How to Read and Verify a Certificate of Analysis (COA)

A plain-English guide to reading a Certificate of Analysis, spotting a faked COA, and confirming the result with the issuing lab — so you can vet a vendor before you trust them.

By LegitShops Research

A Certificate of Analysis (COA) is supposed to be the one document that tells you whether what is in the vial matches what is on the label. In restricted verticals — peptides, SARMs, research chemicals, kratom — it has also become the single most-faked piece of paper on the internet. A clean-looking PDF with a 99% purity figure costs a dishonest vendor nothing to produce in a graphics editor, and most buyers never check it.

This guide explains what a real COA contains, how vendors fake them, and — the part almost everyone skips — how to confirm a COA with the lab that supposedly issued it. LegitShops is an independent trust platform, so we will be blunt: a COA is evidence about a vendor's honesty and process, not a safety, efficacy, or legality claim about any product. We are not telling you to buy anything. We are showing you how to avoid being lied to.

What a Certificate of Analysis Actually Is

A COA is a lab report. A sample from a specific production batch is tested, and the lab documents what it found. A COA is only meaningful when it is tied to a batch (or lot) and produced by a lab that is independent of the seller. A "COA" that applies to "all our products" or has no batch number is marketing, not analysis.

Why this matters is not abstract. A landmark 2017 study published in JAMA bought 44 products sold online as SARMs and tested them: only 52% actually contained the SARM on the label, 39% contained a different unapproved drug instead, and 9% contained no active compound whatsoever. In most products the measured amount of compound did not match the label at all, ranging from roughly one-tenth to several times the stated dose. (JAMA, via EurekAlert) That gap — between what a label claims and what independent testing finds — is the entire reason a COA exists, and the entire reason a faked one is so damaging.

If you only learn one thing here: an unverified COA is worth exactly as much as no COA. Our own 2026 vendor-trust data report describes a "fake-COA crisis" across these categories — precisely because so few buyers verify the documents they are handed.

What a Real COA Contains

A legitimate, useful COA has all of the following. Treat any missing field as a question, not a coincidence.

  • The issuing lab's name and contact details — a real, findable third-party laboratory, ideally ISO/IEC 17025 accredited. That accreditation means the lab has had its methods, equipment calibration, and competence independently audited; it does not guarantee any single result is honest, but it is the floor. (ISO 17025 overview)
  • The compound name and chemical identity — exactly what was tested, not a brand nickname.
  • A batch / lot number — and it must match the number printed on the vial or package you received.
  • The date of analysis — recent, and specific. "2024" is not a date.
  • The analytical methods used — typically HPLC (High-Performance Liquid Chromatography) for purity and mass spectrometry (LC-MS) for identity.
  • The actual results, with supporting data — a purity percentage plus the chromatogram (the graph of peaks), not just a number floating on a page.
  • A signature or analyst identifier from the lab.

Reading the HPLC purity figure

HPLC separates everything in the sample into peaks. The big main peak is your target compound; smaller peaks are impurities. Purity is the main peak's area as a percentage of all peak area combined. Research-grade is generally reported at ≥98%; results below 95% suggest meaningful impurities. (Peptidepedia COA guide) Crucially, the number means little without the chromatogram — a chart with one or two large secondary peaks tells a very different story than a clean single peak, no matter what headline figure is printed.

Reading the mass-spec (identity) figure

HPLC tells you how pure; mass spectrometry tells you whether it is even the right molecule. LC-MS confirms the detected mass matches the expected molecular weight. One technical red flag worth knowing: identity reported only at a loose tolerance like ±0.1% on a large molecule can mask the wrong compound entirely — modern instruments resolve far tighter than that. (Apex Laboratory)

How Vendors Fake COAs

Faking is usually low-effort, which is why it is everywhere. Watch for:

  1. Photoshopped numbers on a real lab's template. The format looks legitimate because it is a real lab's layout — only the results were changed. This is why visual inspection alone can never clear a COA.
  2. Identical purity figures across many batches, products, or months. Real testing produces variance. A vendor whose every product is exactly "99.2%" is showing you a template, not measurements.
  3. A purity percentage with no chromatogram, no method, and no raw data. Unsupported numbers cannot be checked and should be treated as unproven. (Muscle and Brawn COA guide)
  4. No batch number, or a batch number that does not match your vial. A COA for "a" batch is not a COA for your batch.
  5. A "lab" that does not independently exist — no website, no accreditation, no way to contact it, or an address that is just the vendor's own address.
  6. In-house-only testing presented as independent. A vendor testing itself has an obvious conflict of interest. Independent, third-party labs exist to remove exactly that.

How to Verify a COA With the Issuing Lab

This is the step that separates real diligence from theater. A COA you cannot trace back to its source is not verified.

Step 1 — Match the batch. Confirm the lot/batch number on the COA is identical to the one on the physical product (or the product listing). No match, stop here.

Step 2 — Find the lab independently. Do not use any link the vendor gave you. Search the lab's name yourself. Confirm it is a real testing laboratory, check whether it claims ISO/IEC 17025 accreditation, and find its own contact details.

Step 3 — Confirm the result at the source. Many reputable labs let you verify a report directly — a lookup portal, a QR code that resolves to the lab's own domain (not the vendor's), or a reference number. If there is no self-serve option, email or call the lab with the batch number and ask them to confirm the report is genuine and unaltered. A real lab can say yes or no. (Honest Peptide, real vs. fake COA)

Step 4 — Distrust any QR code or link that stays on the vendor's domain. If "verification" never leaves the seller's own website, it verifies nothing. The whole point is to reach an independent party.

Step 5 — Cross-check the vendor's reputation. A clean COA on a vendor with a pattern of complaints, chargebacks, or a regulatory history is a partial picture. Run the seller through our free legit-check tool and search our scam registry, which links vendors to documented enforcement actions and convictions.

A 60-Second COA Checklist

Before you trust any COA, confirm you can answer yes to all of these:

  • Named, real, independent lab — ideally ISO/IEC 17025 accredited
  • Batch number present and matching the actual product
  • Specific, recent analysis date
  • Methods stated (HPLC + mass spec) — not just a bare percentage
  • Chromatogram / raw data included, with one dominant clean peak
  • Purity figure that varies sensibly across the vendor's other batches
  • Result confirmable on the lab's own portal or by contacting the lab directly
  • Vendor reputation independently checked

Miss two or more, and the right move is to treat the COA as unproven and walk.

Where LegitShops Fits

We do not sell anything, take vendor money for ratings, or vouch for what any compound does to your body — that is not our lane and we will never pretend otherwise. What we do is attach trust to business legitimacy: verified buyer reviews, independent COA verification, and an evidence-linked scam registry, so the burden of proof sits on the vendor instead of on you.

If you are vetting sellers in a restricted category, start from our verified-vendor directories — peptides, SARMs, research chemicals, and kratom — and run anything that is not yet listed through the legit-check tool. A COA is a powerful piece of evidence. It is only powerful, though, when you verify it at the source.

This article is educational and about vendor due diligence only. It is not medical, legal, or safety advice, and nothing here endorses purchasing or using any specific product.

More from the LegitShops blog