How to Verify a Certificate of Analysis

A Certificate of Analysis (COA) is the single most important document you'll encounter when evaluating a peptide product. It's supposed to tell you what's in the vial, how pure it is, and whether it's safe to use. The problem is that not all COAs are created equal — and some are outright fabricated.

We know COAs get fabricated because a federal court has said so. In July 2026 the owner of Paradigm Peptides was sentenced to 70 months in prison; he had admitted to forging the laboratory certificates his customers used to verify purity, and products his company sold as SARMs were found to contain testosterone.^[3] Separately, in October 2025 the FDA issued a Class I recall — its most serious category — for injectable products contaminated with dangerous endotoxin levels.^[4]

This guide will teach you to read a COA critically, spot the red flags, and verify results independently. It's not complicated, but it does require knowing what to look for.

Why COAs matter

A COA is a document issued by a laboratory that certifies the results of testing performed on a specific batch of product. For peptides, it should answer three fundamental questions:

1. Is this the right molecule? (Identity testing)
2. How pure is it? (Purity analysis)
3. Is it safe to inject? (Contaminant testing — endotoxins, sterility, heavy metals)

When a COA is legitimate and thorough, it provides genuine confidence. When it's incomplete, generic, or falsified, it gives you nothing but a false sense of security.

The scale of the problem

Here is what can actually be sourced about gray-market peptide quality. We have been deliberately strict about what goes in this table.

Sources, in order: the DOJ sentencing release,^[3] the FDA Class I recall notice,^[4] Finnrick's endotoxin report,^[2] the live Finnrick vendor database,^[1] and FDA's warning-letter database.^[11]

What a legitimate COA should contain

A thorough COA includes multiple sections, each serving a different purpose. Here's what to look for — and what each section actually tells you.

Peptide identity

The top of the COA should clearly state:

• Peptide name — the common name (e.g., BPC-157, semaglutide, tirzepatide)
• Amino acid sequence — the full sequence in single-letter or three-letter amino acid code
• Molecular weight — the theoretical molecular weight calculated from the sequence
• Molecular formula — the chemical formula
• Batch/lot number — a unique identifier tying this COA to a specific production run
• Manufacture date and expiration date

If any of these are missing, you're already working with incomplete information. The lot number is especially important — it's what connects this specific document to the specific vial in your hand.

HPLC purity analysis

High-Performance Liquid Chromatography (HPLC) is the standard method for measuring peptide purity.^[6] It works by separating the molecules in a sample based on how they interact with a solvent flowing through a column. The result is a chromatogram — a graph showing peaks.

How to read it:

• The x-axis is retention time (how long each molecule took to pass through the column)
• The y-axis is signal intensity (typically UV absorbance at 214–220 nm)
• The main peak represents the target peptide
• Smaller peaks represent impurities — deletion sequences, truncated fragments, oxidized variants, or synthesis byproducts

Purity is calculated as: the area under the main peak divided by the total area under all peaks, expressed as a percentage.^[6]

Important limitation: HPLC tells you how pure the sample is, but it cannot tell you what the main peak actually is. A sample could show 99% purity by HPLC while containing a completely different peptide — if that peptide happens to elute at the same retention time. That's why mass spectrometry is essential.

Mass spectrometry (MS) confirmation

Mass spectrometry measures the molecular weight of the molecules in your sample. It's the identity test — the analysis that confirms the main peak on the HPLC chromatogram is actually the peptide you think it is.

What to look for:

• Expected molecular weight — calculated from the amino acid sequence
• Observed molecular weight — the value measured by the mass spectrometer
• The match should be within +/- 1 dalton (Da) for standard peptides

For example, BPC-157 has a theoretical molecular weight of 1419.53 Da. If the MS shows 1419.5 Da, that's a confirmed identity. If it shows 1385 Da or 1502 Da, something is wrong — you may be looking at a degradation product, a deletion sequence, or an entirely different molecule.

Endotoxin testing

Endotoxins are fragments of bacterial cell walls (lipopolysaccharides) that can contaminate peptides during manufacturing. They're invisible, odorless, and heat-stable — you can't see them, smell them, or boil them away. When injected, they trigger severe inflammatory responses including fever, hypotension, organ failure, and potentially death.^[7]

The test: The Limulus Amebocyte Lysate (LAL) assay, standardized under USP ⟨85⟩, detects endotoxin contamination.^[7] Results are reported in Endotoxin Units per milliliter (EU/mL).

