How to spot a fake peptide COA
The nine warning signs we have found on peptide certificates of analysis, how to check each one yourself, and how often each appears in our data. For what each field means, start with how to read a peptide COA. Research use only; nothing here is medical advice.
- Certificates on file
- 1,836
Certificates on file
- Posted copies that differ from the lab's
- 37
Posted copies that differ from the lab's
- Lab lookups that passed our control
- 27
Lab lookups that passed our control
The 60-second checklist
- Open the lab's lookup yourself and find the report by its code.
- Change one character of the code: the lookup should now find nothing.
- Compare client, product, amount, lot, dates, purity and quantity with the lab's copy.
- Read every result row for fail, not detected or an under-filled quantity.
- Check the date: more than 12 months old, or undated, means old stock.
- Look for mass spectrometry (LC-MS, MS) on the identity row.
- Check the lab on our lab directory, and that it is not tier D.
Every vendor's certificates are scored under the same published rule; see How we rate and the lab directory.
Nine red flags, and how to check them
Each sign below is one we have recorded in our own audits. The counts are read from our data when the site is built and cover the vendors currently listed. A red flag is a reason to check further, not proof that a report is false.
The report cannot be found at the issuing laboratory, or any code finds a result
What it looks like: A certificate with a verification code is only as good as the laboratory's lookup. A copy that the lab has no record of cannot be confirmed, and a lookup that returns a report for any code you type proves nothing at all.
How to check it yourself: Open the lookup on the laboratory's own domain (type the address yourself rather than following the seller's link) and enter the code exactly as printed. Then run the control: change one character and look it up again. A genuine lookup returns the report for the real code and nothing for the invented one. Two examples: Freedom Diagnostics serves each report at coas.freedomdiagnosticstesting.com/<search code>.pdf, which returns the PDF for a real code and a 404 (not found) for an invented one; Janoshik reports carry a task number and a key, and an invented key returns an empty page. Step-by-step guides for every laboratory we have confirmed certificates with are listed on how to read a peptide COA.
In our data: 27 of the 37 graded laboratories in our directory passed this control when we ran it (check L3); 8 run no usable lookup at all. We record 26 scored certificates whose printed key was not found at the laboratory.
The client is a different company, or the lab's copy names a different client
What it looks like: The client field says who sent the sample in. A report issued to another business (often a supplier or another store) describes that business's sample. A sharper version: the laboratory's own record names one client, and the PDF on the store's page names the store.
How to check it yourself: Read the client field on the posted copy, then compare it with the client on the copy you open at the laboratory's lookup. They should be the same business, and it should be the vendor selling the product.
In our data: 18 listed vendors carry the SUPPLIER adjustment for certificates issued to another business, and 24 posted copies name a different client from the laboratory's own record, which scores 0 under rule A4.
The same analysis appears for several vendors or products
What it looks like: One analysis describes one sample. When the same sample ID, chromatogram, results or verification key turn up on several stores' pages, or on pages for different products, at most one of them can be the sample it describes.
How to check it yourself: Note the sample or report ID and the exact purity and quantity figures, then search for them. Look up the code at the laboratory and see which client and product its own record names. A chromatogram image that is pixel-for-pixel identical on two different reports is the same run.
In our data: Our adjustment records describe a reused or re-issued analysis (the same analysis issued first to one business and then to another, or one product's key shown on other products) for 7 listed vendors.
The certificate prints a failed result but is shown as proof of quality
What it looks like: Some posted certificates, read closely, report an identity failure (the sample was not the labeled compound) or a fill far below the label, while the page presents them as evidence of quality.
How to check it yourself: Read every result row, not just the purity figure. Look for the words fail, not detected or does not conform, an identity row naming a different compound, and a measured quantity well below the label amount.
In our data: 4 scored certificates print a failed result and 1 has a failed result on the laboratory's own record, across 3 vendors. Each scores 0 under rule A4.
The lot or batch is missing, or does not match the product sold
What it looks like: The lot number is what ties a report to the vial in front of you. A certificate with no lot cannot be matched to a batch, and one lot label printed on certificates for several different compounds is not a real per-batch lot.
How to check it yourself: Compare the lot on the certificate with the lot on the vial or the product page. Check whether the same lot appears on certificates for other compounds from the same store.
In our data: 28 listed vendors carry the LOT adjustment for one lot label printed on certificates for different compounds.
