How to verify a peptide COA — and spot a fake.

Forged certificates of analysis are not rare. They circulate in group buys, they get re-branded from one company to another, and entire look-alike websites exist to “verify” documents the real lab never issued. The basic lookup takes thirty seconds and the full check below takes about two minutes — but you have to know where to look, because a PDF can never vouch for itself.

The two-minute check

You need the certificate — ideally the PDF, not a screenshot — and a browser. The example is a KMD Analytical certificate; the same order works for any lab with a public verification page.

1. Find the certificate ID. On our certificates it is printed at the top, beside the QR code, in the form CODE-YYYYMMDD-XXXX-NN (the sample certificate shows where). No certificate ID at all — just a compound name and a purity number — is the first and loudest red flag.
2. Type the lab's address yourself. Open a new tab and go to kmdanalytical.com/verify — anyone can use it, no account needed. Do not follow a link that came with the certificate; that is the part a forger controls. If you scan the QR code, read the address it opens before anything else.
3. Enter the ID exactly as printed. A certificate we issued returns VERIFIED with its issue date, product and cryptographic fingerprint. An unknown ID returns NOT VERIFIED. There are no false positives: if it verifies, we issued it.
4. Compare the record with the document. The product and issue date on the result must match the document. The result names the compound (on a certificate that leads with a brand's product name, the line beneath it) and writes the date in a different format. Where the result offers “View full COA”, open it — that is the lab's own copy — and compare the client name, results and dates line by line.
5. Add the PDF on the same page and verify again. Drop the file onto the box under the ID field, or tap the box to choose it. Your browser computes the file's SHA-256 fingerprint and the lookup compares it with the one on record; the file never leaves your device. “PDF is byte-identical to the issued record” means nothing was changed. “This PDF does NOT match” means it is not the file the lab has on record.
6. Match the certificate to the vial. Verification proves the document, not that it belongs to your vial. Check that the client or brand named on it is the company you bought from. Where the certificate has a Client Batch / Lot line, it should agree with your label (the Batch ID is the lab's own sample number and will not be on a vial). Where it carries an intake photo, the vial should look like yours.

What the seal proves

A sealed certificate is fingerprinted with SHA-256: a hash computed from the exact bytes of the issued PDF. Alter anything — a purity digit, a date, a company name — and the fingerprint changes completely, so the verification page reports that the file does not match. When the hash matches, you know two things at once: the certificate ID is real, and the file in your hands is byte-for-byte the one the lab issued. The ID lookup alone shows only the first.

What each part of a certificate proves — and what it cannot

A certificate is several separate claims on one page.

How to read the numbers themselves is in how to read a peptide COA; what our testing covers is on the scope page.

How certificates get faked

Look-alike websites

Someone registers a domain one character away from the lab's — an extra hyphen, a different ending — copies the real site's pages and logo, and adds a “verify” page that says yes to certificates the lab never issued. The forged PDF's QR code and “verify at” line point to the copy, so every check a careful buyer runs lands on the forger's server.

• Read the address bar letter by letter. Our only domain is kmdanalytical.com: one word, no hyphen. A certificate “verified” anywhere else was not verified by us.
• Do not trust what a page says about itself. A copied site can copy the “our only website” warning too, with its own address in it.

Edited PDFs

A cheaper forgery starts with a genuine certificate. A PDF editor changes a purity figure, a milligram value, a date or the company name in seconds. A variation puts a real certificate ID on a document made up from scratch, so a lookup of the number alone comes back verified.

The file check in step 5 catches both. If all you have is a screenshot, compare it with the lab's copy in step 4.

A real certificate for the wrong vial

The hardest case passes every check above, because nothing was forged: one genuine certificate shown for a whole product line, for a later batch, or by a company that never submitted anything. Step 6 is the only defense. A certificate that names a different company from the one selling to you is evidence about that company's vial, not yours.

The red flags forged COAs keep showing

• No verification path. The issuing lab has no public page where the certificate can be checked.
• No chromatogram. A purity claim with no trace behind it is a number typed into a template.
• Uniform, too-good numbers. Every vial 99.9%, every batch identical. Real results vary.
• A missing or absurd retention time. The chromatographic details are where forgers get lazy — a “main peak” with no retention time, or one that contradicts the visible trace.
• The certificate is issued to nobody. A real cert names the submitter. Re-branded certificates — one company's results wearing another's name — are a known laundering pattern.
• The lab is unreachable. No phone, no address, no reply. A real lab answers questions about its own certificates.

If a certificate does not verify

One of three things has happened.

• NOT VERIFIED, no matching certificate. The lab has no certificate in force under that number. Retype the ID exactly as printed and confirm the address bar reads kmdanalytical.com. If it still fails, the lab either never issued that document or has withdrawn it.
• Withdrawn. The lab issued the certificate and later withdrew it, for example because the sample went back for a re-test. Type kmdanalytical.com/coa/ followed by the certificate ID: a withdrawn certificate says so on that page. It no longer stands; a replacement, if issued, carries its own number.
• Verified, but the PDF does not match. The number is real but the file is not the one on record: it was edited, re-saved by another program, or is not the current version. Rely on the lab's copy.

Then, in this order:

1. Ask whoever gave you the certificate for the original PDF, exactly as the lab emailed it, and check again.
2. Don't argue with the seller about it — go to the source. Contact the lab using the details on the lab's own website, not the ones printed on the document. For a KMD certificate, email info@kmdanalytical.com with the certificate ID and the file; our phone and address are on the lab facts page. We answer these inquiries directly (they're how more than one forgery has been caught), and any serious lab will do the same.
3. Until the lab confirms the certificate, treat the vial as untested.
4. For an answer about the vial itself, have it tested: place an order, then mail the sealed vial as the submission page describes. Prices are on the pricing page; how third-party testing works covers the process.