Verifactu hash: compute the SHA-256 of an invoice record
Independent, non-governmental site
Load a Tax Agency example or type your own data: the calculator shows the string being hashed and the resulting hash, and says whether it matches the official one.
SHA-256 hash
3C464DAF61…
Matches the result published by the AEAT
3C464DAF61ACB827C65FDA19F352A4E3BDC2C640E9E9FC4CC058073F38F12F60
| Length | 64 hex characters |
String that is hashed
IDEmisorFactura=89890001K&NumSerieFactura=12345678/G33&FechaExpedicionFactura=01-01-2024&TipoFactura=F1&CuotaTotal=12.35&ImporteTotal=123.45&Huella=&FechaHoraHusoGenRegistro=2024-01-01T19:20:30+01:00
Values are taken as they are, trimmed at both ends. A single different character changes the whole hash.
Prepared by Radif Partners · Method · Rules read in the BOE and at the AEAT on 25 October 2026
The hash, called huella in Spanish, is the cryptographic digest that every invoicing system adds to its registration and cancellation records, under article 12 of RD 1007/2023 and article 13 of Order HAC/1177/2024. It is computed with the SHA-256 algorithm over a string made of field=value pairs joined by the & sign. A registration record uses eight values: issuer tax ID, series and number, issue date, invoice type, total VAT, total amount, the previous record’s hash and the generation date, time and time zone offset. A cancellation record uses five. Because each record includes the previous hash, the records form a chain: if someone changes one cent on an invoice already recorded, its hash changes and no longer matches the one stored in the next record. The AEAT document, version 0.1.2, publishes three examples with their results. This calculator reproduces them character for character and lets you change any value to see the effect. It is meant for people who build or audit a system; an ordinary user computes nothing, because the software does it on its own.
The fields that go into the hash
| Order | Registration record | Cancellation record |
|---|---|---|
| 1 | IDEmisorFactura | IDEmisorFacturaAnulada |
| 2 | NumSerieFactura | NumSerieFacturaAnulada |
| 3 | FechaExpedicionFactura | FechaExpedicionFacturaAnulada |
| 4 | TipoFactura | Huella |
| 5 | CuotaTotal | FechaHoraHusoGenRegistro |
| 6 | ImporteTotal | |
| 7 | Huella | |
| 8 | FechaHoraHusoGenRegistro |
Article 13 of Order HAC/1177/2024 says which record values are hashed, and the AEAT technical document says how. Each value is written as its field name, an equals sign and the value, and the pairs are joined with the & sign. Values are trimmed at both ends, the string is encoded in UTF-8 and the SHA-256 result is expressed in upper-case hexadecimal: sixty-four characters. A registration record from the official example starts like this: IDEmisorFactura=89890001K&NumSerieFactura=12345678/G33.
Why one cent changes the whole hash
A good digest algorithm reacts to any change in its input with a completely different output that bears no resemblance to the previous one. That is why nobody can touch up an invoice and adjust the hash by hand: they would have to recompute the hash of the changed record and of every record after it, and the last one may already be with the Tax Agency or signed. Try changing the amount of the first official example:
SHA-256 hash
SHA-256 hash
3C464DAF61AC…
| Full hash | 3C464DAF61ACB827C65FDA19F352A4E3BDC2C640E9E9FC4CC058073F38F12F60 |
| String | IDEmisorFactura=89890001K&NumSerieFactura=123456… |
Hash, chaining and event records
Article 8.2 of RD 1007/2023 requires records to be chained so that their trail can be followed from first to last. The hash is the tool for that. In non-VERI*FACTU mode the system also keeps an event log, chained with its own hash, where it notes events such as detected anomalies or record exports. If the system detects that a chain is broken, it must raise a warning. Any correction is made through a later record, never by rewriting the original, so the first version of every invoice stays in the chain.
For a user the hash is invisible: it appears neither on the invoice nor in the QR. What the customer sees is the QR code, which they can check with the QR reader. The differences between the modes are on VERI*FACTU or non-VERI*FACTU.