The certificate is more than 12 months old
What it looks like: An old report may describe stock that sold out long ago. It is not false by being old, but it says little about the batch on sale today.
How to check it yourself: Find the received or tested date on the report (not the date the page was updated). Treat a certificate with no date at all as old.
In our data: 92 scored certificates across our listings are more than 12 months old or undated (rule A6).
Identity is tested by retention time only, not mass spectrometry
What it looks like: HPLC retention time shows that something came off the column at the same time as a reference standard. A different compound can do the same. Mass spectrometry (LC-MS or MS) measures the mass of the molecule itself, which is much harder to match by accident.
How to check it yourself: Find the identity row and the method. LC-MS, MS, MALDI or an observed mass that matches the expected mass is mass spectrometry. "Retention time", "RT", "conforms to reference" or HPLC alone is not.
In our data: 14 graded laboratories identify by retention time or another non-mass-spectrometry method only, which passes check L4 only partly and caps the laboratory at tier B+. 659 of the 1,836 certificates on file come from them.
The laboratory is not independent of the vendor, or cannot be identified
What it looks like: A certificate from a laboratory that is in effect one vendor's own operation, or that no one can identify, carries no outside assurance. Warning signs: no company name, street address or named staff; a website registered after the reports it serves; every report naming the same client; or a lookup that runs on a vendor's site.
How to check it yourself: Look the laboratory up independently: a business registry entry, a real street address with named staff, and the date its domain was registered compared with the dates on its reports. Check whether its reports name more than one unrelated client or whether it offers testing to the public.
In our data: Check L1 (a real business) and L2 (independence) must both pass. 10 laboratories in our directory fail one of them and sit at tier D. 133 scored certificates come from a laboratory whose independence is not established and score a flat 2.0 (rule A3), as do 21 self-issued certificates and 19 that name no laboratory. Tier D records that independence or existence is not established; it is not a finding that a report is false.
The document has been edited
What it looks like: Signs of an altered PDF include text in a different font, size or alignment from the rest of the report; a header that disagrees with the body (for example a 50 mg heading on a report for an 80 mg product, later reissued); a quantity, date or client that differs from the laboratory's own copy; and results that do not match the chromatogram.
How to check it yourself: Open the laboratory's copy and compare every field: product, amount, lot, client, dates, purity and quantity. Zoom in on figures that matter; edited values often sit slightly off the line or in a different typeface.
In our data: 37 posted copies from 7 vendors differ materially from the laboratory's own record (24 in the client, 10 in the test date, 2 in the quantity, 1 in another field), and each scores 0 under rule A4.
The rule numbers (A3, A4, A6) and laboratory checks (L1 to L6) are defined on How we rate. Each vendor's review lists the certificates behind its lab score.
Spotting a Fake COA: Frequently Asked Questions
How can I tell if a peptide COA is fake?
Look the report up at the issuing laboratory's own website using the code printed on it, then compare every field (client, product, amount, lot, dates, purity and quantity) with the copy the seller posted. Run a control by changing one character of the code: a real lookup should then return nothing. A report the lab has no record of, or one that differs from the lab's copy, cannot be relied on.
What does it mean if an invented code also returns a report?
It means the lookup does not discriminate between real and made-up codes, so a result from it confirms nothing. Peptide Source Review grades a laboratory's verification route (check L3) only after confirming that a real key returns the report and an invented key is rejected on the same day.
Is a COA issued to a different company fake?
Not necessarily, but it describes another business's sample. Suppliers and manufacturers often test a batch before it is resold. Peptide Source Review applies the SUPPLIER adjustment to such certificates, and a posted copy whose client differs from the laboratory's own record scores 0 under rule A4.
Why is HPLC retention time weaker than mass spectrometry for identity?
Retention time only shows that a sample came off the column when a reference did, which a different compound can also do. Mass spectrometry measures the molecule's mass. A laboratory that confirms identity by retention time alone passes check L4 only partly and is graded no higher than tier B+.
How old is too old for a peptide COA?
Peptide Source Review treats a certificate more than 12 months old, or with no date, as aged under rule A6: it still counts, but a quarter of its weight comes off the vendor's lab sub-score, because it may describe stock that is no longer on sale.
Does a genuine COA mean a peptide is safe to use?
No. A certificate describes the identity, purity and contents of one tested research sample. It is not evidence of safety or effect in people, and the products discussed on this site are sold for laboratory research use only.