What does a peptide certificate of analysis show, and how do I tell a real one from a fake?

The short answer

A certificate of analysis (COA) is the single most useful document for reducing peptide sourcing risk — but only if you know what a real one shows and can spot the fakes, which are common.

Evidence tier: This is Tier 2 — established analytical-chemistry methodology (mass spectrometry, HPLC, endotoxin testing). The methods are standard lab science; the only question is whether a given COA actually applied them honestly to your batch.

What a trustworthy COA proves, at a glance:

• Identity — mass spectrometry confirms the molecule is what the label claims
• Purity — HPLC reports the percentage that's the target peptide (aim for ≥98%)
• Provenance — a named independent lab, the specific batch/lot, and a recent date
• Bonus — sterility and bacterial endotoxin testing

If a COA is missing identity, purity, batch, date, or lab name, it's incomplete. This guide is part of our peptide safety & sourcing guide.

What identity testing (mass spec) tells you

Evidence tier: 2 — mass spectrometry is the standard identity method.

Mass spectrometry measures the molecular weight of the compound in the vial. Every peptide has an expected molecular weight; the COA should show a measured mass that matches it (within a small tolerance). This is what confirms you have the right peptide and not a different, cheaper, or inactive compound.

What to check: the COA states the expected mass and the found mass, and they agree. A COA that asserts identity without showing the mass-spec result is asking you to take its word for the most important fact.

What purity testing (HPLC) tells you

Evidence tier: 2 — HPLC is the standard purity method.

HPLC (high-performance liquid chromatography) separates the sample into its components and reports what fraction is the target peptide versus impurities. The headline number is a purity percentage.

The practical floor is 98%. Research-grade peptides commonly test 95–99%; 98%+ is a reasonable bar. Two cautions:

• A COA with no purity figure at all is a non-starter.
• A bare "99.9%" with no chromatogram (the actual graph) attached is less trustworthy than a 98.2% that shows its work. The chromatogram lets you see whether there's a clean single peak or a mess of impurity peaks.

How do I tell a real COA from a fake?

Evidence tier: 2 — document-authentication principles.

Fake or worthless COAs are common because they're easy to produce. The tells:

• No independent lab named. A real COA identifies the testing lab. A PDF with only the vendor's logo and no lab identity is just marketing.
• Batch/lot doesn't match your vial. The COA's batch number should match the label on what you received. A generic COA "for this product" rather than for your batch tells you nothing about your vial.
• No date, or an old date. Testing should be recent and tied to current stock.
• Reused chromatograms. The same graph appearing across different products or batches is fabrication.
• Unverifiable lab. Bonus trust if the lab is real, reputable, and contactable.

The strongest signal is an independent, well-known testing lab with a batch-matched, dated report. See our how to verify a peptide vendor for the vendor-level checks, and our vendor trust-score directory where COA transparency factors into the scores.

What about sterility and endotoxin?

Evidence tier: 2 — sterility and endotoxin testing are standard for injectables.

Identity and purity tell you what the peptide is. They don't tell you whether it's safe to inject. For anything going under the skin, sterility (no microbial growth) and bacterial endotoxin testing matter, because contamination can cause injection-site infections or systemic reactions even when the peptide itself is correct and pure.

Most gray-market COAs stop at identity and purity. A COA that also reports sterility and low endotoxin is a meaningfully stronger document — though, as always, it certifies a tested sample, not your individual vial.

What a COA can't do

Evidence tier: 2 — limits of batch testing.

A COA confirms that a tested sample from a batch met specification at the time of testing. It cannot guarantee that your specific vial is identical, that storage and shipping didn't degrade it, or that nothing went wrong after the test. Quality varies within and between batches.

That's not a reason to skip it — a batch-matched, recent, independent COA dramatically reduces risk versus none. It's a reason to treat it as strong evidence rather than a guarantee, and to combine it with the other safety steps in our sourcing guide.

A step-by-step COA verification walkthrough

Evidence tier: 2 — practical application of the analytical methods above.

