How to actually read a Certificate of Analysis

A Certificate of Analysis is the single most over-trusted document in the gray peptide market. Vendors paste one into a product page, buyers see a number near 99%, and the transaction closes. But a COA is a lab report about a sample, not a guarantee about the vial that lands on your doorstep. The honest tension is this: a real COA tells you something genuinely useful, and a COA is also the easiest thing in this market to weaponize. Learning to read one is mostly learning what it does not say.

We run a verification standard on every compound on this site, and the COA sits at the center of it. Here is how to actually read the document.

The two numbers that carry the report

A COA earns its keep on two tests, and they answer two different questions.

Identity, mass spectrometry. This confirms the vial contains the molecule on the label. It works by measuring the compound's mass to within a fraction of a Dalton and matching it to the known sequence. Identity is the test that catches the most dangerous failure mode: substitution, where a labeled peptide is quietly a different, often higher-potency one, and you overdose without ever knowing. HPLC cannot catch this. Only mass spec can. If a COA shows purity but no identity confirmation, it has skipped the question that can hurt you most.

Purity. HPLC. High-performance liquid chromatography separates the sample into its components and reports the target peptide as a percentage of the total, the headline "99%" you see advertised. It's a real measurement, and it's also the easiest to cherry-pick, because purity genuinely drifts batch to batch. A vendor can run ten batches, publish the cleanest one, and ship you any of the other nine.

There is a third line worth as much as either: net peptide content, the actual milligrams in the vial, which is frequently less than the label. You can have 99% purity of 60% of the dose you paid for. Underfilled vials are common and rarely tested for (sourcing).

What a COA does NOT prove

This is where most buyers get hurt, so be blunt about it.

It is not the vial you received. A COA describes one tested sample from one batch. Match the batch or lot number printed on the certificate to the number on your physical vial. A mismatch, or a missing number, means the document tells you nothing about what you're holding. This is the most common sleight of hand in the market, and the structural reason "it worked for them" is worthless: even an honest review is about a different batch than yours.

It is not proof of sterility. Sterility is its own test. USP General Chapter <71>, and HPLC and mass spec say nothing about it. The product can be 99% pure and still grow bacteria.

It is not proof the product is endotoxin-free. Bacterial endotoxin is measured separately by the LAL test, USP <85>, and the compendia are explicit that a preparation passing a sterility test is not necessarily free of endotoxin (USP <85>). Endotoxin is invisible to HPLC, injected straight into you, and signals poor manufacturing hygiene. It's also the test almost everyone skips.

So a clean identity-and-purity COA can sit beside a non-sterile, endotoxin-laden vial with no contradiction at all. The document simply never asked.

In-house vs. third-party, and the one rule

The most important thing on a COA is the name at the top: who ran it.

A self-reported, in-house number is marketing. Independent testing has caught vendors red-handed, one was graded the lowest tier across dozens of samples by an independent lab while self-reporting 98–99% purity, then shut down (sourcing). Two independent labs have made batch-level honesty their business: Janoshik, the de-facto standard, runs HPLC plus mass spec with a public verification portal so a result can't be quietly edited; Finnrick buys products at retail and publishes data across thousands of samples.

The rule that never changes: never trust a vendor-recommended tester. A COA is only as trustworthy as the independence of whoever ran it. A lab chosen and paid by the seller is not verification.

The five-minute read

1. Match the lot. Certificate batch number = vial batch number. No match, stop here.
2. Check the date. Identity and purity drift across runs; an old COA isn't your product.
3. Find identity (mass spec), not just purity. No mass spec, no answer to the substitution question.
4. Read net peptide content, not only the purity percentage.
5. Read the lab name and verify it independently. No verifiable source = treat the page as decorative.

The grounded takeaway

A COA is necessary and nowhere near sufficient. It can confirm identity and purity for one sample from one batch, and that is genuinely worth having. It cannot confirm sterility, cannot rule out endotoxin, and cannot speak for the specific vial in your hand unless the lot numbers match and an independent lab signed it. (Regulators are tightening the surrounding picture, too: the FDA moved 12 peptides off its Category 2 "do not compound" list in April 2026, which changes the legal landscape but not the physics of what a certificate proves.) You don't need to trust a vendor. You need to verify a batch, and read the certificate for what it actually says, not what you hope it does.