There is no single "acceptable" number, and that is the important part. An earlier version of this guide printed a fixed limit of 0.5 EU/mL for general injectables. That is not a real standard, and we have removed it.

The actual endotoxin limit is calculated per product, using the formula K/M:^[7]

So the limit depends on how much you inject and how much you weigh — not on the concentration alone. A result of 1 EU/mL might be well within limits for a small subcutaneous dose and well outside them for a large infusion. You cannot judge an endotoxin result without knowing the dose, which is why a bare EU/mL number on a COA, with no reference limit calculated for the product, tells you less than it appears to.

Why it matters: In October 2025 the FDA classified a Class I recall — its most serious level, reserved for products that may cause death or serious harm — for NAD+ injections from GenoGenix LLC. The affected lot tested at 3,360 EU/mL.^[4] To put that in perspective without inventing a threshold: for a 70 kg adult, the total endotoxin permitted from all sources in an hour is about 350 EU. A single millilitre of that lot carried roughly ten times that amount. Three patients were hospitalized with hypotension and uncontrollable shaking.

Sterility testing

Sterility testing confirms the absence of viable microorganisms — bacteria, fungi, and mold. The gold standard is USP ⟨71⟩, which involves incubating samples in growth media for 14 days and checking for microbial growth.^[8]

Like endotoxin testing, sterility testing is rarely included on gray-market COAs. Compounding pharmacies operating under USP ⟨797⟩ are required to perform sterility testing on their products.^[9] Gray-market vendors labeling products "Research Use Only" are not.

Amino acid analysis (AAA)

Amino acid analysis breaks the peptide down into its individual amino acids and measures their relative proportions. This confirms the peptide composition independently of HPLC and MS. It's less commonly included on standard COAs but adds another layer of identity verification.

Peptide content / net peptide weight

This is a frequently overlooked but important measurement. A vial labeled "5 mg" may contain 5 mg of total powder — but not all of that powder is peptide. Counterions (acetate, trifluoroacetate), water, and salts make up a portion of the total weight. Peptide content, typically expressed as a percentage, tells you what fraction of the powder is actually the active peptide.

A typical peptide content value ranges from 60–85%. If a vial contains 5 mg of powder with 75% peptide content, you actually have 3.75 mg of peptide.

Red flags on a COA

Knowing what a COA should contain makes it easier to spot the ones that fall short. Here are the most common warning signs.

Suspiciously round purity numbers

Real HPLC analysis produces values like 98.4%, 97.82%, or 99.13%.^[6] If the COA reads exactly "99.00%" or "98.00%," the number was likely typed rather than measured. Analytical instruments don't produce round numbers — people do.

Missing lot or batch number

A COA without a lot number cannot be tied to a specific production run. This means there's no way to verify that the document corresponds to the actual product you received. It could be a generic template applied to every shipment.

No chromatogram or mass spectrum

If the COA claims "99% purity by HPLC" but doesn't include the chromatogram, you're being asked to trust a number without the underlying data. A reputable lab will always include the raw analytical traces.

Generic template reused across products

If the COA for BPC-157 looks identical to the one for semaglutide — same layout, same fonts, same formatting, with only the peptide name swapped — it may be a mass-produced template rather than an actual analytical report. Legitimate labs produce documents with consistent branding but product-specific data and formatting variations.

No lab identification or contact information

An authentic COA names the testing laboratory, includes its address, and often lists accreditation numbers. A document from an anonymous "certified laboratory" with no way to contact them is not verifiable.

Missing endotoxin data for injectable products

For any peptide intended for injection, the absence of endotoxin testing is a serious omission. A clean HPLC trace means nothing if the product contains dangerous levels of bacterial endotoxins.^[7]

Purity claims without method details

A legitimate COA specifies the analytical method: the HPLC column type, mobile phase, gradient conditions, and detection wavelength. Vague statements like "tested for purity" without method details are a red flag.

Dates that don't add up

Check whether the manufacture date, test date, and expiration date are logically consistent. A COA with a test date before the manufacture date, or an expiration date 5 years out for a peptide with a 2-year shelf life, suggests the document was hastily assembled.

How to verify the testing lab

A COA is only as trustworthy as the laboratory that produced it. Here's how to check.

Check for ISO 17025 accreditation

ISO/IEC 17025 is the international standard for testing and calibration laboratories.^[10] It demonstrates that the lab has been independently audited for technical competence, equipment calibration, method validation, and quality management.