Reading a COA well is a repeatable process, not a vibe. Work through it in order, and stop the moment something fails:

1. Find the batch/lot number first. Before reading anything else, confirm the COA's batch matches the label on the vial you received (or the batch the vendor says they're shipping). A COA for a different batch — or a generic "product" COA with no lot — tells you nothing about your vial, no matter how good the numbers look. 2. Check the date. Testing should be recent and tied to current stock. A COA from two years ago doesn't describe what's in production now. 3. Identify the lab. Look for a named, independent testing laboratory — not the vendor's own name or logo. Bonus confidence if the lab is reputable, has a real web presence, and can be contacted to confirm the report. 4. Read the mass-spec result. Confirm the COA states both the expected molecular weight and the measured (found) mass, and that they agree within a small tolerance. This is your identity proof. 5. Read the HPLC purity and look at the chromatogram. Confirm the purity figure (aim ≥98%) and, crucially, that an actual chromatogram is attached. A clean single dominant peak is good; a forest of smaller impurity peaks is a warning even if the headline number looks high. 6. Check for sterility and endotoxin (for injectables). Their presence is a meaningful upgrade; their absence is common but means identity/purity is all you've confirmed. 7. Cross-check against independent testing. If a third-party service has tested this vendor's products off the shelf and agrees, that's the strongest confidence short of a regulated product.

If any step fails — missing batch match, no lab, no chromatogram, stale date — the document hasn't done its job, regardless of how reassuring the rest looks. A single strong-looking purity percentage is the easiest thing on the whole page to fabricate, which is exactly why the batch, lab, date, and chromatogram matter more than the number itself.

A final habit worth building: keep the COA. Save the PDF alongside the batch you're using, so that if you later experience an unexpected reaction or result, you have the documentation to review and to share with a clinician. Treating each batch as something you can trace, rather than an anonymous vial, is part of doing this as safely as the gray market allows.

What if a vendor won't share a batch COA?

Evidence tier: 2 — practical inference from the verification logic.

This question answers itself more often than people realize. If a vendor can't or won't provide an independent, batch-matched COA for the specific product you'd receive, that refusal is the information. A seller genuinely investing in quality testing has every incentive to show it off, because it's their best differentiator; a seller who tests well rarely hides it. So "we don't share COAs," "COAs are available on request" that never materializes, or a generic document that doesn't match your lot should all be read as a quiet "no" to the only question that matters.

The trap to avoid is letting other reassurances substitute for the missing document — a long testimonial wall, a confident "pharma-grade" claim, or a polished site can make the absence of a real COA feel less important than it is. It isn't. The batch-level, independent COA is the load-bearing evidence; everything else is context. When it's missing, the honest conclusion is that you can't verify what's in the vial, and the safe response is to treat that vendor as unverified regardless of how good everything else looks. Walking away from an unverifiable source is cheaper than discovering the problem after you've injected it.

Limitations

This is an educational guide, not medical advice or an endorsement of unregulated products.

• A COA reduces risk; it doesn't eliminate it — it certifies a sample, not your vial.
• The safest option is a regulated product under medical supervision, which removes the sourcing question entirely.
• COA literacy doesn't make self-injection safe — sterile technique and dosing accuracy still matter.
• Marko Maal, MSc Pharmacy reviewed this article. Reviewer attribution does not constitute a doctor-patient relationship.

The bottom line

A real COA shows identity by mass spec, purity by HPLC (≥98%, with the chromatogram), a named independent lab, and a batch number that matches your vial, dated recently — ideally with sterility and endotoxin testing too. A vendor-printed PDF with no lab, no batch match, or a reused chromatogram is worthless. Reading the COA correctly is the highest-leverage skill in gray-market sourcing, but it certifies a batch, not a guarantee.

One last framing worth internalizing: a COA is a claim someone is making about a product, and like any claim it can be honest, sloppy, or fabricated. Your job isn't to admire the numbers — it's to interrogate the provenance. Who tested it, when, which batch, and can you see the raw chromatogram? A seller motivated to move product has every incentive to produce a reassuring-looking document; an independent lab testing a specific batch has no such incentive. That difference in incentive is, in the end, what you're really evaluating when you read a COA. Treat the lab's identity and the batch match as the load-bearing facts, and the headline purity number as the thing they make trustworthy — not the other way around.

Related on this site

• Peptide safety & sourcing guide
• How to verify a peptide vendor
• Peptide reconstitution and dosing guide
• Vendor trust-score directory
• How we score vendor trust
• Finnrick vendor testing

References

• Vanhee C, Janvier S, Desmedt B, et al. 2015. Analysis of illegal peptide drugs via HILIC-DAD-MS. Talanta. 142:1-10. PMID 26003687 — identity/purity analysis of illicit peptides.
• Sharma SK, et al. 2014. Reversed-phase HPLC methods for the analysis of peptide purity. J Chromatogr A. PubMed search — HPLC purity methodology overview.
• United States Pharmacopeia. USP <85> Bacterial Endotoxins Test. USP.org — endotoxin testing standard for injectables.
• U.S. Food and Drug Administration. Research use only products labeling. FDA.gov — meaning of RUO labeling.