia of QR, barcode and payment-code standards Specifications: - [AEAT: technical specifications of the invoice QR code and the checking service URL, v0.5.0 (10 December 2025)](https://www.agenciatributaria.es/static_files/AEAT_Desarrolladores/EEDD/IVA/VERI-FACTU/DetalleEspecificacTecnCodigoQRfactura.pdf) - [Orden HAC/1177/2024, de 17 de octubre (BOE)](https://www.boe.es/buscar/act.php?id=BOE-A-2024-22138) - [Real Decreto 1007/2023, de 5 de diciembre, the RRSIF (BOE, consolidated)](https://www.boe.es/buscar/act.php?id=BOE-A-2023-24840) - [AEAT: technical specifications of the billing record hash, v0.1.2 (27 August 2024)](https://www.agenciatributaria.es/static_files/AEAT_Desarrolladores/EEDD/IVA/VERI-FACTU/Veri-Factu_especificaciones_huella_hash_registros.pdf) ## Overview The **VERI\*FACTU QR code**, officially the *código «QR» tributario*, is the [QR Code](https://docs.barcoder.ai/docs/standards/qr-code) that Spain requires on invoices and tickets issued with billing software. Its payload is a plain [URL QR](https://docs.barcoder.ai/docs/standards/url-qr) pointing at a checking service of the Agencia Tributaria (AEAT), with four parameters: the issuer's NIF, the invoice series and number, the issue date and the total [3][3] [5][5]. The legal basis is the *Reglamento de sistemas informáticos de facturación* (RRSIF), approved by **Real Decreto 1007/2023**, and its technical order, **Orden HAC/1177/2024** [2][2] [3][3]. It is a tax code, not a payment code: it pays nothing [Spain report](https://docs.barcoder.ai/docs/payments/ES). **Dates as of 30 October 2026.** The dates in force are **before 1 January 2027** for corporate income tax payers and **before 1 July 2027** for other businesses and the self-employed [2][2] [4][4]. The Ministry of Finance announced on 5 October 2026 that it plans to move the pending obligations to **October 2028**, but that is a forecast, not a law: see [Status](#status) [1][1]. ## History - **July 2021.** Ley 11/2021, the anti-fraud act, added article 29.2.j to the Ley General Tributaria, which requires billing software to guarantee the integrity, traceability and inalterability of records. It also set the article 201 bis infringement [2][2]. - **December 2023.** Real Decreto 1007/2023 (BOE 6 December) approved the RRSIF. It also added article 6.5 to the invoicing regulation (Real Decreto 1619/2012), which requires the QR, and article 7.5, which extends it to simplified invoices. The original deadline was before 1 July 2025 [2][2]. - **March to October 2024.** The AEAT's QR document started as version 0.1.0 on 5 March 2024, before the order existed [5][5]. Orden HAC/1177/2024 is dated 17 October, was published on 28 October and took effect on 29 October 2024 [3][3]. - **April 2025.** The AEAT's services, including QR checking, went into production on **23 April 2025** [13][13]. Real Decreto 254/2025 (BOE 2 April) moved the deadlines to 1 January 2026 for corporate tax payers and 1 July 2026 for everyone else [10][10]. - **July 2025.** Software producers' nine-month period ended on 29 July 2025. From then on they had to supply only adapted systems, apart from existing maintenance contracts [13][13]. - **December 2025.** Real Decreto-ley 15/2025 (BOE 3 December, in force 4 December) moved the deadlines to the current dates [4][4]. - **October 2026.** The Ministry's note announced the planned move to October 2028 [1][1]. ## Technical specification The rules come from three layers: articles 20 and 21 of the order, then AEAT's technical document, version 0.5.0 of 10 December 2025 [3][3] [5][5]. ### Symbol | Property | Rule | |---|---| | Symbology | QR Code under ISO/IEC 18004 [3][3] | | Size | Between 30 × 30 mm and 40 × 40 mm [3][3] [6][6] | | Error correction | Level M [3][3] | | Quiet zone | At least 2 mm of blank space on all four sides; 6 mm recommended [5][5] | | Contrast | High enough to guarantee legibility [5][5] | ### Placement and captions - The code goes at the start of the invoice, before the content the billing system generates, unless an obstacle is justified. It must then still stand out clearly [5][5]. - It should be the first QR on the invoice, and on a multi-page invoice it appears once, on the first page [5][5]. - In portrait layout it