How to verify:

1. Find the lab's accreditation certificate number on their COA or website
2. Go to the website of the accrediting body (common ones include A2LA, ANAB, or national accreditation bodies)
3. Search the certificate number in their database
4. Verify the lab's name, address, accreditation scope, and certificate validity dates

The scope of accreditation matters. A lab might be ISO 17025 accredited for water testing but not peptide analysis. Make sure the accreditation covers the specific test methods listed on your COA.

GMP certification

For pharmaceutical-grade products, look for current Good Manufacturing Practice (cGMP) compliance. This indicates the facility follows FDA-level manufacturing and testing standards. Compounding pharmacies should comply with USP ⟨795⟩ (non-sterile) or USP ⟨797⟩ (sterile compounding).^[9]

Verify directly with the lab

If the COA lists a lab name, call them. A legitimate lab will confirm whether they tested a specific lot number and can verify the results. Some labs also run a report-lookup portal where you enter the report number or scan the QR code on the document and see the record the lab holds — Janoshik Analytical's public.janoshik.com works this way. Note what that gives you: confirmation that one specific report is genuine. It is not an aggregate database of market-wide results, and no lab we are aware of publishes one.

Fraudulent COAs sometimes list real lab names with fabricated results. Checking with the lab is the definitive step — and the Paradigm case is the reason it matters.^[3]

Third-party testing options

If you want to verify a product independently — rather than relying on the vendor's own COA — you have options.

Janoshik Analytical

• Location: Prague, Czech Republic
• Specializes in: Chemical analysis of peptides, steroids, and pharmaceutical compounds
• Methods: HPLC, LC-MS/MS, NMR spectroscopy
• How to submit: Ship a sample to their lab; results are typically returned within days
• Report lookup: Runs a portal at public.janoshik.com where you can confirm an individual report by number or QR code. It is a per-report verifier, not an aggregate results database
• Cost: Varies by test type; typically in the range of $50–150 per analysis
• Note: Janoshik is not ISO 17025 accredited, which limits its applicability in regulated clinical contexts. It is widely used in the research peptide community, but it publishes no aggregate statistics — so figures attributed to "Janoshik data" without a report number should be treated with caution

Finnrick

• What it is: A free testing service, not a laboratory. You ship a vial; Finnrick brokers it to a commercial partner lab for HPLC analysis and publishes the result
• Scope: 9,826 published lab tests across its vendor database as of August 2026^[1]
• Vendor ratings: Maintains a public vendor rating database. Ratings are percentages. Finnrick used letter grades until July 2026, when it retired them — so any letter grade you see quoted for a vendor is a historical figure that can no longer be checked at the source
• Endotoxin: A paid add-on rather than part of the standard protocol. Finnrick reported 8% of samples across 140 endotoxin tests through January 2026 showed endotoxin above trace amounts, and that sample is self-selected toward vials buyers already suspected^[2]
• Caveat: The database updates continuously. Any number taken from it is a snapshot and should carry the date you looked

When to seek third-party testing

• You're using a new vendor for the first time
• The vendor's COA raises any of the red flags described above
• You're working with an expensive or critical peptide where product failure has high consequences
• The product is intended for injection and the vendor COA lacks endotoxin data

---

---

Real-world contamination data

The abstract risk of contaminated peptides becomes concrete when you look at the testing data.

Forged paperwork

The clearest documented failure is not a purity number — it is the COA itself. The owner of Paradigm Peptides admitted to fabricating laboratory certificates so his products would appear independently verified, and investigators found that six compounds sold as SARMs in fact contained testosterone. He was sentenced to 70 months in federal prison in July 2026.^[3] For years, his customers were reading paperwork that showed high purity and third-party testing, and the paperwork was fiction.

That is the single strongest argument for everything in this guide. A COA you cannot trace back to the lab that issued it is a design file, not evidence.

Endotoxin contamination

Finnrick reported in February 2026 that 8% of samples across 140 endotoxin tests through January 2026 showed endotoxin above trace amounts.^[2] Read that carefully: endotoxin is a paid add-on, ordered mostly by buyers who already suspected something was wrong, so the figure describes suspect vials rather than the market. It is a signal that the hazard is real, not a contamination rate.

