Verifying a COA with the laboratory

A certificate is only as independent as its hosting. When the vendor serves the file, the vendor controls it; when the laboratory serves it, the laboratory does. This is the cheapest improvement available to any vendor already paying for third-party testing, and almost nobody has made it.

Every row is derived from the stored certificate records and the laboratory registry at /labs. The full corpus is downloadable as coa.csv.

Seven laboratories named on indexed certificates publish a lookup anyone can use. That does not mean every report behind them can be checked. Laboratory portals divide into two designs, and the difference decides whether evidence survives scrutiny at scale.

Where the laboratory serves the report at a fixed address, a genuine identifier returns the document and an invented one returns nothing. That is verification: it can be performed by a reader, by this index, or by a retrieval system, and it cannot be faked by the seller. Where the portal assembles the record in the browser after loading, the same page comes back for any identifier, so the check succeeds only for a person who waits and reads. Those reports are not suspect; they are simply unverifiable by anything other than a human being with the page open.

This distinction is why the index records the laboratory from the document rather than from the vendor’s description of it, and why a certificate’s provenance tier turns on where the file lives. The methodology behind that is at /methodology.

Nineteen suppliers not yet in the index asked to be listed during October 2026. Four of them publish certificates served by the issuing laboratory, a higher share than the 7% of indexed vendors that do. Each is named below because each asked publicly to be listed and the finding about it is one we checked and that favours it.

None of the four is scored yet, and inclusion here is not a listing, a ranking or an endorsement. It records one checked fact: a genuine certificate identifier returns the document from the laboratory, and an invented one does not. No supplier is named here for a shortcoming, because a submission is a private enquiry and not grounds for a public finding about a business the index does not carry.

Hosting is not quality. A laboratory-served certificate from an unaccredited laboratory is checkable and may still be worth little; a vendor-served certificate from a competent laboratory may be entirely accurate. The figures above count where a document lives, not whether its contents are right.

Nor is a lookup an accreditation. Of the laboratories in this corpus, the accreditation column above reflects what each claims on its own site and what we could confirm, and the two frequently differ. The per-laboratory detail, including which claims we could not substantiate, is at /labs.

How do I verify a peptide COA is real?

Open the report from the laboratory, not from the vendor. A certificate served at the laboratory's own address cannot be edited by the seller; one served from the seller's site can be. Across the 654 certificates indexed here, only 45 (7%) are hosted by the issuing laboratory. Where the laboratory prints a search code or accession number, use it on the laboratory's lookup and compare the lot, the date and the assayed mass against the copy the vendor published.

Which peptide testing labs have a public COA lookup?

7 of the laboratories in this index publish a lookup anyone can use without an account: Bioviridian Inc., Freedom Diagnostics Testing, ILS Laboratories, Janoshik Analytical, KMD Analytical (KMD Group LLC), Krause Analytical LLC, United Laboratories. A lookup is not an accreditation and does not make the laboratory competent; it makes its reports checkable. Several other laboratories named on indexed certificates publish no lookup at all, so their reports can only be read as the vendor presents them.

Is a vendor-hosted certificate of analysis worth anything?

It is worth more than no certificate and less than a laboratory-served one. 93% of the certificates indexed here are served by the vendor, so treating that as disqualifying would reject almost the whole market. The practical test is whether the document carries a lot number, a named third-party laboratory, an assayed mass against the label claim, and an identifier that resolves somewhere outside the vendor's control.

Why do some lab verification links not work?

Many laboratory portals build the record in the browser after the page loads. Requesting such a page returns the same shell whatever code is supplied, so an automated check cannot confirm a report even when a person looking at the same link can. That is a property of how the portal is built, not evidence that a report is false. Laboratories that serve the document itself at a fixed address are the ones whose reports can be checked at scale.