How to Verify a Peptide COA: Reading HPLC/MS & Spotting Fakes

If you are buying a research peptide, the certificate of analysis (COA) is the one document a vendor will wave at you as "proof of quality." Learning to read it properly is genuinely worth doing — but only if you start from the right frame. A COA is the best signal available to a buyer in an unregulated market, and it is still only a signal. No regulator audits these documents, nothing compels a vendor to test honestly, and fabricated or recycled certificates are common. This guide teaches you to read the chemistry on a COA and to spot the fakes — while being honest that a perfect-looking COA cannot make an unapproved research chemical into a verified, safe medicine.

The bigger picture — why this market exists, how the "research use only" label shifts all risk onto you, and why even a real COA is a floor and not a guarantee — is laid out in our pillar on where to buy peptides and the "research chemical" gray zone. This page is the narrow, practical companion: what the numbers on the page actually mean, and how a counterfeit certificate gives itself away.

First, the honest frame: these are not FDA-approved drugs

Before reading a single line of a COA, anchor the context. The recovery and performance peptides this market sells — BPC-157, TB-500, the GH secretagogues — are not FDA-approved drugs, and there is no approved, quality-controlled finished product to compare a vendor's vial against. BPC-157, the flagship, has no approved formulation and no validated human dosing; a 2026 biopharmaceutical review searching the FDA, EMA, and WADA databases concluded its development "remains rudimentary" and named the difficulty of controlling peptide impurities as a core translational barrier⁶. A 2025 narrative review reached the same bottom line: no approved, quality-controlled product exists⁷. The FDA, separately, placed BPC-157 among the bulk drug substances that may present significant safety risks¹⁰.

That matters for COA-reading in a specific way: a certificate of analysis is the vendor's own quality paperwork substituting for the regulatory quality system that an approved drug would have. It is filling a gap, not closing it. Read it carefully — but never let a clean COA talk you out of the underlying fact that you are evaluating an unapproved substance.

What a legitimate, batch-specific COA must contain

A meaningful COA is not a generic "we test everything" badge. It is a document tied to one specific batch of one specific product, reporting the measurements that establish what the compound is and how pure it is. Five elements are non-negotiable.

1. A batch/lot number that matches your vial. This is the single most important field, because it is what makes the document about your product rather than some other batch. The lot number printed on the COA must match the lot number printed on the vial in your hand. A COA with no lot number, or a lot number that doesn't match, proves nothing about what you received — it is a stock photo of quality, not a measurement of it.

2. HPLC purity, reported as a real percentage. High-performance liquid chromatography (HPLC) separates the peptide from its impurities and quantifies how much of the sample is the intended compound. A legitimate COA reports a specific measured purity — commonly expressed as a percentage of total peak area — and for a research peptide buyers typically look for ≥98%. The chromatogram itself (the trace, with a dominant main peak and small, labeled impurity peaks) is the underlying evidence; a single bare number with no chromatogram is weaker than a number backed by the trace.

3. Mass-spectrometry identity confirmation. Purity tells you how much of the sample is one compound; it does not tell you that the compound is the right one. Mass spectrometry (MS) confirms identity by measuring the molecule's mass and matching it to the expected molecular weight of the target peptide. Identity without purity, or purity without identity, is half a picture. A vial that is 99% pure something-other-than-what-you-ordered is still 99% pure — which is exactly why the MS identity result and the HPLC purity result have to be read together.

4. A test date that is recent and coherent. A COA should be dated, and the date should be recent — a useful rule of thumb is less than 12 months old, because the document is supposed to describe a current batch, not a years-old one recycled across every subsequent shipment. The date also has to be internally coherent: a test date that predates the product's manufacture date is impossible (you cannot test a batch that didn't exist yet) and is a hard tell of a fabricated or recycled certificate.

5. A named, independent third-party lab — ideally verifiable on the lab's own server. The testing should be done by an outside laboratory, not the vendor's own bench, and that lab should be named, with enough detail (address, contact, or a report ID) that you could in principle confirm the result independently. The strongest version of this is a COA you can look up on the testing lab's own website via a report number or QR code — verification on the lab's server, not just a PDF the vendor emailed you. A PDF a vendor controls end-to-end can be edited in seconds; a record hosted by the independent lab cannot.

Reading the chemistry: what the HPLC and MS numbers actually mean

The two analytical methods on a COA answer two different questions, and the value of the document comes from holding both at once.

HPLC = the purity question. The chromatogram shows peaks; the largest should be your peptide, and the smaller ones are impurities — truncated sequences, deletion products, or process residues. Synthetic-peptide quality science treats impurity control as the hard, central problem precisely because these related impurities are chemically similar to the target and hard to separate⁶. A subtle point that matters: a high purity number can still hide a meaningful impurity if the method wasn't sensitive enough to resolve it. Analytical chemists developing reference standards for synthetic peptide therapeutics have shown that even closely related variants — including mirror-image (enantiomeric) and isomerized forms — require specialized chromatography to detect at all, which a routine purity assay may miss entirely⁵. In other words, "98% by HPLC" is only as good as the method behind it; the number is necessary but not, by itself, complete.

