How to read a peptide COA, number by number.

A certificate of analysis (COA) is supposed to be the document that lets you trust a vial without trusting the person who sold it to you. In practice, most peptide COAs are just PDFs — and a PDF is easy to edit, easy to reuse for a batch it was never run on, and easy to fake outright. This guide is how to read one properly, and how to tell a real result from a forged one.

We're an independent third-party peptide testing lab, and we issue COAs for a living, so a caveat up front: we have an interest in you taking certificates seriously. We've tried to write this so it's useful even if you never send us a thing.

What a COA actually is

A COA is a lab's written report of what it measured on a specific sample — the same document vendors variously call a peptide purity report, a peptide analysis report, or a lab test report; whatever the header says, it's the same animal and the same rules apply. A good peptide COA answers four questions: What is it? How pure is it? How much of it is there? And who says so — verifiably? Everything below is about reading those answers and checking whether you can believe them.

The three numbers that matter

Identity. Does the certificate confirm the compound is what the label claims, and how? The credible way to establish identity is by comparing the sample against a certified reference standard for that exact peptide — matching retention time and UV spectrum (or, at some labs, mass). “Identity: confirmed” with no reference to a standard is a claim, not evidence.

Chromatographic purity (%). This is the area-percent of the target peak versus everything else the analysis resolved — the “how pure” figure. Watch for a purity number with no chromatogram, no method, and no wavelength behind it. Purity of what, measured how?

Net-peptide assay / content (mg per vial). This is how many milligrams of actual peptide are in the vial. It is not the same as purity, and this is the single most common gap on peptide COAs. A vial can read 99% pure and still be significantly underfilled — because purity describes the quality of what's there, and assay describes the quantity. If a COA gives you a purity percentage but never tells you the milligrams, it has answered half the question. (More on that distinction in purity vs. net-peptide content.)

Two things a good COA also shows

A content specification, not just a content number. A milligram figure on its own leaves you to decide whether 8.7 mg in a “10 mg” vial is fine. A certificate should say what the lab judged it against. KMD's specification is a floor: content must be at least 90% of the label claim, with no upper cap — an overfilled vial is reported as what it is, not failed — and the spec is printed beside the result so the pass/fail is checkable, not implied. Purity is printed to two decimal places for the same reason: a number you can hold someone to.

One row per active in a blend. A vial that holds more than one compound — a GLOW, a Wolverine, a CJC-1295/Ipamorelin — cannot honestly carry a single purity figure, because purity is the ratio of one peak to everything else. A credible blend COA resolves each active as its own peak and reports identity, purity, and milligrams for each, against each compound's own reference standard, on one certificate. A blend COA with one purity number has not measured the blend. How the identity match itself works is in how peptide identity is confirmed.

The red flags of a fake or misleading COA

• No verification method, and no way to check it. If you can't independently confirm the lab issued the document and that it hasn't been altered, the COA is only as trustworthy as whoever emailed it to you.
• A purity number with no chromatogram or method context. Real results come from a real run. A bare “99.2%” floating on a page with no trace behind it is unfalsifiable.
• Purity but no milligram assay. Sometimes an honest gap, sometimes a convenient omission — either way, it leaves the underfill question open.
• Identity “confirmed” with no reference standard named. Confirmed against what?
• A mismatched or missing batch/lot number. The COA should tie to a specific batch. A certificate that doesn't name a batch — or names one that doesn't match your vial — is a certificate for someone else's material, at best.
• Reused COAs. One genuine certificate photocopied across an entire product line. The document might be real; it just wasn't run on your vial.
• Capabilities that don't add up. Be skeptical of a single certificate claiming a stack of unrelated tests — mass spec, sterility, endotoxin, heavy metals, residual solvents — with no method detail. Labs are honest about their scope; a COA that quietly implies it can do everything usually can't.
• Edited PDFs. A number changed after the fact — a purity bumped up, a milligram figure inflated. Without a way to detect tampering, you'd never know.

How a verifiable COA closes the gap

Most of the red flags above come down to one weakness: an ordinary PDF can't prove it's genuine or unaltered. That's the problem a verifiable certificate solves.

Every COA KMD issues carries a unique QR code and a SHA-256 hash — a cryptographic fingerprint of the exact PDF. Anyone can take the certificate to our verifier, and the check confirms two independent things: that KMD issued it, and that not one character has changed since we did. Alter a single digit of a purity result or a milligram figure and the fingerprint no longer matches — the tampering is detectable, not hidden. A QR code that merely links to “yes, this is real” proves the certificate exists; a hash proves this exact file wasn't touched. Those are different guarantees, and the second is the one that catches an edited number.

One more property of an honest system: a certificate that has been withdrawn — because the vial was re-tested — no longer verifies, and its own certificate page says it was withdrawn rather than quietly disappearing. A “not found” on a certificate you are holding should make you suspicious; a “withdrawn” is the lab telling you the truth. The step-by-step is in how to verify a peptide COA.

You don't need to take our word for the honesty of a KMD certificate. You can check it — and so can whoever you forward it to.

A quick checklist before you trust a COA

1. Does it name the compound and the batch/lot, and does that match your vial?
2. Is identity established against a named reference standard?
3. Is there a purity percentage with a method behind it (technique and wavelength)?
4. Is there a net-peptide milligram figure, not just a purity percentage?
5. Is the lab independent of whoever sold you the vial?
6. Can you verify the certificate is genuine and unaltered — or are you just trusting the sender?
7. If the vial is a blend, is every active reported on its own row — or is there one purity number for the whole mixture?

If a COA can't clear that list, it isn't necessarily fake — but it hasn't earned your trust yet.

About KMD Analytical

We're an independent, third-party peptide testing lab in Chatsworth, California. We test peptides for identity, chromatographic purity, and net-peptide assay (mg/vial) by RP-HPLC-UV, and we issue SHA-256-verifiable COAs. We don't sell peptides, we're transparent about our scope — RP-HPLC-UV, not LC-MS or sterility testing — and every certificate we write can be checked by anyone. That's peptide testing you can verify.