How to verify a peptide COA: a 6-step check that works for any lab

Verify a peptide COA in six steps

A COA (certificate of analysis) is only as good as the lab record behind it. The check below works for any lab that keeps a lookup on its own website. Do the steps in order and stop at the first mismatch.

1. Find the lab named on the COA and type its web address yourself.
2. Open the lab’s lookup page and enter the report number and key.
3. Match the lab’s copy against yours, field by field.
4. Check that the dates run in a possible order.
5. Compare the lab’s vial photo with the vial you hold.
6. Compare the file fingerprint, where the lab offers one.

If the lab has no lookup page, skip to the section on labs without a lookup. If you want to judge what the numbers mean, read how to read a COA after you have confirmed the document is real.

Step 1: Type the lab’s address yourself

Do not start from the QR code or the link printed on the COA. A QR code is a link chosen by whoever made the document. A forged COA can point to a copied site on a look-alike domain, with one letter changed or a different ending.

Find the lab’s site through a search engine or a rating site’s lab page, then bookmark it. Check that the domain on the lookup page is the same one the lab uses for the rest of its site.

Step 2: Enter the report number and key

Most lookups ask for two values: a report number and a key (also called an access code). The key matters. A report number alone is often short or sequential, so anyone can guess the next one. A long random key cannot be guessed.

In HK Analytical’s September 2026 review of public COAs from 25 labs and one rating site’s certificate wrapper, 12 linked to a copy hosted by the lab. Only 6 used access codes that could not be guessed or worked through in sequence. Some labs run an open public database instead, searched by company name. That still works for verification, as long as the record you find matches your copy.

Step 3: Match the record field by field

The lab’s copy wins over the seller’s copy. Compare every field, and treat any difference as a reason to stop.

Field	What to compare	What a mismatch usually means
Report number	Every character	A different report, or a made-up number
Product and label claim	Peptide name and stated mg	A report for another product or strength
Batch or lot	The lot printed on your vial	A report for another batch
Client or seller	The name on the lab’s record	A report someone else ordered
Results	Each number, unit and decimal	An edited copy
Status	Valid, replaced or withdrawn	An old or withdrawn result

Fields such as product name, lot and label claim usually come from the client, not the lab. ISO/IEC 17025 clause 7.8.2.2 asks labs to mark client-supplied information and to state that results apply to the sample as received. A lab record that shows a different lot from your vial tells you the report covers a different batch. We do not hold ISO/IEC 17025 accreditation.

Step 4: Check the dates

Dates must follow a possible order: received, then tested, then issued. A test date before the receipt date points to a template or an edited file. A sterility result issued less than 14 days after receipt cannot be a full USP <71> test, because that method incubates for at least 14 days.

Also look at the age of the report. A COA from many months ago says little about a batch the seller says is new.

Step 5: Compare the vial photo

A photo taken by the lab when the sample arrived ties the report to a physical vial. Compare the cap colour, the crimp, the label text, the printed lot and the fill level with the vial you hold. A photo with the lab’s own sample label in the frame is stronger than a plain product shot. A seller’s product render is not evidence.

Step 6: Compare the file fingerprint

A file fingerprint is a SHA-256 hash: a 64-character hexadecimal code computed from every byte of the file. Change one character and the code changes completely. Re-saving the PDF or printing it to a new PDF also changes it, even when the text looks the same.

Some labs let you check this. In our September 2026 review, 6 of the 26 offered either a hash check or a lab copy that was byte-for-byte identical to the copy sellers posted.

How the lookup works at six labs buyers often use

These are the verification routes each lab publishes. They were checked in September 2026 and can change, so confirm on the lab’s own site.

Lab	How to check a report	What you need
Janoshik	Verification page on janoshik.com, or the QR code on the report	Task number and unique key
Freedom Diagnostics	Public lookup that lists a company’s reports, plus a QR code to the PDF	Search code or company name
Vanguard Laboratory	Search on verifiedbyvanguard.com, for reports the client has made public	Report number
Krause Analytical	Upload form on krauselabs.com; the lab replies by email	The original PDF from the seller
MZ Biolabs	QR code with a human-readable ID on 2026 reports; no public lookup page on the lab’s site when checked	The QR code on the report
Testides	Lookup on testides.com/verify, which shows the recorded results, chromatogram and vial photo	The full report number

Each route has strengths. A key-based lookup stops strangers from finding reports. A public database helps buyers compare a seller’s history. A hash upload proves the exact file. Krause’s form notes that screenshots or transposed documents cannot be validated, which is good advice for any lab: always ask the seller for the original file.

When the lab has no lookup page

Some labs confirm reports only by email. Send the PDF to the contact address published on the lab’s own website, never to an address printed on the COA. Ask the lab to confirm the report number, product, lot, client and results.

Rating sites record this gap. Peptigrity gives each certificate a status, and one of them is “Lab has no portal”. PeptideBenchmark records, for each lab, the share of COAs that carry a working lab lookup link. In its registry in October 2026, three labs had a lookup link on every COA, while several others had no automated lookup sample at all.

“COA verification failed”: what it means and what to do

A failed lookup means the lab’s system found no record that matches what you entered. Work through the causes in this order:

1. A typing error. Look-alike characters (O and 0, I and 1, S and 5) cause most failures.
2. A key from a different report. Sellers sometimes post the key of an older batch.
3. A replaced or withdrawn report. Some lookups show a status. Others simply return nothing.
4. A document the lab never issued. If the lab confirms it has no such record, do not rely on the COA.

Failed checks are not rare. In a sweep on 23 May 2026, Disclosed Labs checked 2,252 COAs across 8 lab portals, and the labs confirmed 2,092 of them (92.9%). The rest could not be confirmed at the source. That is about 1 in 14.

What a verified COA still does not prove

Verification proves who issued a document and that it was not changed. It does not prove three other things:

• That your vial matches. The lab tested the vial it received. Your vial may come from another batch, or have been stored differently. Our guide on vendor COAs versus testing your own vial covers when this matters.
• That the numbers are right. A genuine report can still show weak evidence. Check how identity, purity and content were measured.
• That the report was meant for this seller. A real report shown by the wrong seller is a reused COA. See how reused COAs happen and the signs of a forged or weak COA.

How to verify an HK Analytical report

Every HK Analytical report has a private link made of a report ID and an access key. Enter both on hkanalytical.com/verify, or scan the QR code on the report. The report page shows the status (valid, superseded or withdrawn), the sample and results, how the client is related to HK Analytical, the PDF and its fingerprint, and every version with the reason for each change.

On the same page your browser can compute the fingerprint of a PDF you were given. The file never leaves your device. Each report is also a signed record (an Ed25519 signature over the canonical record), and our public keys are published at hkanalytical.com/.well-known/hk-coa-keys.json. Our guide to signed COAs explains what that adds. There is no search and no list, so only people with the ID and key can open a report. You can try the check with the ID and key of our example report.