How to read a peptide COA (and spot a fake one)

A certificate of analysis is the closest thing this market has to a label you can trust. It's also the easiest thing in it to fake.

That tension is the whole reason to learn to read one properly. A real COA from an independent lab tells you what was in a specific vial on a specific day. A fake, recycled or cherry-picked one tells you what a seller would like you to believe. On a phone screen, they look the same.

This guide walks through a typical peptide COA line by line: what each number measures, what it quietly leaves out, and the checks that separate a genuine report from a decorative one. Where it helps, we've added what the lab data on VendorVerify shows, drawn from 1,529 vials that buyers had tested between March 2023 and September 2026. This guide explains lab reports; it isn't medical advice or guidance on using any compound.

What a COA is, and who wrote it

"COA" stands for certificate of analysis. In the research-peptide world the term covers two very different documents, and the first job is working out which one you're holding.

A vendor or manufacturer COA is produced, or at least supplied, by the people selling the product. It might come from the factory that made the batch, from a lab the vendor paid, or from a template in someone's design software. Some are genuine. The trouble is that you can't tell which from the document alone, and the seller has every reason to show you the best one they have.

A buyer-commissioned COA is a report from an independent lab that a customer, or a group of customers pooling money, sent a vial to. The buyer chose the lab and the vial. Every result on VendorVerify comes from this kind of report, and it's the kind worth weighting most.

Neither is a guarantee. A buyer's report can still be misread, matched to the wrong vendor, or quietly edited before it's shared. But the incentives are different. In a market with no regulator checking the paperwork, incentives are most of what you have.

The anatomy of a typical report

Layouts differ from lab to lab, but almost every peptide COA contains the same building blocks.

The sections that cause the most confusion are purity, quantity and identity, so that's where we'll spend the most time.

Purity: the number everyone reads first

Purity is usually reported as a percentage from HPLC, high-performance liquid chromatography. The lab dissolves the sample, pushes it through a column that separates the molecules, and records everything that absorbs UV light as it comes out the other end. Each compound shows up as a peak. Purity is the target peptide's peak as a share of all the peaks.

So "99.4% purity" means that of the UV-detectable material the lab saw, 99.4% was the peptide it was looking for. The other 0.6% is usually closely related impurities: slightly shorter chains, oxidized versions, leftovers from synthesis.

Useful. Also much narrower than most people assume.

HPLC purity doesn't tell you how much peptide is in the vial. It doesn't see water, salts or the counter-ions the peptide was purified with. And it's relative: a vial holding half the promised amount can still produce a beautiful 99.8% peak, because purity only describes the material that was there.

In our data, purity is rarely where vials go wrong. Of the 1,478 vials with a purity result, 1,341 (91%) came in at 99% or higher, and 14 were under 95%. If you only ever read the purity line, nearly every vendor looks excellent.

Quantity: the line that actually fails

The number that separates good vendors from bad ones is usually quantity. Labs call it content, net content, amount or assay. It's the lab's measurement of how many milligrams of peptide were in the vial, typically found by comparing the sample against a reference standard.

Put it next to the label. A vial sold as 10 mg that measures 10.3 mg is fine. One that measures 7.9 mg is 21% short, and on VendorVerify that counts as a failed vial.

Here's how the 1,441 vials with a measured amount in our data compare with their labels:

Two things jump out. Most vials hold more than the label says; the median is 6.5% over, and "exactly on label" is the minority. And a small but real share is badly short.

Now the part that matters for reading a COA. Fifty-two vials in our data tested at 99% purity or better while holding more than 10% less peptide than the label claimed. Twenty of them were more than 20% short. Every one of those reports would have looked reassuring to someone who only read the purity line.

Figures as of September 28, 2026. Live numbers for each peptide are on its results page, and every vendor's are on the ratings page.

Identity: is it even the right molecule?

Purity and quantity both assume the lab is measuring the right compound. Identity testing checks that assumption.

The standard tool is mass spectrometry, often paired with chromatography as LC-MS. It weighs the molecule. If the measured mass matches the peptide's known molecular weight, that's strong evidence the vial holds what it says. If it doesn't match, no purity figure in the world helps.

Look for a line saying identity was confirmed by MS, ideally with the observed mass next to the expected one. Be more cautious with a report that only says "conforms" or relies on retention time, the point at which the peak came out of the column. Retention time can suggest identity, but a different peptide can elute at a similar moment.

Mix-ups aren't hypothetical. Buyers have reported vials sold as one GLP-1 compound that tested as a different one, and "not detected" results where the lab found no trace of the claimed peptide at all.

