How to Verify a Peptide COA

Three semaglutide vials bought online, each labeled around 99 percent pure, came back at 7.7, 9.0, and 14.4 percent actual purity when a lab ran them (PMID 39509151). Every one held more active drug than the label claimed, by 28 to 39 percent, and all three carried measurable bacterial endotoxin. That 2024 analysis in the Journal of Medical Internet Research is a clean snapshot of the research-peptide gray market, where the label and the reality often have little to do with each other.

For research-grade products, a Certificate of Analysis from an independent lab is the only way to confirm a vial's identity and purity. FDA does not check these products. A certificate only helps if you know how to read one and, more important, how to verify it.

This guide covers both, and builds on the storage, sourcing, and safety guide rather than repeating it.

Most of these compounds ship with a label saying they are for research, not for people. That label is a seller's label, not an FDA category or approval route. The rule often cited for it, 21 CFR 809.10, covers in vitro diagnostic products, not injectable peptides. FDA has not reviewed these vials, and the sellers are not inspected as drug makers. So the pharma-grade guardrails (Good Manufacturing Practice, sterility and endotoxin release testing) are missing in practice.

Regulators have been active here. A June 2023 FDA warning letter to an online seller listed BPC-157 among products labeled "research purpose only" and "not for human consumption" (FDA letter (opens in a new tab)). A December 10, 2024 letter to another online seller did the same for semaglutide, tirzepatide, and retatrutide labeled "RESEARCH USE ONLY" (FDA letter (opens in a new tab)).

Both letters found that each seller's website showed the products were intended as drugs for human use, whatever the label said. Under 21 CFR 201.128, intended use turns on objective intent, which labeling claims and advertising can show (eCFR (opens in a new tab)). So a disclaimer doesn't override how a product is marketed.

The takeaway is responsibility, not alarm. When manufacturing standards are optional, the certificate and its verification become the buyer's job. And the gray-market track record is uneven. A 2018 Talanta analysis of falsified peptides from illegal online pharmacies found purity ranging from 5 to 75 percent, plus inorganic arsenic at up to ten times the parenteral limit and detectable lead (PMID 30029448). Melanotan II vials labeled 10 milligrams have measured at 4 to 9 milligrams of actual peptide, every one under label (Breindahl, 2015; PMID 24771717).

A Certificate of Analysis, or COA, is a lab report for a specific batch of material. A real one lists the tests run, the method behind each test, the specification it had to meet, and the measured result. Good ones name the lab and carry a report or accession number you can look up.

One thing gets missed constantly. A COA proves something about the sample the lab tested. It doesn't automatically prove anything about the vial in your hand. Those match only if the batch and lot on the certificate match the batch and lot on your vial, and if the certificate came from an independent lab rather than a marketing folder.

Purity numbers on a product page are marketing until a batch-specific certificate backs them. The gap between a '99 percent pure' headline and a matching, verifiable lab report is where most quality problems live.

Most legitimate peptide COAs run four tests. Each answers a different question, and each has a limit worth knowing.

HPLC purity measures how much of the sample is a single species. Reversed-phase high-performance liquid chromatography, run under USP General Chapter 621, separates the main peak from related impurities. It answers how uniform the sample is, not what it is. A wrong compound that happens to be pure will still post a high purity number, so purity alone never confirms identity.

Mass spectrometry identity confirms what the molecule actually is. Electrospray ionization mass spec reads the molecular weight, the compound's mass fingerprint, and matches it against the expected value. Its limit matters. Mass alone can't tell apart stereoisomers or sequence variants that share the same weight. Identity and purity together are far stronger than either one.

LAL endotoxin checks for bacterial pyrogens. The Limulus Amebocyte Lysate assay, standardized in USP 85, detects gram-negative endotoxin. One nuance trips people up. There's no universal pass number in endotoxin units per milligram, because the real limit depends on the intended dose, calculated as K over M. A raw figure on a certificate means little on its own, and this test checks pyrogens, not live microbial contamination, which is separate.

Amino acid analysis and net peptide content measure how much of the vial is actually peptide. This is quantity, not quality. It separates real peptide mass from the water and counterion salts, like acetate or trifluoroacetate, that come along with it.

Purity and net peptide content answer two different questions, and confusing them is common.

Purity is the fraction of the peptide present that is the correct peptide. Net peptide content is how many milligrams of actual peptide sit in the vial, after subtracting salt, water, and residual solvent. A vial can read 99 percent pure on HPLC and still hold far less peptide by mass than the label suggests, because purity says nothing about fill weight.

