How to Read a Peptide Certificate of Analysis (COA)

A Certificate of Analysis (COA) is a document issued for a single manufactured lot that records the quality-control tests performed on that lot. In a regulated pharmaceutical setting it is the formal evidence that a batch met its release specifications before distribution. In the peptide gray market — "research use only," "not for human consumption" — the COA has been repurposed as a trust signal, which is precisely why it is so often faked, incomplete, or detached from the product it supposedly describes.2321

This article is informational and editorial content only. It is not medical advice, not a protocol to follow, and emphatically not a sourcing or buying guide. It teaches one narrowly-defined skill: how to read and critically evaluate the analytical paperwork that accompanies peptide material. Most research-grade peptides discussed in the broader literature are not FDA-approved for human use, and a COA does not change a substance's legal or safety status. Consult a licensed clinician before any health decision.

Why does reading a COA matter at all?

The reason this skill is not academic is empirical. When peer-reviewed investigators test-purchased "research-use" semaglutide sold online without a prescription, three vials each labeled "99% pure" measured 7.70%, 8.97%, and 14.37% purity by ultra-high-resolution UHPLC-QTOF; all three carried detectable bacterial endotoxin (up to 8.95 EU/mg) despite being sterile; all three were classified substandard, falsified, and counterfeit; and 3 of 6 total purchase attempts were outright non-delivery scams demanding fake "customs" fees of US $650–1,200.1 Independent analysts and regulators have separately documented Photoshopped certificates, recycled lot numbers, and COAs citing laboratories that do not exist.32 The empirical anchor is public and readable in full via the open-access PubMed Central record of the JMIR 2024 study — it is worth reading before trusting any "99%" claim.

A COA is therefore only as trustworthy as your ability to (a) read every section, (b) independently verify the testing laboratory, and (c) understand what the COA does not test — because it reports only the assays that were ordered and paid for.23

What are the four independent axes of a peptide COA?

The single most important concept for COA literacy is that the four axes are independent: a strong result on one says nothing about the others. A peptide can be 99% pure by HPLC and yet be the wrong molecule (no MS), or be the right molecule at high purity yet be only 70% net peptide by weight, or be all of the above yet endotoxin-positive (invisible to both HPLC and MS).1621

Identity by mass spectrometry. HPLC purity cannot confirm identity — a 99%-pure wrong or scrambled peptide is still 99% pure by HPLC. Peptide identity is most commonly confirmed by ESI-MS, which reports multiply-charged ions; you deconvolute (or trust the reported deconvoluted mass) and compare the observed mass to the theoretical mass from the header block.22 For routine identity on a low-resolution instrument, observed versus theoretical mass is conventionally expected to agree within about ±1 Da for peptides below ~3000 Da; high-resolution QTOF or Orbitrap instruments achieve far tighter agreement.22 The critical limitation: MS confirms mass, not sequence. A scrambled sequence or a D-amino-acid substitution has an identical mass to the correct L-peptide and passes a simple MS identity check — only tandem MS/MS resolves sequence order and stereochemistry.22

Purity by HPLC. Purity is the area of the main peak divided by the total area of all peaks, times 100 — area-percent. This measures the target relative to other UV-absorbing, peptide-related impurities (truncated sequences, oxidized or deamidated forms, synthesis by-products). It does not measure non-peptide contaminants well, and it does not measure how much peptide is in the powder by weight.19 This is exactly why the JMIR semaglutide samples could each show essentially one clean chromatographic signal while true purity sat at 7.7–14.4% — the balance was non-peptide bulking material.1 Always read the chromatogram image, not just the number, and be suspicious of round numbers: genuine results read like "98.73%," not "exactly 99.0%."20

What does a COA tell you about how much peptide you actually have?

This is the axis most buyers ignore and the one that most directly governs how much peptide is actually present. Purity is a ratio; content is an absolute quantity. Net peptide content (NPC) is the percentage of the powder's mass that is actual peptide, versus bound water, salts, and counterions. Because peptides are hygroscopic and synthesized as salts, net peptide is typically only ~60–80% of the gross weight.16 The practical consequence: a powder can be 99% pure by HPLC yet only ~80% net peptide, so reasoning by gross weight overstates the delivered peptide mass by ~20–40%. NPC is measured by quantitative amino acid analysis, not by HPLC, and can be estimated theoretically as peptide MW divided by [peptide MW + Σ(bound counterions × counterion MW)].17

Two supporting measurements complete this axis. Water content is determined by Karl Fischer titration (a ~10 mg sample); hygroscopic peptides can hold meaningful water, directly reducing net peptide.18 Peptides with basic residues (Lys, Arg, His) are isolated as salts, so the counterion — usually trifluoroacetate (TFA, ~114 Da), acetate (~59 Da), or chloride — binds the peptide and inflates gross weight.16 Without NPC, water, and counterion data, a high HPLC purity number leaves the actual deliverable peptide mass — and therefore any computed quantity — undefined. Purity tells you the peptide is clean; content tells you how much of it there is.16

How do you evaluate contamination and biosafety on a COA?