Reading the chromatogram itself

Many reports include the chromatogram: a graph of the detector's signal over time. It's worth a glance even if you never look at another one.

A clean trace has one tall, sharp main peak and a flat baseline, with maybe a few tiny bumps on either side. Several sizeable peaks close to the main one point to impurities or degradation. Because the purity figure is calculated from this graph, the two should agree. A report claiming 99.9% next to a chart with obvious secondary peaks doesn't add up.

One more trick worth knowing: forged reports sometimes reuse the same chromatogram image across different products. If two reports for two different peptides show an identical trace, down to the same little wobble in the baseline, at least one of them is fake.

Blends and multi-peptide vials

Some products combine two or more peptides in one vial, such as CJC-1295 with ipamorelin, or branded blends of three or four compounds.

A proper report measures each component separately and gives each its own amount. A single purity figure for a blend tells you very little, and a single total weight tells you even less, because one component can be badly short while another is overfilled. If a blend's report doesn't break out every ingredient, treat it as incomplete.

Endotoxin, TFA and the tests most COAs skip

A standard purity-and-quantity report says nothing about several things buyers increasingly care about. If these matter to you, check whether they were tested rather than assuming they were.

Endotoxin. Endotoxins are fragments of bacterial cell walls. They can be present in a product that's otherwise pure and correctly filled, and HPLC won't show them. They're measured with a separate assay, usually LAL, and reported in endotoxin units (EU) per milligram or per vial. A result written as "< 0.05 EU" means below the lab's detection limit.

TFA. Trifluoroacetic acid is used in making and purifying many synthetic peptides and can stay behind as a counter-ion. Some reports list TFA content or state the salt form, acetate or TFA. It sits entirely outside the purity number.

Sterility. A separate culture test that usually takes around two weeks. A purity report, however clean, says nothing about whether a vial is sterile.

Heavy metals and residual solvents. Occasionally tested, rarely shown.

VendorVerify records these results when buyers have them done, under "Other lab tests" on each vendor page. We don't score them yet, because far fewer vials get tested for them, and a test that wasn't run isn't the same as a test that failed.

How to check a COA is real

Most of the time you won't be looking at a PDF you ordered yourself. You'll be looking at a screenshot posted by a vendor, a Discord member or a Telegram channel. Here's how to test it.

1. Find the unique identifier. Independent labs give each report a key, task number or QR code. No identifier is a red flag on its own.
2. Check it at the source. Go to the lab's website yourself rather than clicking a link in the post, and look the report up. Janoshik produced about seven in ten of the results in our data. Its verification page takes a report's task number and unique key and looks up the matching test record. Other labs offer lookup pages or will confirm by email.
3. Match every field. The verified report should show the same compound, the same claimed amount, the same sample description and the same numbers as the copy you were shown. Forgers usually change one field, not all of them.
4. Match the batch. A real report for last year's batch says nothing about the one on sale now. Look for a batch or lot number that ties the report to what you would actually receive.
5. Look at the dates. The test should come after the batch was made and, ideally, recently. A vendor who has been "testing" a product with the same report for eighteen months hasn't been testing it.

Red flags we see again and again

Some warning signs come up so often they're worth memorizing.

• The QR code or report key is cropped, blurred or missing. There's rarely an innocent reason.
• The key exists but belongs to something else. In one documented case, a certificate posted for NAD+ had its key and QR code removed, and the task number behind it turned out to belong to a bacteriostatic water test, according to a Peptide Protocol Wiki review of Janoshik.
• Every product scores 99.9%. Real results vary. A catalog where every peptide lands at the very top of the scale is more likely a template than a lab.
• Purity with no quantity. A report showing only purity leaves out the measurement most likely to fail.
• A lab you can't find, or one that only seems to exist on the vendor's own site.
• Formatting that's slightly off. Fonts that change mid-page, misaligned tables, a logo that doesn't match the lab's website. Compare against a report you've verified yourself.

None of these proves fraud on its own. Together, they're usually enough reason to stop and ask questions.

One good report is not a promise about your vial

Even a genuine, verified, recent report describes the vial that was tested. Batches vary, and so do vials within a batch. The honest reading of a clean COA is "this vendor has produced at least one good vial," not "every vial is good."

That's why patterns beat any single certificate. A vendor with dozens of independent results over many months, most of them close to label, tells you far more than one perfect PDF. It's also why VendorVerify won't rank a vendor until it has at least five lab reports, and why newer reports count for more in the score. The methodology page explains exactly how.

If you've had a vial tested yourself, you can submit the report. Every buyer-commissioned result makes the picture sharper for everyone else.