E-Invoice QR Code Verifier (India): Check the IRN Signature
Is this e-invoice really registered? The IRP’s signature tells — checked on your device.
The signed QR code
Hold the QR code flat, filling most of the frame, in good light. The large QR code near the IRN is the signed one. The camera picture stays on this device.
Result
Signature check
—
What the IRP signed
Compare with the printed invoice
Type what the paper or PDF says — the comparison updates as you type. A genuine QR code copied onto another invoice shows up here.
Other QR codes in this file
Each signed QR code is checked on its own.
A valid signature proves the IRP registered these details. It cannot show whether the IRN was cancelled afterwards (an IRN can be cancelled within 24 hours of its generation): for that, search the IRN on the e-invoice portal.
Use another public key for an IRP or period not bundled here
Download the key from the IRP’s public keys page — a .pem public key, a .cer certificate, or the .zip that holds them — and choose it here. It is used on this page only and never uploaded.
The keys bundled with this tool 20 keys of 7 systems
Each Invoice Registration Portal signs with one key per period. These are the keys the IRPs publish, checked against NIC’s own sample QR codes.
| IRP | IRNs generated | Published on |
|---|---|---|
| NIC IRP-1 (einvoice1.gst.gov.in) | 05/08/2020 – 11/09/2020 | einvoice1.gst.gov.in |
| 11/09/2020 – 28/09/2020 | einvoice1.gst.gov.in | |
| 28/09/2020 – 16/09/2022 | einvoice1.gst.gov.in | |
| 28/09/2020 – 16/09/2022 | einvoice.gst.gov.in | |
| 16/09/2022 – 06/09/2024 | einvoice1.gst.gov.in | |
| 06/09/2024 – 03/06/2026 | einvoice1.gst.gov.in | |
| 03/06/2026 – 01/05/2027 | einvoice1.gst.gov.in | |
| NIC IRP-2 (einvoice2.gst.gov.in) | 01/04/2023 – 04/09/2024 | einvoice1.gst.gov.in |
| 05/09/2024 – 03/06/2026 | einvoice1.gst.gov.in | |
| 03/06/2026 – 01/05/2027 | einvoice1.gst.gov.in | |
| Cygnet IRP (einvoice3.gst.gov.in) | 30/09/2022 – 30/09/2024 | einvoice.gst.gov.in |
| 30/09/2024 – 20/06/2026 | einvoice.gst.gov.in | |
| 20/06/2026 – 01/05/2027 | einvoice3.gst.gov.in | |
| Clear IRP (einvoice4.gst.gov.in) | 13/01/2023 – 30/09/2024 | einvoice.gst.gov.in |
| 20/06/2024 – 20/06/2026 | einvoice.gst.gov.in | |
| EY IRP (einvoice5.gst.gov.in) | 01/03/2023 – 12/09/2024 | einvoice.gst.gov.in |
| 12/09/2024 – 20/06/2026 | einvoice.gst.gov.in | |
| IRIS IRP (einvoice6.gst.gov.in) | 25/11/2022 – 20/11/2024 | einvoice.gst.gov.in |
| 20/06/2024 – 20/06/2026 | einvoice.gst.gov.in | |
| NIC e-invoice sandbox (test system) | 18/09/2020 – onwards | einvoice1.gst.gov.in |
Tax rules and rates change. This calculator follows the rules described on this page and may not cover every situation. Check the official source or a qualified tax professional before filing or invoicing.
About the E-Invoice QR Code Verifier (India): Check the IRN Signature
A B2B e-invoice carries a QR code that the Invoice Registration Portal (IRP) signs when it registers the invoice: the supplier and recipient GSTINs, the document number, type and date, the invoice value, the number of items, the main HSN code, the IRN and its date, with the IRP’s digital signature over all of them. If anyone changes a single character, the signature fails.
Scan that QR code with your camera, drop the invoice PDF or a photo, or paste the signed text, and this page checks the RS256 signature with the public keys the IRPs publish for each period — NIC’s IRP-1 and IRP-2 and the Cygnet, Clear, EY and IRIS IRPs, bundled with the tool — recomputes the IRN from the signed details, and compares them with what is printed on the invoice. You get one of: verified, invalid signature, no bundled key for that IRP or period, data mismatch with the printed invoice, a test e-invoice from the IRP’s sandbox, or a QR code that is not an e-invoice QR at all. No login and no OTP, and nothing is uploaded: it works on your device, even offline once the page has loaded.
How to use it
- Choose PDF or photo and drop the e-invoice PDF, a photo or a screenshot — or choose Camera and point it at the large QR code near the IRN, or Paste the text of the signed QR code (or the IRP’s response JSON).
- Read the result: the signature check with the IRP and key that signed it, and the signed details — GSTINs, document, value, items, main HSN, IRN and IRN date.
- Under Compare with the printed invoice, check the GSTINs, number, date and value against the paper. From a PDF they are filled in from its text; a genuine QR code copied onto another invoice shows up as a data mismatch.
- For an IRP or period whose key is not bundled, choose the key file from that IRP’s public keys page under Use another public key.
- Copy the result or download it as JSON for your purchase file.
