The QR code on a KSeF invoice — what is in it and what it proves

What the QR code on a Polish e-invoice actually contains, how the first code differs from the second, and how to spot one that leads somewhere it should not.

Published October 29, 2026

Polish invoices now carry a QR code. It is not decoration and it holds no amount to pay — it leads to an address where you can check whether that invoice really reached the national e-invoicing system, KSeF.

It is worth knowing what is inside it, because this is the code that gets swapped on fraudulent invoices.

The first code: verifying the invoice

The first code is on every invoice, whatever mode it was issued in. It holds an address built from four parts:

https://qr.ksef.mf.gov.pl/invoice/{seller's NIP}/{DD-MM-YYYY}/{digest of the invoice file}

• The seller's NIP — ten digits, from the invoice's Podmiot1 field.
• The issue date — field P_1, as day-month-year.
• The digest of the invoice file — a SHA-256 hash of the file, written in Base64URL.

The digest is the important part. It ties the code to the particular contents of the document: change one digit of an amount and the digest changes completely, so the code no longer matches the invoice it is printed on.

Under the code, the invoice's KSeF number is printed — or the word OFFLINE if no number has been assigned yet.

The second code: verifying the issuer

The second code appears only on invoices issued offline and is labelled CERTYFIKAT. It holds the serial number of the issuer's KSeF certificate and a signature made with that certificate's private key.

So it confirms who issued the invoice, not that the invoice has reached the system. These are two different claims and they are easy to conflate.

How to spot a code that leads somewhere else

The Ministry of Finance publishes exactly three addresses:

Any other address is not a KSeF address, however similar it looks and however many times it contains "ksef" and "gov". A QR code on paper does not show where it leads until you scan it — which is the whole problem.

Our code reader takes such a code apart and checks the domain. If the address is not one of the three above, we show it as text, with no link to click, and say so plainly.

What the code does not prove

A well-formed QR code does not mean the invoice is genuine. It means somebody built an address to the right pattern. The proof is the page that address opens: if the Ministry's system shows an invoice with that digest, from that tax number, on that date, that is confirmation. The code by itself is not.

The same goes for the bank account. A KSeF code contains no account number and says nothing about one — the account for payment comes from the body of the invoice, and that is what is worth checking against what you know about the supplier.

In short

• The QR code on an invoice leads to verification in KSeF, not to a payment.
• It contains the seller's tax number, the issue date and a digest of the invoice file.
• A second code, labelled CERTYFIKAT, concerns the issuer and appears only in offline mode.
• The only genuine addresses are qr.ksef.mf.gov.pl and its demo and test counterparts.
• The proof is the page the code opens, not the code itself.