What these files are
Invoices between businesses in Italy are, with few exceptions, XML files in the FatturaPA format, sent through the Italian tax authority’s Exchange System (SdI). Many suppliers sign them digitally first, so they arrive as .xml.p7m: the XML wrapped in a CAdES signature envelope.
Accountants and Italian partners often pass them on in bulk: a ZIP downloaded from the Agenzia delle Entrate portal (Fatture e Corrispettivi) or exported from accounting software. To view and download invoice files on that portal, you need to join its e-invoice consultation service, which is done on the same portal. You do not need to unzip the ZIP here: drop it as it is.
What is in the archive, and what we do with it
We recognise each file by its content, not by its name:
- .xml.p7m: a digitally signed invoice. We check the signature and read the invoice.
- .xml: an invoice without a signature, for example one the supplier sent unsigned.
- .pdf.p7m and other signed documents: we extract the original document and put it in the ZIP, unchanged.
- Receipts and notifications of the Exchange System (SdI), and metadata files: recognised and listed as skipped.
- A ZIP inside the ZIP: opened, one level deep only.
The PDF of each invoice
For every invoice we draw a readable PDF laid out like a traditional Italian invoice (it is not the tax authority’s official stylesheet): document type (TD01 invoice, TD04 credit note…), number and date, supplier and customer with VAT number (partita IVA) and tax code (codice fiscale), description (causale), lines with quantity, price and VAT rate, withholding tax, VAT summary per rate, totals and payment terms with IBAN. Labels are in English; official code descriptions stay in Italian next to the code. Long invoices continue over several pages, and past 2,000 lines the PDF is shortened (the XML file has them all). A file holding several invoices gets one PDF for each, up to 50 per file.
The PDF is a representation of the invoice, not the invoice itself: the tax document remains the XML file, which is the one to keep. Every page says so in its footer.
Attachments inside an invoice (a courtesy PDF copy, an order) are in the ZIP next to their invoice, under the same name prefix. If a .p7m envelope holds a PDF instead of an XML invoice, the ZIP contains that PDF as it is.
The Excel summary
The Excel file has three sheets: Invoices, one row per invoice (file, signature result, type, number, date, supplier and customer with VAT number and tax code, taxable amount, VAT, total, currency, first due date and any error); VAT summary, one row per rate or exemption of each invoice; and a Legend explaining the columns.
Amounts and dates are real numbers and dates, ready to sum, filter and sort. Taxable amount and VAT are the sums of the invoice’s VAT summary; the total is the document total stated on the invoice or, when it is missing, taxable amount plus VAT. The amounts of each rate are those stated in the file, with no rounding; the invoice’s taxable amount, VAT and total are computed only as described above.
What the “Signature” column tells you
Every signed file goes through the same checks as on the main page: document integrity, the cryptographic signature, the certificate bound to the signature, the certificate’s validity at the reference date, and an issuer on the Italian (AgID) or Romanian (ADR) trusted lists. The reference date is that of a trusted time-stamp when the file contains one; otherwise it is today.
- Signature intact: all the checks above passed.
- Problem found: at least one check failed, for example the content does not match what was signed, or the certificate had expired when it was signed. The table says which. A certificate that expired after signing, with no time-stamp, gives “Partly verified” instead.
- Partly verified: nothing failed, but not every check could be completed, usually because the certificate’s issuer is not on the lists we use. It does not mean the signature is forged.
- Not signed: the file is an XML with no digital signature.
- Certificate revocation is not checked: that would mean contacting the certificate provider online. “Signature intact” is not a statement of legal validity; for a verification report to keep, use your certificate provider’s software.
Limits and privacy
Everything happens in your browser: the ZIP is opened and every invoice is read, checked and converted on your device, never uploaded to a server. No code on this page sends the files, their names or their content anywhere. When you close the tab, nothing is left.
- Up to 1,000 invoices and documents per run (receipts and metadata files do not count) and 500 MB in total; each file up to 50 MB.
- Password-protected archives: extract the files first and drop those.
- A damaged file does not stop the others: its error shows on its own row, in the table and in the Excel file.
- A computer is faster: we work on several files in parallel, and a phone has less memory.