E-Invoice QR Code: What It Holds and How to Verify It

Every B2B e-invoice carries a QR code returned by the Invoice Registration Portal. It is not decoration: it is a digitally signed summary of the invoice, and anyone holding a copy can check that the invoice was genuinely registered. But the check has to be done properly. Point a phone camera at it and you learn almost nothing. This guide explains what the QR contains, how to verify it with the official tools, how to verify it in code, and the one thing even a valid QR cannot tell you.

What the e-invoice QR code is

When a supplier reports an invoice to the IRP, the portal validates it, generates the IRN, and returns two signed artefacts: the signed invoice and the signed QR code. The QR code is a JSON Web Token: a small JSON payload of key invoice details, signed with the IRP's private key. The supplier must print it on the invoice. The background is in who must e-invoice and e-way bill vs e-invoice.

What the QR code contains

Because the full invoice is not in the QR, verifying it confirms the headline facts — who, to whom, which document, how much — not every line and rate.

Why an ordinary scanner proves nothing

Scan an e-invoice QR with a phone camera and you get a long string of characters in three dot-separated parts. That is the token. A forger can produce a QR code containing a token that looks identical in form. What they cannot produce is a token whose signature checks out against the IRP's public key, because they do not have the private key. Verification means checking that signature. Reading the text is not verification.

Verifying with the official app

NIC publishes a mobile app for verifying e-invoice QR codes. It holds the IRP's public keys, scans the QR, checks the signature, and shows the decoded details with a clear valid or invalid result. Compare the details it shows — especially the GSTINs, the document number and the value — with the printed invoice. A valid signature over different details means the printed invoice has been altered.

Verifying on the e-invoice portal

The e-invoice portal also offers verification of a signed invoice: upload the signed JSON you received from the supplier, and it confirms whether it was issued by the IRP. This suits accounts teams who receive e-invoice JSON rather than printed copies. Access is described in e-invoice portal login.

Reading and verifying the QR in code

For accounts payable automation, the QR can be decoded and checked when the invoice is scanned in. Reading the payload needs nothing more than base64:

import base64, json

def read_einvoice_qr(token: str) -> dict:
    header, payload, signature = token.split('.')
    payload += '=' * (-len(payload) % 4)          # restore base64 padding
    claims = json.loads(base64.urlsafe_b64decode(payload))
    return json.loads(claims['data'])              # the invoice fields are a JSON string

fields = read_einvoice_qr(scanned_text)
print(fields['SellerGstin'], fields['DocNo'], fields['TotInvVal'], fields['Irn'])

That reads the fields; it does not verify them. To verify, check the token's RSA signature against the IRP's public signing key with any standard JWT library, rejecting the token if the check fails. Obtain the key from the IRP's official documentation, and note that each IRP signs with its own key, so a system that accepts invoices from suppliers using different IRPs needs each one. If you already call the e-invoice API, the developer portal guide covers where the keys and documentation live.

What a valid QR does not prove

A valid signature proves the invoice was registered on the IRP on the IRN date. It says nothing about what happened afterwards:

• the IRN may have been cancelled within 24 hours — check its status. See cancelling an e-invoice;
• the supplier's registration may since have been suspended or cancelled;
• the supplier may not have filed its returns or paid the tax, which is what your credit ultimately depends on.

So the QR check belongs alongside two others: the supplier's GSTIN status, and its filing record. Both are covered in vendor GST verification in accounts payable.

B2C invoices: a different QR

Consumer invoices are not e-invoices and have no IRN. Businesses above a much higher turnover limit must instead print a dynamic QR code on B2C invoices, which carries payment details such as the UPI ID and amount so the customer can pay by scanning. It is a payment convenience, not a signed proof of registration, and cannot be verified the same way. If a consumer bill makes you doubt the GST on it, see is the GST on my bill real?.

Frequently asked questions