How to read a COA — the five measures that matter.

Every vendor says "third-party tested." The certificate tells you what that actually meant. Here is how to read one in five minutes, what most certificates quietly leave out, and how to catch a fake.

Why this skill matters more than vendor reviews

Vendor reputations move fast in this market — companies appear, take orders, and disappear inside a year, and review threads are gamed in both directions. Certificates don't argue. If you can read one, you can evaluate any vendor in the time it takes to open a PDF, regardless of what Reddit thinks this month.

The problem is that "third-party tested" has been flattened into a slogan. It can mean a full five-measure panel run on the vendor's own lot at a named US lab — or it can mean a purity screenshot recycled from an overseas supplier's batch, tested on someone else's vial, months before your order existed. Both get the same badge on a product page. The certificate is where the difference lives.

The five measures, in the order they matter

1. Net content — the unarguable number

Start here, not at purity. Net content is the one measure a purity percentage absolutely cannot catch, and it is the one with a direct price on it. A 50mg label over a 45mg fill is a 10% surcharge; a 50mg label over a 40mg fill is 25%. Underfill is common enough across the market that independent testing groups treat fill accuracy as a standard pass/fail criterion alongside purity.

What good looks like: the certificate prints a measured number — "net content: 48.2 mg" — rather than a checkbox. A vendor willing to publish a measured fill, including when it lands slightly under label, is showing you real data. A vendor who only ever shows round numbers that exactly match every label is showing you a template.

2. Identity — the test purity people think they already have

Here is the nuance most buyers miss in both directions. HPLC purity runs are done against a reference standard, so a peak at the expected retention time is presumptive identity evidence — purity is not identity-blind. But retention time cannot separate close analogs: a truncated sequence or a similar peptide can co-elute at the same time and still read "99%." That is exactly why LC-MS — mass confirmation — is a separate, separately-paid line on serious certificates. If the purity number settled identity, nobody would pay for the mass spec.

3. Purity — necessary, wildly insufficient

Purity by HPLC-UV is a peak-area ratio: of the material the detector can see, what fraction sits in one peak. It is a real and important measure — a 92% purity peptide carries 8% of something else. But it is the cheapest number to produce and the easiest to fake, which is why it is the one number every vendor shows. When a certificate is purity-only, the honest reading is: this vendor bought the minimum.

4. Endotoxin — the injectable-format question

Bacterial endotoxins are pyrogens — fever-inducing fragments of gram-negative bacterial cell walls. The standard test is the LAL assay per USP <85>, reported against a threshold [good labs run it in duplicate]. For anything in injectable format, this is not an exotic extra — it is the difference between a chemistry document and a safety document. Very few research vendors run it. The ones that do tend to say so loudly, because it is genuinely rare.

5. Microbial — and the sterility trap

This is where the market's language gets slippery, so read carefully:

• USP <85> is an endotoxin test. It detects pyrogens.
• A PCR microbial screen looks for microbial DNA. "No detectable microbial DNA" is a contamination screen — useful, real, limited.
• USP <71> is the actual sterility test — a roughly 14-day culture-based method that consumes sample units. It is expensive, slow, and almost never run on research peptides.

DNA-absence is not sterility: PCR can miss viable organisms below its detection floor and can equally flag dead DNA. So when a vendor's marketing says "sterility tested," open the certificate and look for USP <71>. In our experience reviewing certificates across the market, it is almost never there — the claim is usually endotoxin or PCR wearing a bigger word. Note the legitimate exception: "sterile" as a form descriptor ["sterile diluent · USP" on bacteriostatic water] describes how a product is filled, not a test result on a peptide lot.

The verification step almost nobody does

A real third-party certificate carries three pieces of metadata that make it checkable:

1. The lab's name — a real, findable laboratory, not "our testing partner."
2. An accession or reference number — the lab's own identifier for that specific analysis.
3. The lot number — matching the lot printed on the vial you received.

Reputable peptide-testing labs offer verification — some print lookup codes directly on the certificate. Take sixty seconds and check. A certificate that cannot be verified with the lab that supposedly issued it is, functionally, artwork. And a striking pattern we keep finding: vendors whose homepage claims a long list of tests — while their own lab-results page shows fewer, or shows none at all, just prose about testing. When the claim count and the document count disagree, believe the documents.

Whose vial was actually tested

The quietest distinction in the whole market: tested in whose name, on whose lot. Bulk peptide arrives from a synthesizer with the manufacturer's batch data. A vendor can forward that paperwork untouched — which tells you about a batch that existed upstream, months ago, before dilution, handling, and refilling. Or the vendor can pull vials from their own finished lot and pay a lab to test those, with the vendor's name as the client on the certificate.

The second document is categorically stronger. It covers the product as sold, not the powder as bought. When you see a certificate, check the "client" field — if it names some other company, you are reading recycled supplier data. Ask the vendor directly: was this run on your lot, in your name? The speed and specificity of the answer is itself a signal.

Red flags that end the conversation

• No certificate at all — or "COA available on request" that never materializes.
• No named lab, no accession number — unverifiable by construction.
• "GMP-standard facility" — weasel phrasing chosen because "GMP-certified" would be falsifiable. Real certification comes with a cert number and an issuing body.
• Sterility claims without USP <71> on the document.
• Every lot, every compound, always 99.9% — real analytical data has texture. Perfect uniformity is a template tell.
• A homepage test list longer than the certificate's — count both. They should match.

What good actually looks like

A handful of vendors now publish the full document: named lab, accession number, lot, the five measures, and the measured fill printed even when it lands a few percent under label. That last detail is the strongest trust signal in the market — publishing a 48.2mg measurement against a 50mg label is something a fabricator would never do. Our 2026 COA audit grades vendors on exactly this axis, with links to the documents themselves. The criteria — and our referral disclosure — are in the editorial policy.

FAQ

References & further reading

1. USP General Chapter <85> Bacterial Endotoxins Test — usp.org
2. USP General Chapter <71> Sterility Tests — usp.org
3. FDA, Facts About the Current Good Manufacturing Practices [CGMP] — fda.gov
4. FDA Import Alert 66-80, Detention Without Physical Examination of GLP-1 Bulk Drug Substances — accessdata.fda.gov · covered in depth in our supply-chain report

disclosure: inside your peptides may earn referral fees from vendor links, including the next lab. grades and rankings follow the published criteria in our editorial policy — never referral terms. research + education only · not medical advice.