How to verify a peptide COA: the lab lookup, the batch match, what 99% leaves out

The six-field check

1. Find the identifiers. A verifiable certificate carries a task or job number and a key, or a QR code, or a lab ID, printed by the lab. No identifier, no check — ask the vendor for the full report and stop until you have it.
2. Run the lab's own lookup. Janoshik: task number plus the capitalised key at the bottom of the report, or the QR, at janoshik.com/verification. Vanguard: the Lab ID at verifiedbyvanguard.com. Chromate: COA number plus access code at chromate.org/verify. Kovera: koveralabs.com/verify. Peptide Test: verify.peptidetest.net. The address bar must show the lab's domain.
3. Match five fields exactly: compound, batch or lot, purity, quantity per vial (mg) and sample date. The lab's stored copy is the reference; a value that differs in the vendor's PDF is an altered report, whatever the reason.
4. Match the vial. The batch on your vial equals the batch on the report, and the report date is later than the batch date. A report for another batch certifies nothing about yours.
5. Read what was measured. HPLC purity, quantity, identity by mass spectrometry, net peptide content, endotoxin, sterility and TFA are separate tests. A report that carries only the first one supports only the first claim.
6. Look for what is missing. Where the lab's public listing shows other reports for the same vendor and batch, read them. A vendor that publishes the passing report and not the failing one has told you something.

Ninety seconds for a certificate that passes. The rest of this guide is what each step rests on.

Which labs let you verify a COA yourself?

We checked each lab's site on 3 November 2026. "Public lookup" means anyone with the identifiers printed on the report can retrieve the lab's copy without an account.

Two cautions. A verification page on a vendor's domain, or on a domain that imitates a lab's (janoshiklabs.com, janoshik.online, and a verification.mzbiolabs.us.com page that belongs to a vendor, not the lab), is not a lookup. And a lab's "not found" has three meanings — forged, unpublished by the client, or mistyped — so a miss is a reason to ask the lab, not a verdict.

What does a complete peptide COA contain?

USP general chapter 1503 (synthetic peptides) describes the assay on an anhydrous, counter-ion-free basis and separates the lines that a one-page vendor report tends to collapse into "purity 99%":

• Purity by HPLC — the main peak as a share of total detected area. It says nothing about mass, water or salt.
• Identity by mass spectrometry — observed mass against the theoretical mass of the sequence. Without it, a 99% peak could be the wrong peptide. Janoshik's base test does not include it; the LC-MS screen is a $205 add-on.
• Quantity per vial — milligrams found against the label claim. Janoshik reports it in the base test; a third-party review of 1,478 vials at 99%+ purity found 52 holding more than 10% less than the label.
• Net peptide content — peptide as a share of the powder after water, counter-ion and solvents. Bachem's QC guide: net peptide content and purity "are not equivalent". Janoshik offers it as a CHNS mass report ($145).
• Counter-ion — TFA or acetate, by USP 503 and 503.1. TFA testing is a $290 add-on at Janoshik.
• Water — Karl Fischer, USP 921.
• Endotoxin — LAL assay, USP 85, in EU per mg or per vial; needs its own vial ($180 at Janoshik). How to read the units is in endotoxin on a peptide COA.
• Sterility and bioburden — TAMC/TYMC, USP 61 and 62; 14 days, $290.
• Heavy metals — As, Cd, Pb, Hg, USP 232 and 233; $105 as an add-on.

Prices are Janoshik's public list on 3 November 2026 and are there to show why vendor reports stop at purity and quantity: the full set costs several times the base test. A report with one HPLC line is not fake; it is narrow.

How do doctored and recycled COAs look?

Patterns from lab notices, our own mirrors and buyers' reports, with the date each was documented:

• The lookup fails or returns different values. Janoshik: a report "is considered legitimate only if it matches the version stored in our system". We found 42 Core Peptides reports where the shop's PDF dropped the quantity line that Vanguard's own copy prints (Vanguard, two versions, October 2026).
• Identifiers removed. TrustPointe, March 2025: forged copies had the QR code and link cut off and carried values that were "not even possible".
• Wrong chromatogram under a real letterhead. Vanguard, July 2026: a "retatrutide" certificate carrying a tirzepatide chromatogram; the lab stated "we did not issue these certificates".
• Client or sample name edited. r/Biohackers, May 2026: a Janoshik report with the company name changed, caught by pulling the task number on the lab's site. A cropped NAD+ certificate whose task number resolved to a bacteriostatic-water test was reported the same way.
• Dates older than the batch. r/RetatrutideWomen, September 2026: report dates earlier than the batch numbers on the vials.
• One task number on several products or vial sizes. A real test covers one sample; the same number on a 5 mg and a 10 mg listing is a reuse.
• 99.9% on everything, with no mass spectrometry. Vendor PDFs re-rendered from a template show it in the file itself: a raster chromatogram pasted into a vector PDF, an image editor in the PDF's producer metadata, identical baseline noise across lots.
• A lab's reference number is not a stable citation. 57 of the 1,828 Kovera certificates we mirror were revised under the same number; 20 moved a value (Kovera revisions, August 2026). Re-run the lookup before a purchase rather than trusting a saved PDF.

Forgery is not hypothetical. Matthew Kawa, who sold SARMs that tested as testosterone under forged certificates, was sentenced to 70 months on 30 July 2026 (the case and what a COA can prove).

What a verified COA still does not tell you

Three limits hold even when every field matches.

The report describes one sample on one day. It was chosen and shipped by the vendor, under a client name the vendor typed in (Janoshik's report header fields — client, sample name, manufacturer, batch — are filled by the client, default "Anonymous"). It does not describe the vial you received unless the batch matches, and it does not describe storage since.

The report tests what was paid for. "Purity 99.2%" with no identity, quantity, endotoxin or TFA line is a narrow statement, and a vendor that publishes only that line has made a choice.

The report is not a regulatory status. FDA warning letters to online peptide sellers continued through 2026 — five on 31 March 2026 and five more on 24 August 2026 — and each states that "Research Use Only" labelling does not change that the products are unapproved new drugs when sold for human use. Our FDA letters coverage tracks the sellers named. A verified certificate and an open warning letter can describe the same vendor; our audits score them separately.

How we use this in audits

We mirror the public listings of two labs — 662 Janoshik client-published tests (crawl of 15 October 2026) and 1,828 Kovera certificates (26 May 2026), 2,490 in all — and check every vendor-published COA against the issuing lab's record where one exists. A certificate the lab cannot find, or one that differs from the lab's copy, is noted on the vendor page and counts against the COA subscore; where the lab's listing shows a failed report the vendor omitted, the profile lists both. The COA verifier runs the Janoshik part of that check on a task number. The protocol and its weights are on the methodology page.