A certificate that reports both is doing more work than one that reports purity alone. When a COA lists net peptide content above the label amount, the vial was slightly overfilled. When it stays silent on content, you know the quality of the peptide but not the quantity. For the hands-on side of measuring and mixing what you receive, the reconstitution guide has the syringe math.

Two identifiers show up on peptide labels, and they do very different jobs.

A CAS Registry Number identifies the substance. It's a unique code assigned to a chemical, and it's the same everywhere, for every producer and every batch. GHK-Cu carries the same CAS number no matter who made it. A CAS number answers what compound this is, and nothing more.

A lot or batch number identifies the production run. The manufacturer assigns it, and it ties one physical unit back to one manufacturing event. Two vials of the same compound made months apart share the CAS number but should carry different lot numbers.

This is why it matters. A certificate has to match both the CAS and the lot on your vial. A correct CAS only confirms which compound the label claims. Only the lot number tells you whether the specific batch you received was the one that got tested. The peptide glossary has quick definitions if a term here is new.

A fast check separates real batch tracking from theater. A legitimate lot number belongs to one product and one production run. So search the published COA library for the lot number printed on your vial, and count how many distinct products come back.

One product, one or a few sizes, one date range? That looks like a real batch. The same lot number attached to twenty, thirty, or fifty different compounds across several months? That's not a batch number. That's a shared testing or shipment code wearing a lot number's clothes.

The distinction isn't academic. When a single code covers an entire catalog, searching by lot tells you nothing about your specific vial, because the code doesn't point to a single run. The paperwork can look full and still float free of what you're holding.

Anyone can generate a PDF with plausible numbers. Fabricated chromatograms and mass spectra that pass a casual glance are now trivial to produce. So the goal is verification, not trust.

The strongest signal is a report you can confirm on the testing lab's own server. Independent labs that publish an accession number or a QR code let you type that number into the lab's database and pull the same result. Anyone can fake a certificate PDF. Only the lab can create a matching entry in its own system.

Two checks follow from that. A certificate from a named, independent analytical lab means more than in-house-only testing. And the accession number or QR on the certificate should resolve in the lab's database, to your product and your lot. A missing accession number, a dead QR code, or a code that opens a different product is the tell.

One order, examined closely, shows how this plays out. Names are left out. The pattern is the point.

The order was five items. Two arrived as the wrong compound entirely. A healing blend came as a single unrelated peptide, and a growth-hormone combo arrived as a different variant with one of its two ingredients missing. That alone is a fulfillment failure, before any lab question.

Then the certificates got interesting. One vial's lot number, searched in the product's own COA library, pulled up a certificate for a completely different peptide. The physical product was one compound; its lot resolved to another. Next, one lot number returned roughly fifty different products across several months of report dates, the shared-code pattern from above. And one vial carried no QR code at all, so there was no way to confirm it against the lab.

The reassuring half. When individual reports were opened, several were real. One certificate carried a genuine mass spec with a molecular weight that matched the compound, and the numbers were internally consistent. The testing itself looked legitimate.

The lesson holds both truths at once. Lab work can be real and tracking can still be broken. If the lot on your vial doesn't resolve to a matching, product-specific certificate, you can't verify that vial, no matter how good the rest of the paperwork looks.

A handful of signals separate paperwork you can check from paperwork you can't.

One lot number across many products. If a searched lot returns a whole catalog of different compounds, it's a shipment code, not a batch identifier.

A certificate that names a different product or size. The COA has to match both the compound and the lot on your vial. A near-match is a miss.

Purity only, with no identity or content. HPLC purity without a mass spec identity test and net peptide content leaves the two most useful questions unanswered.

In-house testing with no independent lab. A named third-party lab with a searchable database beats an in-house report nobody can verify.

No accession number, or a dead QR code. If the certificate can't be confirmed on the lab's server, treat it as unconfirmed.

Stale or missing dates. A certificate from years ago, or with no report date, doesn't describe fresh material.

Mismatches happen, and what they mean is plain. Only a current certificate for that exact product and lot verifies a vial. Its accession number also has to resolve on the testing lab's database.

Without that match, the honest position is that the material is unverified. Real testing on some other batch doesn't transfer to the unit in front of you.

Run these checks against the paperwork for any lot.

Confirm the certificate names an independent lab and carries an accession number or QR code. Search the lot number in the published COA library and check that it returns one product, not fifty. Confirm the certificate lists HPLC purity, mass spec identity, endotoxin, and net peptide content, each with a method and a specification. Match the vial's lot number to a certificate for that exact product, and confirm the accession number resolves on the lab's own site.

None of this makes a research compound safe or approved. It tells you whether the material matches its documentation, which is the one question a buyer can actually answer. The beginner's guide and the storage and safety guide cover what to do with material once you trust it.