sits at the top, preferably centred, otherwise top left. In landscape it sits on the left, preferably near the top-left corner [5][5]. - The caption **«QR tributario:»** must always sit above the code [5][5]. - Invoices from systems that report to the AEAT also carry, just below the code, either **«Factura verificable en la sede electrónica de la AEAT»** or **«VERI\*FACTU»** [3][3] [5][5]. - AEAT's annex shows layouts for narrow formats, including 40 × 40 mm codes on paper 57 mm and 44 mm wide [5][5]. ### URL The base URL depends on the system's mode and on the environment [5][5]: | Mode | Environment | Base URL | |---|---|---| | Verifiable (VERI\*FACTU) | Production | `https://www2.agenciatributaria.gob.es/wlpl/TIKE-CONT/ValidarQR` | | Not verifiable | Production | `https://www2.agenciatributaria.gob.es/wlpl/TIKE-CONT/ValidarQRNoVerifactu` | | Verifiable | External test portal | `https://prewww2.aeat.es/wlpl/TIKE-CONT/ValidarQR` | | Not verifiable | External test portal | `https://prewww2.aeat.es/wlpl/TIKE-CONT/ValidarQRNoVerifactu` | The code's URL must carry "únicamente" these four parameters [5][5]: | Parameter | Content | Format | Length | |---|---|---|---| | `nif` | Issuer's NIF | NIF format | 9 | | `numserie` | Invoice series plus number | Text, ASCII 32 to 126 | Up to 60 | | `fecha` | Issue date | `DD-MM-AAAA`, hyphens | 10 | | `importe` | Invoice total | Decimal point, not a comma | Up to 12 integer and 2 decimal digits | Parameter values must be URL-encoded as UTF-8, and text may only use the printable ASCII codes 32 to 126 [5][5]. AEAT's own sample uses a series containing `&`, which must become `%26`; the unencoded form is its example of a wrong URL [5][5]. **AEAT's published sample** (test values from the specification) [5][5]: ``` https://www2.agenciatributaria.gob.es/wlpl/TIKE-CONT/ValidarQR?nif=89890001K&numserie=12345678-G33&fecha=01-09-2024&importe=241.4 ``` The service also accepts two optional parameters. `idioma` sets the language of the result (`gl`, `ca`, `eu`, `es`, `va`, `en`; Spanish by default), and `formato=json` asks for a machine-readable answer. AEAT states that `formato` must never appear in the URL inside the QR [5][5]. ### What the code does not contain There is no hash, signature or checksum in the URL: the specification allows only the four fields above [5][5]. The tamper-evidence sits in the billing records behind the invoice: - Each record carries a **SHA-256** hash, written as 64 uppercase hexadecimal characters [12][12]. - For a new invoice record the input is `name=value` pairs joined with `&`, in UTF-8: issuer ID, series and number, issue date, invoice type, total tax, total amount, the previous record's hash, and the generation timestamp [12][12]. - Including the previous hash chains the records together [12][12] [13][13]. - In NO VERI\*FACTU mode the security elements also include a signature on each record [13][13]. ### Symbol size in practice Computed with segno 1.6.6 at level M with no error-level boost: | Payload | Characters | Version | Modules | Module size at 30 mm | |---|---|---|---|---| | AEAT's production sample above | 129 | 8 | 49 × 49 | 0.61 mm | | 60-character plain series, longest `importe` | 187 | 10 | 57 × 57 | 0.53 mm | | 60 characters that all need `%XX` encoding, longest `importe` | 307 | 13 | 69 × 69 | 0.43 mm | ### Checking a code A recipient can scan with any device with a camera. AEAT advises its app, though it is not required, because it helps ensure the QR is genuine [6][6]. Checking does not send the invoice to the AEAT and is not a duty on the recipient: the service compares the four values with the records it holds [6][6]. | Result | JSON `resultado` | Meaning | |---|---|---| | Encontrada | `00` | The AEAT holds a matching invoice [5][5] | | No encontrada | `01` | No match, or the invoice was cancelled. A technical delay in reporting is possible, so AEAT suggests retrying later [5][5] | | No contrastable | `02` | The invoice came from a system that does not report, so nothing can be compared [5][5] | Validation errors are numbered: 1001 to 1004 for a missing parameter, 2001 to 2006 for a bad format or length, 3001 for a technical fault and 3002 for too many attempts in a day [5][5]. ### Discrepancies between sources - **ISO edition.