Examples
The signed QR code printed in NIC’s “Signed QR Code in E-invoicing system”
Verified — signed by NIC IRP-1 with its key for IRNs generated from 06/09/2024 to 03/06/2026 Invoice Test-00df1 of 14/07/2025, value ₹2.00, 1 item, main HSN 010190 The IRN matches SHA-256 of the GSTIN, 2025-26, INV and the number
Same QR code with TotInvVal 2 changed to 200000
Invalid signature — the QR code names NIC IRP-1’s key, but the signature no longer matches its contents
Signed number Test-00df1, printed number Test-00df2
Data mismatch — the QR code is genuine, but the document number on the invoice differs from the signed one
upi://pay?pa=shop@okbank…
Not an e-invoice QR — a UPI payment code carries no IRP signature
Common uses
- Checking a large purchase invoice before claiming its input tax credit.
- A tax auditor or CA testing supplier invoices for genuineness.
- Spotting an e-invoice QR code pasted onto a different or edited invoice.
- Reading what an e-invoice QR code holds without an app or a login.
How the check works
The signed QR code is a JSON Web Token in three parts: a header that names the algorithm (RS256) and the IRP’s signing certificate (kid, x5t), the signed details, and the signature. The page checks the signature over the first two parts with each IRP public key it holds, the key the header names first; a match proves the details were signed by that key’s holder and not changed since.
It then recomputes the IRN: the IRP FAQs say it is a hash of the supplier GSTIN, the year, the document type and the document number, and NIC’s own sample QR codes are SHA-256 of the GSTIN, the financial year (for example 2025-26), the type and the number in capitals — exactly what the page computes. Supplier and recipient GSTINs get their check-character test too.
What each result means
- Verified — signed by an IRP with the key it publishes, and nothing in the QR code has been changed.
- Invalid signature — the QR code names a published IRP key, but the signature does not match: it was altered after signing, or not made by the IRP.
- No bundled key — no key held here verifies it. It may be signed with a key this tool does not have yet (load that IRP’s key), or not by an IRP at all. Check it on the IRP portal before relying on it.
- Data mismatch — the QR code is genuine, but the printed GSTIN, number, date or value differs from what was signed.
- Test e-invoice — signed by NIC’s sandbox, the developers’ test system: not a real e-invoice.
- Not an e-invoice QR — a payment, link or text QR code, which no IRP signs.
Where the keys come from
Each IRP signs with one key per period and publishes it. The keys bundled here are the files listed on NIC’s public keys page for IRP-1, IRP-2 and the sandbox, the keys GSTN lists for every IRP on its e-invoice portal for the Cygnet, Clear, EY and IRIS IRPs, and the newer key Cygnet publishes on its own IRP portal. Both of NIC’s sample QR codes verify with them. When an IRP publishes a new key, it is added to the tool; until then, Use another public key takes the file from that IRP’s page. The table The keys bundled with this tool on this page lists every key and the IRN generation period it covers.
Sources
- NIC, Signed QR Code in E-invoicing system: what the QR code holds and how it is verified
- NIC, e-invoice FAQs: the IRN, signed QR codes, and cancellation within 24 hours
- NIC, QR code verification app and Verify Signed Invoice: the official checks
- CGST Rules, rule 48(4) and the e-invoice notifications, on CBIC’s tax information portal
Limitations
- It cannot tell whether the IRN was cancelled after it was generated — that needs the IRP portal (search by IRN).
- A verified QR code proves the IRP registered the invoice; it does not prove that the supply took place, that the supplier filed GSTR-1, or that the credit is eligible.
- Only the keys the IRPs have published are bundled; a QR code signed with a newer key shows “no bundled key” until that key is added or you load it.
- Very small, blurred or damaged QR codes may not be readable; the large signed QR code needs a sharp picture. Scanned PDFs are searched like photos.
- For information only, not tax advice.
Privacy
Your invoice, photo or QR text is read in this browser and never uploaded or stored. The camera picture stays on this device, and a key file you load is used on this page only.
Frequently asked questions
How do I verify an e-invoice QR code?
Scan the QR code with the camera, drop the invoice PDF or a photo, or paste the signed QR text. The page checks the IRP’s signature with the published public keys, shows the signed details and compares them with the printed invoice — no login or OTP needed.
Can it tell if an IRN was cancelled?
No. The QR code is signed once, when the IRN is generated, and an IRN can be cancelled within 24 hours of that. Only the IRP portal knows about a cancellation: search the IRN there for a large invoice.
Why does it say “no bundled key”?
None of the keys held by the tool verifies the signature. The QR code may be signed with a key published after the tool was updated: download that IRP’s key from its public keys page and choose it under “Use another public key”. If the QR code was not made by an IRP, no published key will ever verify it.
Is a B2C invoice’s QR code an e-invoice QR code?
No. Invoices to consumers may carry a dynamic QR code for payment (UPI). It is not signed by an IRP, so there is no signature to verify; the page says so.
Is my invoice uploaded anywhere?
No. The QR code is read, the signature checked and the IRN recomputed in your browser. The tool works offline once the page has loaded.