The FDA's October 2025 Class I recall of NAD+ injections from GenoGenix LLC — due to endotoxin levels of 3,360 EU/mL — demonstrates what happens when contaminated injectable products reach consumers.^[4] Three patients required emergency treatment.

Vendor quality collapse

Peptide Sciences, once one of the largest gray-market research peptide vendors in the United States, shut down in March 2026. At the time, Finnrick rated its retatrutide product an "E" — the bottom of a letter-grade scale Finnrick retired in July 2026 — across 37 samples. That grade can no longer be checked at the source. On Finnrick's current percentage scale, retrieved August 15, 2026, the vendor sits at 61% overall, with retatrutide at 56% across 41 tests and CJC-1295 at 17% across 11.^[1] The shutdown illustrates how independent testing can expose quality problems that vendor-supplied COAs obscure.

Compounding pharmacies vs. gray market

Not all peptide sources are the same, and the COA expectations differ significantly between them.

Compounding pharmacy COAs

Pharmacies compounding peptides under USP ⟨795⟩/⟨797⟩ are required to:^[9]

• Source Active Pharmaceutical Ingredients (APIs) from FDA-registered facilities
• Test each batch against USP monograph specifications
• Perform sterility testing (USP ⟨71⟩) for sterile preparations^[8]
• Perform endotoxin testing (USP ⟨85⟩) for injectable products^[7]
• Maintain lot traceability from API source through final product
• Document beyond-use dating based on stability data

A pharmacy COA should include the pharmacy name, lot number, compound identity, potency/assay results, sterility and endotoxin results, and the responsible pharmacist's sign-off.

Gray-market COAs

Products labeled "Research Use Only" (RUO) are not required to meet pharmaceutical manufacturing or testing standards. Their COAs typically include:

• HPLC purity and mass spectrometry data (when legitimate)
• Amino acid sequence confirmation
• Batch/lot number (when provided)

They typically do not include:

• Endotoxin testing
• Sterility testing
• Potency/assay confirmation against reference standards
• USP monograph compliance
• Chain-of-custody documentation

The practical difference

A compounding pharmacy COA backed by USP standards, FDA-registered API sourcing, and mandatory sterility/endotoxin testing provides a fundamentally different level of assurance than a gray-market COA — even when the gray-market COA looks impressive on paper. The regulatory framework around pharmacy compounding exists specifically because the testing itself, without oversight, is not enough.^[5]

A practical COA checklist

Use this checklist to evaluate any COA you receive. Not every item is equally critical, but more checkmarks mean more confidence.

Identity verification

1. The COA lists the peptide name and full amino acid sequence
2. The theoretical molecular weight is stated
3. Mass spectrometry data shows an observed MW matching the theoretical MW (within +/- 1 Da)
4. A unique batch/lot number is present and matches your product label

Purity data

5. HPLC purity percentage is listed with the method specified (column, gradient, wavelength)^[6]
6. The actual HPLC chromatogram is included (not just the number)
7. The chromatogram shows a single dominant peak with minimal secondary peaks
8. Purity is above 95% for research-grade applications

Safety testing (critical for injectables)

9. Endotoxin testing results are reported (LAL assay, result in EU/mL)^[7]
10. Endotoxin level is below 0.5 EU/mL
11. Sterility testing results are reported (USP ⟨71⟩ or equivalent)^[8]

Lab credibility

12. The testing laboratory is named with full contact information
13. The lab has ISO 17025 accreditation (or equivalent) — verified in the accrediting body's database^[10]
14. The COA can be verified directly with the lab (call or check their online database)

Document integrity

15. Manufacture date, test date, and expiration date are all present and logically consistent
16. The document does not use suspiciously round purity numbers (exactly 99.00%, 98.00%)
17. The COA is specific to this product — not a generic template with the peptide name swapped in
18. A responsible analyst or quality officer is identified by name or signature

The bottom line

A COA is not a seal of approval — it's a set of claims that can be verified. The peptide market includes excellent vendors who invest in rigorous testing and documentation. It also includes vendors who photoshop purity numbers onto template PDFs. The difference between the two is not visible from a website's marketing page. It's visible in the details of the COA.

A federal court has now established that at least one major vendor forged its COAs outright.^[3] That is the whole case for "trust but verify" — not a statistic, a conviction. Learn to read the document, check it with the lab that supposedly issued it, and when the stakes are high, get an independent test.

---

Related content

Tool

COA Checklist and Red-Flag Checker

Score a certificate of analysis against lot specificity, test methods, and injectable-relevant signals.