** The consolidated order in the BOE cites ISO/IEC 18004 with no year [3][3], while AEAT's document quotes the same article as ISO/IEC 18004:2015 [5][5]. - **Result label.** The specification's screenshots and JSON say "No contrastable" [5][5]; the FAQ says "Factura no verificable" [6][6]. - **Caption size.** The order asks for text similar to the invoice's other data [3][3]; AEAT's document asks for equal or larger [5][5]. ## Use cases - **Consumer tickets.** Simplified invoices carry the same content as full ones, and AEAT's leaflet says the code goes on "factura y ticket" [2][2] [11][11]. Customers can check tickets as well as invoices when the issuer uses VERI\*FACTU [11][11]. - **Business invoices.** A buyer can confirm that a supplier's invoice reached the AEAT. Under the RRSIF, the recipient may also send the QR data voluntarily through the AEAT's channel [2][2] [6][6]. - **Structured e-invoices.** An e-invoice needs no QR image; it carries the same URL in its own field [3][3] [6][6]. The public e-invoicing solution regulated by Orden HAC/1028/2026 has a QR group whose fields hold «VERIFACTU» or «TICKETBAI» and the URL [15][15]. - **Accounts-payable automation.** `formato=json` lets a receiving system check an incoming e-invoice's URL by machine [5][5]. - **Point-of-sale systems.** AEAT's developer FAQ works through till and back-office setups. The record must exist when the code is generated and the ticket is handed over, or at the same moment [13][13]. ## Implementations No library below is official. The AEAT offers a free VERI\*FACTU application for small businesses and the self-employed [8][8] [11][11]. - **[mdiago/VeriFactu](https://github.com/mdiago/VeriFactu)**: C# / .NET, 338 stars, commits into late October 2026. Sends records to the AEAT and returns the QR image [19][19]. - **[invopop/gobl.es.verifactu](https://github.com/invopop/gobl.es.verifactu)**: Go, 15 stars, last commit 8 October 2026. Converts GOBL invoices and sends them. Its file list includes `qr_code.go`, and a recent merge uses the non-verifiable service in its QR codes [20][20]. - **[josemmo/Verifactu-PHP](https://github.com/josemmo/Verifactu-PHP)**: PHP, 112 stars, last commit 22 February 2026. Generates and sends records; its README does not mention the QR [21][21]. - **[zxing/zxing](https://github.com/zxing/zxing)**: Java, about 34,200 stars, commits in October 2026. A general decoder that reads the symbol; the fields are then ordinary URL parameters [22][22]. ## Comparison Spain has two neighbouring regimes. Taxpayers with a tax domicile in the Basque Country or Navarra fall under their foral rules, and AEAT describes the Basque [TicketBAI QR](https://docs.barcoder.ai/docs/standards/ticketbai-qr) as similar in content [7][7]. | | VERI\*FACTU QR | TicketBAI QR (Álava annex) | |---|---|---| | Size and error level | 30 to 40 mm, level M [3][3] | 30 to 40 mm, level M [16][16] | | Payload | AEAT URL with four fields [5][5] | Foral URL with `id`, `s`, `nf`, `i`, `cr` [16][16] | | Issuer identity | NIF in the clear [5][5] | NIF inside a 39-character TicketBAI code [16][16] | | Link to a signature | None in the URL [5][5] | First 13 characters of the signature inside the code [16][16] | | Error detection | None in the URL [5][5] | CRC-8 on the code and on the URL [16][16] | | Position, portrait | Top [5][5] | Very bottom [16][16] | A TicketBAI code therefore embeds a fragment of the signature and a checksum that software can test offline. A VERI\*FACTU code has neither, so its only check is the AEAT lookup. The VERI\*FACTU mode itself is also a choice inside the regime: a system can report every record to the AEAT, or keep the records and send them when required. Both print a QR, but only the first gets a verifiable answer [11][11] [18][18]. ## Fun facts - Version 0.5.0 of AEAT's specification, dated more than a year after the order was published, still calls it "Orden XXXXXXX" in its introduction [5][5]. - Real Decreto-ley 15/2025 is mostly about local and regional budget surpluses. Its preamble and its rank-safeguard clause refer to "artículo 3" for the VERI\*FACTU change, but the decree has two articles and the change is in its first final provision [4][4]. ## Status **Active standard, not yet generally mandatory.