Research Use Only. Not medical advice
PeptideAudits

Guide

How to read a COA — and why a PDF isn't proof

A certificate of analysis is only as trustworthy as your ability to check it. Here's how we evaluate every report, and how you can do the same in under two minutes.

01

Why a PDF is not enough

A COA is usually a PDF or a screenshot. Anyone with a free PDF editor can change a vendor name, a date, a purity figure or a batch number in minutes — and the result looks identical to the real thing. A genuine report from one vendor can be relabeled for another, and a two-year-old report can be "re-dated" for this month's batch.

Looking at a PDF can tell you a report is suspicious. It can never tell you a report is genuine.

Five edits, one forged certificate
Client / vendor
Another Vendor LLCYour Vendor Co.
Sample
BPC-157 5mgBPC-157 10mg
Batch / lot
BX-0412BX-2610
Test date
2024-03-022026-10-02
Purity (HPLC)
96.8%99.6%

02

The verification portal difference

Some labs keep every report on their own servers and let anyone look it up with the report's task ID or QR code. When you pull the report straight from the lab, you see what the lab actually issued — any edit to the PDF shows up as a mismatch. That direct lookup is the only foolproof check against a forged report.

Public lookup available
  • Janoshik — task ID / QR code lookup
  • MZ Biolabs — online report portal
  • Freedom Diagnostics — Search Code / QR code lookup (opens the lab's own copy of the report)
  • Vendor name, batch, date and results are confirmed by the lab itself.
Static report only
  • The lab may be real and competent, but there's no self-service way to confirm this exact PDF.
  • You're trusting the vendor didn't change anything.
  • Same applies to a Janoshik, MZ or Freedom Diagnostics report with its key or Search Code cropped out.

How to verify a report yourself

  1. Find the task ID, verification key or QR code on the certificate.
  2. Open the lab's website yourself — type the address, don't use a link from the vendor.
  3. Enter the key and compare every field: client, sample name, batch, date, purity, quantity.
  4. Any mismatch, or "report not found", means the PDF you were shown isn't what the lab issued.

How this affects a PeptideAudits grade

Lab credibility is worth 25 of 100 points.

  • 3rd-Party · Independently Verifiable25 ptsOutside lab with a public self-service lookup (Janoshik task ID / QR, MZ Biolabs portal, Freedom Diagnostics Search Code / QR), so anyone can confirm the report is authentic and unaltered.
  • 3rd-Party · Unverified Portal15 ptsA legitimate outside analytical lab, but there's no public self-service lookup to confirm the report wasn't edited.
  • In-House / Manufacturer5 ptsTested by the vendor or its manufacturer, not an independent lab.
  • Unverified / No COA0 ptsNo valid lab report is available for this batch.

03

Beyond purity: 99% isn't the whole story

HPLC purity is the headline number, but it's one test. A complete picture needs to know how much is in the vial, whether it's contaminated, and whether the report even describes the batch you're holding.

Quantity (net content)

Purity says what share of the powder is the peptide. Quantity says how much powder is there. A 10mg vial measuring 7.8mg can be 99.5% pure and still 22% underdosed — which also makes its real price per mg 28% higher.

Pass · Within ±5% of the label

Endotoxin (LAL)

Bacterial endotoxins survive filtration and aren't visible on an HPLC trace. Only a dedicated LAL test shows them.

Pass · Under 1 EU/mg

Heavy metals

Lead, arsenic, cadmium and mercury can come from reagents and equipment. A purity test doesn't measure them.

Pass · Pb < 0.5 · As < 1.5 · Cd < 0.5 · Hg < 1.5 µg/g

Sterility

Checks for live microbial contamination. Rarely published by RUO vendors — when it is, it's a strong signal.

Pass · No growth

COA age & batch match

A certificate only describes the batch that was tested. Some vendors reuse one good report for years across many production runs. If the batch number on your vial doesn't match a recent report, the COA tells you nothing about it.

Pass · Current batch, tested < 60–90 days

04

Spotting red flags

None of these prove a forgery on their own. Two or more on one report is a reason to stop and verify.

  • No task ID or QR codeReports from labs that offer public lookup normally carry a key. A missing or cropped-out key means you can't check it.
  • Recycled batch numbersThe same lot number on different compounds, vial sizes, or across years of listings.
  • Mismatched fonts or alignmentNumbers in a slightly different typeface, weight or baseline than the text around them — a classic sign of editing.
  • Blurry seals or signaturesLab logos, stamps or signatures that are pixelated while the rest of the page is sharp were likely pasted in.
  • Impossible or odd datesTest dates in the future, before the product launched, or a report date earlier than the sample received date.
  • Too-perfect resultsExactly 100.00% purity, or identical purity and chromatograms across different peptides.
  • Sample name doesn't matchThe report names a different compound, size or client than the product page it's attached to.
  • Lab you can't findA lab with no independent website, no address, or a domain controlled by the vendor itself.
  • Verify link supplied by the vendorAlways open the lab's site yourself. A vendor-provided "verify" link can point to a look-alike page.

Put it to work

For research use only. This guide explains how laboratory reports are evaluated; it isn't medical advice.

PeptideAudits · Protocols App

Track Your Research Protocols, Half-Lives & Reconstitution Math

Log every vial, batch number and reconstitution in one place — with half-life curves and the same math as the calculator above, saved per protocol.

Open the Protocols App
  • Protocol log
    Vials, batch #s and COA links per study
  • Half-life tracking
    Visual decay curves by compound
  • Saved reconstitution
    Units-to-draw, remembered per vial