Guide

How to Evaluate a Peptide Clinic

A scorecard for evaluating telehealth providers and compounding pharmacies — with red flags to watch for.

Guide

How to Reconstitute Peptides

A safety-first guide to preparing lyophilized peptides, from equipment to technique.

News

What Happened to Peptide Sciences

The largest gray-market vendor shut down. What it means for product quality and vendor trust.

Peptide

BPC-157

The most-discussed research peptide. COA verification is especially important for gray-market compounds.

Peptide

Sermorelin

A commonly purchased peptide where COA quality directly reflects vendor reliability.

References

1. [1]

   Finnrick. “Independent peptide testing and vendor safety rankings.” 2026. Link

   Free-testing service that brokers customer-submitted samples to commercial partner labs, then publishes vendor ratings. It is not itself a laboratory and is not ISO 17025 accredited. The database updates continuously, so any figure drawn from it needs a retrieval date. Retrieved August 15, 2026.

2. [2]

   Finnrick. “Why Endotoxin Testing Matters for Peptides.” 2026. Link

   Published February 6, 2026. Reports that 8% of samples across 140 endotoxin tests through January 2026 showed quantifiable endotoxin above trace amounts. Endotoxin is a paid add-on, so the sample is self-selected toward products buyers already suspected.

3. [3]

   U.S. Attorney's Office, Northern District of Indiana. “Illinois Man and Indiana Woman Sentenced Respectively to 70 Months and 16 Months in Prison For Selling Unapproved Drugs in Interstate Commerce.” 2026. Link

   DOJ press release, July 30, 2026. The owner of Paradigm Peptides admitted to forging laboratory certificates used to represent purity; products sold as SARMs were found to contain testosterone.

4. [4]

   U.S. Food and Drug Administration. “Class I recall: NAD+ for Injection (GenoGenix LLC) — elevated endotoxin levels.” 2025. Link

   Class I recall (most serious). Lot #GG121624-023 tested at 3,360 EU/mL. Three patients hospitalized with hypotension and uncontrollable shaking.

5. [5]

   U.S. Food and Drug Administration. “FDA's concerns with unapproved GLP-1 drugs used for weight loss.” 2025. Link

   FDA safety communication documenting adverse events from compounded semaglutide and tirzepatide, including dosing errors requiring hospitalization.

6. [6]

   Mant CT, Chen Y, Yan Z, Popa TV, et al.. “HPLC analysis and purification of peptides.” Methods Mol Biol. 2007. 386:3–55 PubMedReview

   Foundational reference on reversed-phase HPLC methods for peptide purity analysis. Verified against PubMed on August 15, 2026; an earlier version of this guide cited this PMID with the wrong author, volume, pages, and year.

7. [7]

   United States Pharmacopeia. “USP General Chapter ⟨85⟩ Bacterial Endotoxins Test.” 2025. Link

   Pharmacopeial standard defining the LAL assay and the K/M calculation for endotoxin limits in injectable products. K is 5.0 EU/kg/hour for IV or IM administration and 0.2 EU/kg/hour for intrathecal; M is the maximum dose per kg per hour. The limit is product- and dose-specific, not a fixed concentration.

8. [8]

   United States Pharmacopeia. “USP General Chapter ⟨71⟩ Sterility Tests.” 2025. Link

   Pharmacopeial standard for sterility testing of pharmaceutical products. Requires 14-day incubation in two growth media.

9. [9]

   United States Pharmacopeia. “USP General Chapter ⟨797⟩ Pharmaceutical Compounding — Sterile Preparations.” 2025. Link

   Standard governing sterile compounding practices, including required testing, personnel training, and facility requirements.

10. [10]

    International Organization for Standardization. “ISO/IEC 17025:2017 — General requirements for the competence of testing and calibration laboratories.” 2017. Link

    International standard for laboratory competence. Covers personnel, equipment, method validation, and quality management.

11. [11]

    U.S. Food and Drug Administration. “Warning Letter — GLP-1 Solution, Inc. (MARCS-CMS 715883), issued September 9, 2025.” 2025. Link

    One of 58 warning letters issued the same day under the subject 'Unlawful Sale of Unapproved and Misbranded Drugs to United States Consumers Over the Internet (Telehealth).' Recipients were telehealth companies, online sellers, and med spas rather than compounding pharmacies.

---