How to Read a Peptide Certificate of Analysis (And Spot a Fake)
A COA is only useful if you know what to look for — and what vendors are hoping you'll miss.
Why COAs Matter
A Certificate of Analysis is supposed to be proof that a peptide product has been tested and meets quality specifications. In a market where published testing data shows 30% of grey-market peptides contain the wrong molecule and 65% exceed endotoxin safety thresholds (Rohrbough et al., Drug Testing and Analysis, 2020), a legitimate COA is one of the few pieces of evidence a consumer can use to assess product quality.
But not all COAs are legitimate. And even legitimate ones require interpretation.
The Five Essential Tests
1. HPLC Purity (High-Performance Liquid Chromatography)
What it measures: The percentage of the sample that is the intended peptide vs. impurities (truncated sequences, deletion sequences, oxidized forms).
What to look for: Purity ≥98% is the standard benchmark. Look for the actual chromatogram — a graph showing peaks. The main peptide should appear as a single, dominant peak. Smaller peaks represent impurities.
Red flag: A COA that states “98% purity” without showing the actual chromatogram. The graph is the evidence; the number alone is just a claim.
2. Mass Spectrometry (MS or LC-MS)
What it measures: The molecular weight of the compound. This confirms the peptide’s identity — that it is actually the molecule it claims to be.
What to look for: The observed mass should match the theoretical mass of the target peptide within standard instrument tolerance (typically ±1-2 Da). For BPC-157, the expected mass is approximately 1,419.5 Da. For TB-500 fragment, approximately 847-889 Da.
Red flag: No mass spec data on the COA. HPLC tells you how pure the sample is, but mass spec tells you what the sample actually is. Without both, you can’t know if you have a pure sample of the right molecule or a pure sample of the wrong one.
3. Endotoxin Testing (LAL Test — for injectables)
What it measures: Bacterial endotoxins (lipopolysaccharides from gram-negative bacteria) that can trigger severe immune responses including fever, sepsis, and organ failure.
What to look for: Results in EU/mL (Endotoxin Units per milliliter). The USP limit for injectable products is typically <5 EU/kg of body weight per hour. For a reconstituted peptide, levels should be reported as below a specific threshold.
Red flag: No endotoxin test on a product intended for injection. This is the most critical safety test for injectables, and it’s the one most often missing. Chemical purity does not equal sterility — a 99.9% pure peptide can be loaded with endotoxins. And importantly, a 0.22-micron sterile filter does NOT remove endotoxins (they are too small).
4. Heavy Metal Screening
What it measures: Contamination with lead, mercury, arsenic, cadmium, and other toxic metals from manufacturing equipment or raw materials.
What to look for: Results for at least lead, mercury, arsenic, and cadmium, reported in ppm (parts per million). All should be below USP limits.
Red flag: Missing entirely from the COA, or reported as “pass” without specific values.
5. Residual Solvent Analysis
What it measures: Leftover solvents from the manufacturing process (acetonitrile, TFA, DMF, etc.) that can be toxic above certain levels.
What to look for: Specific solvent names and quantities, all below ICH Q3C limits.
Red flag: Missing from COAs, especially for peptides manufactured in unregulated facilities.
How to Spot a Fake COA
Grey-market peptide vendors sometimes fabricate or reuse COAs. Here’s what to check:
No verification key or QR code: Legitimate testing labs increasingly include unique verification codes that can be checked against their database. Janoshik Analytical, considered the “gold standard” in the community, uses QR-code-verified COAs. If the COA lacks any way to independently verify it, treat it with skepticism.
Same COA used for months: Each manufacturing batch should have its own COA. If a vendor uses the same document for different batches or over many months, the COA may be legitimate for the original batch but meaningless for what you’re actually receiving.
Missing chromatogram images: A COA that lists purity numbers without the actual HPLC chromatogram or mass spectrum is a claim, not evidence. Generating fake numbers is trivial; generating fake chromatograms that would fool an analytical chemist is harder (though not impossible).
Untraceable lab name: Look up the testing lab. Legitimate analytical labs have websites, contact information, and professional credentials. If you can’t find the lab, the COA is suspect.
COA date older than 3–12 months: Testing is batch-specific. A COA dated a year ago doesn’t tell you anything about the current product.
Round numbers for everything: Real analytical results have decimal points and slight imperfections. A COA showing exactly 99.0% purity, exactly 0 endotoxin, and exactly 0 heavy metals across the board looks more like a template than a real test result.
Reputable Testing Labs
The following labs are generally considered credible by the analytical and research chemical communities:
- Janoshik Analytical: Widely regarded as the “gold standard” for independent peptide/SARM testing. QR-code-verified COAs. Czech Republic-based.
- Chromate: US-based analytical testing
- MZ Biolabs: Peptide and biological testing
- Finnrick Analytics: Has tested 5,160 samples from 173 vendors — the largest known independent testing database
Cost: Independent third-party testing typically runs $100–350 per sample. If you’re spending $150/month on peptides and want verification, testing one batch provides significant peace of mind.
What a COA Cannot Tell You
Even a perfect COA has limitations:
- It doesn’t prove the product was stored correctly after testing — heat, light, and moisture degrade peptides
- It doesn’t test every vial/capsule — only the specific sample sent to the lab
- It doesn’t guarantee the vendor didn’t switch products between the tested batch and what they ship you
- It doesn’t measure biological potency — only chemical identity and purity
- It doesn’t test for every possible contaminant — only the specific tests performed
The Bottom Line
A COA is the minimum transparency standard — any vendor that doesn’t provide one for every product batch is not worth your money or your trust. But a COA is also not a guarantee. The most protective approach is: (1) buy from vendors that publish batch-specific COAs from named labs, (2) verify the COA with the testing lab when possible, and (3) if you’re investing significant money in peptides, consider sending one sample for independent testing. At $100–350, it’s a small price for knowing what you’re actually putting in your body.