These tests matter for anything conceivably injectable, and none of them are visible to HPLC or MS. Their most dangerous property is that they are routinely omitted from gray-market COAs — omission is the most common and most legal way to make a COA mislead.23

Bacterial endotoxin (LAL / BET, USP <85>). Endotoxin is lipopolysaccharide shed from Gram-negative bacterial cell walls; it is heat-stable, invisible to HPLC and MS, and at parenteral doses causes fever, inflammation, and at high exposure septic shock.4 The standard assay is the Limulus Amebocyte Lysate (LAL) test, reported in EU/mL, EU/mg, or EU/vial. USP <85> sets the limit as K/M, where the constant K = 5 EU/kg for all parenteral routes except intrathecal, where K = 0.2 EU/kg; for a 70 kg adult this caps non-intrathecal exposure at roughly 350 EU per hour.56

Sterility (USP <71>). This is a separate, culture-based test: the sample is tested by membrane filtration or direct inoculation into Fluid Thioglycollate Medium (anaerobes) and Soybean-Casein Digest / Tryptic Soy Broth (aerobes and fungi), incubated at least 14 days, and "no growth" passes. USP <71> is harmonized with Ph. Eur. 2.6.1 and the Japanese Pharmacopoeia.78

Two further panels round out biosafety: heavy metals (Pb, Cd, Hg, As) require ICP-MS at parts-per-billion sensitivity, and residual synthesis solvents (TFA, acetonitrile, DMF) require a dedicated GC panel. Both are commonly absent from gray-market COAs unless specifically ordered.23

Who tested it, and can you verify the lab independently?

The most load-bearing governance signal on a COA is who produced it and whether you can independently confirm it. A COA produced by an independent laboratory removes the manufacturer's conflict of interest; an in-house COA is not automatically invalid but carries an inherent conflict and a lower trust tier.24 The gold standard is a lab accredited to ISO/IEC 17025 — the international standard for the competence, impartiality, and consistent operation of testing laboratories — granted by recognized bodies such as A2LA and cross-checkable against the global ILAC mutual-recognition framework.91011 Independent verifiability is the acid test: a COA you can confirm on the testing lab's own portal is far harder to fake than a vendor-hosted PDF, which is trivially Photoshopped.23

What can even a perfect COA never tell you?

Four analytical limits and one regulatory ceiling. Analytically: a COA reports only the tests that were ordered, so a missing endotoxin or sterility line means untested, not clean; it is batch-specific and historical, saying nothing about degradation after manufacture or about the vial you received unless the lot matches; HPLC purity without NPC leaves the deliverable mass undefined; and MS confirms mass, not sequence or stereochemistry.231622

The biggest limit is regulatory, not analytical. Under the U.S. Federal Food, Drug, and Cosmetic Act, a product becomes a drug the moment it is intended to affect the structure or function of the body — and "research use only" labeling is not a legal shield when marketing signals human therapeutic intent.1415 The FDA issued a December 2024 warning-letter wave to GLP-1 and peptide sellers, a February 2025 letter to a named peptide seller, and in September 2025 more than 50 warning letters plus a parallel series to sellers of "research use only" peptides including BPC-157; in 2026 it proposed excluding semaglutide, tirzepatide, and liraglutide from the 503B bulks list.1312 As of early 2025 the FDA had logged more than 455 adverse-event reports for compounded semaglutide and more than 320 for compounded tirzepatide.2 No COA addresses any of this.

Bottom line. A COA is a batch quality record read across four independent axes; require the chromatogram and the spectrum, match the lot number to the vial, verify an ISO/IEC 17025 lab independently, and assume omitted tests are untested. But never treat a COA as approval — quality documentation and legal or human-use safety are separate axes, and for most gray-market peptides the latter is simply absent. The correct response to a fake, incomplete, or gray-market COA is to disengage and consult a licensed clinician, not to find a better vendor. Regulatory facts here are current as of June 2026 and should be re-verified after that date.