MS = the identity question. Mass spectrometry weighs the molecule and compares it to the expected mass. This is what catches the most dangerous failure mode in an unregulated market — a vial that is the wrong substance entirely. The peptide-quality literature is explicit that establishing identity against a reference standard is foundational to verifying a synthetic peptide is what it claims to be⁴. Without an MS result, a COA is asking you to trust that the pure thing in the vial is also the right thing, on the vendor's word alone.

Held together, the honest reading is: HPLC ≥98% and an MS identity match, both tied to a lot number that matches your vial, dated within the last year, from a named lab you can ideally verify independently. Miss any one of those and the certificate has a hole in it.

How fake and recycled COAs give themselves away

Because nobody audits these documents, a meaningful share of them are decorative — and the fakes follow patterns. The tells:

• •A test date that predates the manufacture date. Internally impossible; a clear sign the COA was fabricated or recycled rather than run on the batch you're buying.
• •A lot number that doesn't match the vial — or no lot number at all. A generic certificate detached from your specific batch is marketing, not assurance.
• •The same COA file recycled across visibly different products or lots. A real batch test produces a different document, with different numbers, for each batch. One PDF reused everywhere means nothing was actually measured for your vial.
• •An identical "99.9% purity" on everything. Peptide synthesis varies lot to lot, so genuine HPLC numbers move. A flawless, uniform figure printed across every product and every batch is almost certainly copied marketing text, not a measurement — a pattern we catalog alongside the other peptide vendor red flags.
• •No named lab, no method, no chromatogram. A bare table of numbers with no testing lab, no HPLC/MS method stated, and no underlying trace is unverifiable by design. If you can't tell who tested it and how, you can't trust what it says.
• •A vendor-hosted PDF you can't confirm anywhere else. A document the seller controls end to end can be edited at will. The verifiable version lives on the independent lab's own server, reachable by a report ID or QR code.

The reason this skepticism is warranted isn't paranoia — it's the base rate. The most rigorous testing of this channel comes from the closely related SARM market, which runs through the same unregulated, "research use only," overseas-synthesis supply line. In a landmark JAMA analysis, investigators chemically tested products sold online as SARMs and found that only a minority contained what the label claimed: wrong amounts, no active compound at all, or undeclared drugs not on the label¹. A 2024 analysis of illegal SARM products purchased online documented the same label-versus-content discrepancies², and a 2025 study screening unregistered supplements detected illegal SARMs consumers had no way to anticipate from the packaging³. When products from this channel are actually tested, mislabeling is a common finding — which is exactly the gap a COA is supposed to close, and exactly why a fabricated COA is so damaging.

Why a verified COA still isn't a safety guarantee

Suppose a COA passes every check above — lot-matched, ≥98% HPLC, MS identity confirmed, dated last month, verifiable on a named lab's server. That is the best a buyer in this market can do, and it genuinely lowers the odds of receiving an outright counterfeit or a wildly mislabeled product. But it does not make the peptide a safe, approved medicine, for reasons that sit outside the document:

• •It is still an unapproved substance. No COA changes the regulatory status; BPC-157 and its peers remain unapproved, with no validated human dose and an FDA bulk-substance safety flag¹⁰. The certificate verifies the chemistry, not the wisdom of injecting it.
• •The document is unaudited. Even a "third-party" lab named on a COA operates without a regulator confirming the test was run as described. The trust chain has a missing link that no buyer can fully close.
• •Contamination has caused real harm. A clean purity number on the listed compound says nothing about an undeclared contaminant the assay wasn't looking for — and contaminated performance and bodybuilding products have been tied to documented clinical harm, including a published case of cholestatic liver injury traced to contamination⁸. The FDA's tainted-supplements database shows adulteration with approved and unapproved drugs continued across 2007–2021, undeterred by warnings⁹.
• •Sterility and reconstitution are separate problems. A COA reports on the dry peptide's identity and purity; it says nothing about endotoxin, sterility, or what happens once you reconstitute the vial — a step with its own contamination risks we cover in how to reconstitute peptides safely.

So the honest hierarchy is: a lot-matched, lab-verifiable COA reporting HPLC purity and MS identity is the strongest signal you can demand, and you should demand it. It is still a floor, not a ceiling.

The bottom line

Reading a peptide COA well comes down to five questions: does the lot number match your vial, is HPLC purity reported as a real measured percentage (buyers look for ≥98%), is identity confirmed by mass spectrometry, is the date recent and coherent (under ~12 months, never predating manufacture), and is the testing lab named and ideally verifiable on its own server? Miss any one and the certificate has a hole. The fakes betray themselves with impossible dates, mismatched or missing lot numbers, recycled files, and suspiciously uniform "99.9%" figures.

But hold the frame to the end: a COA is the best signal a buyer can get in a market with no referee, and it is still only a signal. These are unapproved research chemicals; the document is unaudited; and a clean certificate cannot rule out contamination or convert an unproven peptide into a safe medicine. For a competitive athlete, the anti-doping stakes make this sharper still — a contaminated vial can trigger a failed test regardless of any certificate, as we explain in whether peptides show up on drug tests and our guide to whether GH peptides are safe and legal for athletes. Price is part of the same picture — the cheapest vial is usually the worst signal, as we detail in BPC-157 cost: research vials vs clinic pricing — and the regulatory ground keeps shifting, which we track in the 2026 FDA peptide reclassification. For the full evidence picture on what these peptides can and cannot do, see our pillar on where to buy peptides and the "research chemical" gray zone and our evidence-ranked guide to the best recovery peptides.