** The technical specification is published and the AEAT's services have been in production since April 2025 [5][5] [13][13]. **In force on 30 October 2026** [2][2] [4][4] [9][9]: - Corporate income tax payers: adapted systems before **1 January 2027**. - All other taxpayers in scope: operational systems before **1 July 2027**. These replaced 1 January 2026 and 1 July 2026, which had replaced the original 1 July 2025 [10][10]. The AEAT's note, updated 13 October 2026, still gives the 2027 dates [9][9]. **Announced, not enacted.** The Ministry of Finance's press note of 5 October 2026 forecasts postponing the pending obligations of Real Decreto 1007/2023 "hasta octubre de 2028". The aim is to match the e-invoicing obligation for businesses with annual turnover up to €8 million. A later change would align scope and technical aspects with the EU's ViDA reporting rules [1][1]. The note gives no day and names no legal instrument [1][1]. The BOE's consolidated text, read on 30 October 2026, still lists Real Decreto-ley 15/2025 as the last change [2][2]. The AEAT's main page links the note as a forecast [8][8]. A third-party source, the tax publisher Supercontable (9 October 2026), says the change would need a new real decreto or real decreto-ley, and that the general election called for 29 November adds uncertainty [17][17]. We found no official text confirming how the change will be made. **Who is in scope.** A business that uses billing software falls under the RRSIF unless one of these applies [7][7] [2][2]: - It invoices only by hand. - It is in the SII, the immediate VAT reporting system. SII and the RRSIF exclude each other, and a business joining SII should stop including the QR. - Its tax domicile is in the Basque Country or Navarra, under foral rules. - It holds a current exemption resolution, or is excluded by article 3 of the RRSIF. Producers and sellers of software are also covered [7][7]. Holding a non-certified or altered system carries a fixed fine of €50,000 per tax year, and producers face €150,000 per year of sales and per type of system [14][14]. The QR applies in both modes, whichever the taxpayer chooses [6][6] [11][11]. ## Sources [1]: https://www.hacienda.gob.es/sgt/gabsehacienda/nota-informativa-verifactu.pdf [2]: https://www.boe.es/buscar/act.php?id=BOE-A-2023-24840 [3]: https://www.boe.es/buscar/act.php?id=BOE-A-2024-22138 [4]: https://www.boe.es/boe/dias/2025/12/03/pdfs/BOE-A-2025-24446.pdf [5]: https://www.agenciatributaria.es/static_files/AEAT_Desarrolladores/EEDD/IVA/VERI-FACTU/DetalleEspecificacTecnCodigoQRfactura.pdf [6]: https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu/preguntas-frecuentes/posibilidad-remision-informacion-factura-parte-receptor.html [7]: https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu/preguntas-frecuentes/cuestiones-generales-ambitos-aplicacion.html [8]: https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu.html [9]: https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu/nota-informativa-ampliacion-plazo-adaptacion-facturacion.html [10]: https://sede.agenciatributaria.gob.es/Sede/todas-noticias/2025/abril/2/modificacion-reglamento-que-regula-sistemas-facturacion.html [11]: https://sede.agenciatributaria.gob.es/static_files/Sede/Biblioteca/Folleto/VERIFACTU/Folleto_VERIFACTU_en_gb.pdf [12]: https://www.agenciatributaria.es/static_files/AEAT_Desarrolladores/EEDD/IVA/VERI-FACTU/Veri-Factu_especificaciones_huella_hash_registros.pdf [13]: https://www.agenciatributaria.es/static_files/AEAT_Desarrolladores/EEDD/IVA/VERI-FACTU/FAQs-Desarrolladores.pdf [14]: https://www.boe.es/eli/es/l/2003/12/17/58/con [15]: https://www.boe.es/buscar/doc.php?id=BOE-A-2026-20587 [16]: https://web.araba.eus/documents/d/araba/anexo-v-1-pdf [17]: https://www.supercontable.com/boletin/H/articulos/Verifactu_se_aplaza_octubre_2028_incertidumbre_anuncio_sin_norma_con_elecciones.html [18]: https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu/preguntas-frecuentes/caracteristicas-requisitos-sif-capacidad-remision-etc_.html [19]: https://github.com/mdiago/VeriFactu [20]: https://github.com/invopop/gobl.es.verifactu [21]: https://github.com/josemmo/Verifactu-PHP [22]: https://github.com/zxing/zxing [es-cro]: https://docs.barcoder.ai/docs/payments/ES [1] [Previsión de modificación de los plazos de aplicación (nota informativa)](https://www.hacienda.gob.es/sgt/gabsehacienda/nota-informativa-verifactu.pdf) — Ministerio de Hacienda, press office, 5 October 2026 [2] [Real Decreto 1007/2023, de 5 de diciembre, consolidated text](https://www.boe.es/buscar/act.php?id=BOE-A-2023-24840) — BOE, accessed 30 October 2026 [3] [Orden HAC/1177/2024, de 17 de octubre](https://www.boe.es/buscar/act.php?id=BOE-A-2024-22138) — BOE, 2024 [4] [Real Decreto-ley 15/2025, de 2 de diciembre](https://www.boe.es/boe/dias/2025/12/03/pdfs/BOE-A-2025-24446.pdf) — BOE no. 290, 3 December 2025 [5] [Detalle de las especificaciones técnicas del código «QR» de la factura y de la «URL» del servicio de cotejo, v0.5.0](https://www.agenciatributaria.es/static_files/AEAT_Desarrolladores/EEDD/IVA/VERI-FACTU/DetalleEspecificacTecnCodigoQRfactura.pdf) — AEAT, 10 December 2025 [6] [FAQ: posibilidad de remisión de información de la factura por parte del receptor](https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu/preguntas-frecuentes/posibilidad-remision-informacion-factura-parte-receptor.html) — AEAT, updated 21 October 2026 [7] [FAQ: cuestiones generales, ámbitos de aplicación](https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu/preguntas-frecuentes/cuestiones-generales-ambitos-aplicacion.html) — AEAT, updated 21 October 2026 [8] [Sistemas Informáticos de Facturación (SIF) y VERI\*FACTU](https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu.html) — AEAT, updated 13 October 2026 [9] [Nota informativa sobre la ampliación del plazo de adaptación](https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu/nota-informativa-ampliacion-plazo-adaptacion-facturacion.html) — AEAT, updated 13 October 2026 [10] [Modificación del Reglamento que regula los sistemas informáticos de facturación](https://sede.agenciatributaria.gob.es/Sede/todas-noticias/2025/abril/2/modificacion-reglamento-que-regula-sistemas-facturacion.html) — AEAT, 2 April 2025 [11] [VERI\*FACTU: adapte su sistema informático de facturación (leaflet)](https://sede.agenciatributaria.gob.es/static_files/Sede/Biblioteca/Folleto/VERIFACTU/Folleto_VERIFACTU_en_gb.pdf) — AEAT, 5 December 2025 (PDF creation date) [12] [Detalle de las especificaciones técnicas para generación de la huella o hash de los registros de facturación, v0.1.2](https://www.agenciatributaria.es/static_files/AEAT_Desarrolladores/EEDD/IVA/VERI-FACTU/Veri-Factu_especificaciones_huella_hash_registros.pdf) — AEAT, 27 August 2024 [13] [Preguntas frecuentes de empresas de desarrollo](https://www.agenciatributaria.es/static_files/AEAT_Desarrolladores/EEDD/IVA/VERI-FACTU/FAQs-Desarrolladores.pdf) — AEAT, 4 December 2025 [14] [Ley 58/2003, General Tributaria, consolidated text, article 201 bis](https://www.boe.es/eli/es/l/2003/12/17/58/con) — BOE, accessed 30 October 2026 [15] [Orden HAC/1028/2026, de 2 de octubre, solución pública de facturación electrónica](https://www.boe.es/buscar/doc.php?id=BOE-A-2026-20587) — BOE no. 247, 5 October 2026 [16] [Especificaciones del código TicketBAI y del código QR (annex)](https://web.araba.eus/documents/d/araba/anexo-v-1-pdf) — Diputación Foral de Álava, 14 March 2022 (PDF creation date) [17] [Verifactu se aplaza a octubre de 2028, ¿estás seguro?](https://www.supercontable.com/boletin/H/articulos/Verifactu_se_aplaza_octubre_2028_incertidumbre_anuncio_sin_norma_con_elecciones.html) — Supercontable (third party), 9 October 2026 [18] [FAQ: capacidad de remisión de los SIF](https://sede.agenciatributaria.gob.es/Sede/iva/sistemas-informaticos-facturacion-verifactu/preguntas-frecuentes/caracteristicas-requisitos-sif-capacidad-remision-etc_.html) — AEAT, updated 21 October 2026 [19] [mdiago/VeriFactu](https://github.com/mdiago/VeriFactu) — GitHub, accessed 30 October 2026 [20] [invopop/gobl.es.verifactu](https://github.com/invopop/gobl.es.verifactu) — GitHub, accessed 30 October 2026 [21] [josemmo/Verifactu-PHP](https://github.com/josemmo/Verifactu-PHP) — GitHub, accessed 30 October 2026 [22] [zxing/zxing](https://github.com/zxing/zxing) — GitHub, accessed 30 October 2026 ## Deployments _No country reports mention this standard by name._