How to read a peptide certificate of analysis (COA)

A certificate of analysis, or COA, is a laboratory’s report on one batch of a substance: which tests were run, by what method, what the acceptance limit was, and what the result was. Sellers post them as proof of quality, so reading one is a useful part of peptide basics. A COA can describe a powder, and that is where its reach ends. It cannot tell you a molecule is safe in people. The are peptides safe guide covers what lab tests of unregulated products have actually found, and the FDA status tracker covers what is legal.

Identity: mass spectrometry

Mass spectrometry weighs molecules. The COA should state the expected molecular mass for the named peptide and the mass the lab measured; the two should agree within the method’s stated tolerance. This is the test that catches the wrong substance in the vial, which is the most basic failure and one that official medicines labs keep finding in seized peptide products.

Its limits are worth knowing. A mass match confirms the right total mass, not that the amino acids are in the right order: a scrambled sequence of the same amino acids weighs the same. Tandem mass spectrometry (MS/MS), which breaks the peptide into fragments, can confirm the sequence. And a mass spectrum on its own says little about quantity.

Purity: HPLC

High-performance liquid chromatography (HPLC) pushes a dissolved sample through a column that separates molecules, and a UV detector records each one as a peak. Purity is normally reported as the main peak’s share of the total peak area, so “98.7%” means the target peptide made up 98.7% of what the detector saw. A COA that is useful shows the chromatogram itself, the detection wavelength, and the column and method, not just a number.

HPLC purity is the most quoted and most misread line on a COA:

• It describes the peptide material only. Water, salts and counterions are not in the denominator.
• It is blind to anything the detector cannot see at that wavelength, and to endotoxin and bacteria entirely.
• It says nothing about how much peptide is in the vial.

A purity figure on a label is a claim, not a test. In a 2024 study of semaglutide vials ordered from illegal online pharmacies, the products claimed 99% purity; the researchers measured 7.7% to 14.4%. An earlier study of the ten falsified peptide drugs most often seen on the Belgian market found purity as low as 5% for some peptides.

Content: why purity is not the same as how much you have

Synthetic peptides are made and purified using trifluoroacetic acid (TFA), so they usually come out as TFA salts: each peptide molecule carries counterions that add weight but are not peptide. Freeze-dried powder also holds water. Net peptide content is the share of the powder’s total weight that is peptide once those are counted, and it is measured separately, usually by amino acid analysis or nitrogen analysis. A powder can be 99% pure and still contain noticeably less than its weight in peptide.

Content is also where the label amount is checked. The same 2024 semaglutide study found vials holding 29% to 39% more drug than labeled. For a drug dosed in fractions of a milligram, an error in either direction changes the dose. This is why the reconstitution calculator and the reconstitution guide start from a pharmacy label with a verified strength: the arithmetic is only as good as the number on the vial.

Endotoxin

Endotoxin is a toxic fragment of the outer wall of certain bacteria. It causes fever, chills and, in large amounts, shock. It is the result that matters most for anything injected and the one most often missing from research-peptide COAs. It is measured with the bacterial endotoxins test described in USP chapter 85 and reported in endotoxin units (EU), usually per milligram or per vial.

Three points make this line hard to read on a research product:

• Dead bacteria still leave endotoxin. It is not removed by the benzyl alcohol in bacteriostatic water, and a sample can pass a sterility test and still contain it. In the 2024 semaglutide study, no viable microorganisms were found, but endotoxin was detected in every sample.
• The limit depends on the dose. For approved injectables, the endotoxin limit is calculated from the maximum dose per kilogram of body weight, under USP chapter 85 and FDA’s endotoxin testing guidance. A result has meaning only against a dose. A research-use product has no labeled human dose, so there is no valid limit to compare its result with.
• The ingredient matters as much as the test. In August 2026 at least 30 patients had sepsis-like reactions to compounded glutathione injections made from a dietary-supplement-grade ingredient. FDA’s response included the line that “testing alone does not ensure drug quality.”

Sterility

A sterility test incubates samples from a batch and checks for microbial growth; USP chapter 71 sets the method. A pass means the units tested grew nothing. It cannot show that every vial in the batch is sterile, and it cannot show that a vial stayed sterile after it was shipped, opened and punctured. Official labs have found the bacterium Bacillus cereus in illegal injectable peptide products.

Matching the COA to the vial

A COA is about one batch. Before reading any result, check that it is about the product in hand:

Lab accreditation: ISO/IEC 17025

ISO/IEC 17025:2017 is the international standard for the competence, impartiality and consistent operation of testing and calibration laboratories. Accreditation to it is granted by an accreditation body for a defined scope: specific tests, on specific materials, by specific methods. A lab accredited for one test is not accredited for every test it runs. To check, look the lab up on the accreditation body’s public register and confirm that the tests on the COA, such as peptide identity by LC-MS or endotoxin by LAL, are on its scope. A logo on a PDF proves nothing on its own.

Accreditation tells you the lab can run the test properly. It does not tell you the sample came from the batch you hold. A third-party lab that tests whatever sample a seller mails in can produce a genuine report about a vial that was never sold.

Red flags

• No lot number, or a lot number that does not match the vial.
• The same COA used for several lots, sizes or products.
• Purity only: no identity, no content, no endotoxin, no sterility for something meant to be injected.
• A purity number with no chromatogram, no method and no acceptance limit.
• No lab name, no address, no accreditation number, no signature, or a lab that cannot be contacted.
• The manufacturer and the tester are the same company, with no independent test.
• Results that are suspiciously round or identical across batches.
• A COA image with edited text, mismatched fonts or a date that predates the product.
• “Research use only” on the label next to dosing instructions. FDA treats that combination as evidence the product is an unapproved drug intended for people.

What does the HHS policy expect a COA to show?

As of November 2, 2026, HHS’s interim policy on six compounded peptides makes the certificate a condition. It says HHS does not intend to take enforcement action against a state-licensed pharmacy, federal facility or licensed physician compounding those peptides when ten conditions are met, and one is a valid COA from an FDA-registered facility. The policy is not an approval, and its limits are set out in the FDA status tracker. Its appendix is still the most detailed public yardstick we have seen for a peptide COA, and it sets a bar well above a purity number.

All of this is aimed at a pharmacy receiving bulk ingredient, so a patient would not normally see it. The pharmacy label with your name on it is the document meant for you.

Why a COA does not make a research product legal or safe

Even regulated drug makers do not take a supplier’s COA on trust. Federal manufacturing rules let a drug maker accept a supplier’s report of analysis only if it runs at least one specific identity test itself and establishes the reliability of the supplier’s results “through appropriate validation of the supplier’s test results at appropriate intervals.” A single PDF from a seller is far short of that.

A COA also answers the wrong question for a person. It describes the composition of one sample. It does not show that the molecule is safe in humans: for BPC-157, FDA’s review found it “lacks sufficient information to know whether the drug would cause harm when administered to humans,” and a perfect COA changes none of that. It does not supply a dose, a stability date, storage conditions or a beyond-use date. And it does not change the law. Under 21 CFR 312.160, a product labeled for research may be shipped only for laboratory or animal research and is not legal to use on people, and FDA warning letters, including five sent to peptide sellers on August 24, 2026, have found that research disclaimers do not hold when a seller’s website offers dosing guidance and reconstitution calculators.

Patients who get approved drugs never see a COA, and do not need to. The batch was released against specifications FDA approved, made under manufacturing rules FDA inspects, with a label FDA reviewed. A compounded drug comes with a licensed pharmacy’s label, a patient name and a beyond-use date. Those are the documents written for the person using it. The peptide therapy guide explains how to check that a clinic and pharmacy are the real thing.