How to read a peptide certificate of analysis

A certificate of analysis (COA) is a lab report on one sample. A useful one answers four questions: is this the right molecule, how much of it is there, what else is in the vial, and is it safe to put under the skin. Plenty of COAs answer only the second, and a single “99% pure” figure tells you less than it looks.

We’ll go through each test in the order you’ll usually meet it, with worked numbers from real, anonymised lab reports. Then the red flags.

Identity: is it the right molecule?

Identity testing asks whether the peptide in the vial is the one on the label. The standard tool is mass spectrometry, which weighs molecules. Every peptide has a predictable molecular mass from its amino-acid sequence, so a matching mass is strong evidence you have the right chain. A wrong mass, or a mass that fits a shortened or modified version, is a clear failure.

The best version of this is a blind test. The sample goes in without a name and the lab reports what it found. When a report says a vial labelled as a GLP-1-type peptide was “identified as” that peptide without being told what to look for, that is more convincing than a lab confirming the name it was given.

Purity: what share of the material is the target peptide?

Purity usually comes from HPLC (high-performance liquid chromatography). The sample is pushed through a column, its components separate, and a detector draws a peak for each one. Purity is the target peak’s area as a percentage of all the peaks.

Two limits are worth knowing. HPLC purity says nothing about identity on its own: a single clean peak could be the wrong compound. And it only counts what the detector sees, so things like water, salt and leftover counter-ions from manufacturing don’t appear in the percentage. Synthetic peptides pick up predictable impurities: sequences missing an amino acid, sequences with an extra one, oxidised or rearranged forms, and trifluoroacetate left over from the synthesis [1]. Some of those sit very close to the main peak. A good report shows the chromatogram, not just the number.

Content: how many milligrams are actually there?

Content (sometimes called assay or quantity) is a separate measurement. It compares the sample against a reference standard to work out the actual mass of peptide in the vial.

This is the number that matters if you care whether a “15 mg” vial holds 15 mg. A worked example from a real report: a vial labelled 15 mg measured 16.14 mg, which is about 108% of label, with HPLC purity of 99.9%. Another, a 500 mg vial of NAD+ (not a peptide, but tested the same way), measured 529.18 mg. A little over label is what you’d hope to see. Well under label means you’re paying for, and dosing, less than you think.

Purity and content can disagree sharply, which is why you want both. A 2024 study bought semaglutide vials from illegal online pharmacies and tested them with liquid chromatography and mass spectrometry. The semaglutide content came out 28.6–38.7% above the labelled amount, yet the measured purity was only 7.7–14.4%, against the 99% printed on the labels [5]. A seller quoting just one of those figures could have made the product sound fine.

Endotoxin: the test that matters most for injection

Endotoxins are fragments of the outer wall of certain bacteria. They survive when the bacteria are dead, and even sterile material can carry them. Injected, they can cause fever and inflammation. The standard test uses a reagent made from horseshoe crab blood (the LAL test), which FDA has accepted in place of the older rabbit fever test for decades [2].

The limit comes from a simple formula. The threshold pyrogenic dose in humans is 5 endotoxin units (EU) per kilogram of body weight per dose [3]. For a 70 kg adult that is 5 × 70 = 350 EU per dose. A lighter person has a lower ceiling: 250 EU at 50 kg.

A worked example from a real report: a 15 mg vial measured 1.275 EU for the entire vial. Even if the whole vial were given at once, that is about 275 times under the 350 EU ceiling. By contrast, the illegal semaglutide vials in the 2024 study all contained endotoxin, at 2.2–9.0 EU per milligram [5]. Whether that crosses the limit depends on how many milligrams go into one dose, which is exactly why the result should be expressed per vial or per milligram, not as “pass”.

Watch the units. A result in EU/mg means little until you multiply by the amount in a dose.

Sterility: are there living microbes?

Sterility testing incubates part of the sample in growth media and watches for bacteria, yeasts and moulds. A pass means nothing grew. Two points to bear in mind: it tests the sample sent, not every vial in the batch, and it is separate from endotoxin. A product can be sterile and still carry endotoxin from bacteria killed earlier in the process. The purchased semaglutide vials in the 2024 study were free of living microbes but every one contained endotoxin [5].

Heavy metals

Heavy-metal testing looks for elemental contaminants. The international pharmaceutical guideline on elemental impurities names arsenic, cadmium, mercury and lead as its highest-concern class, because they are human toxicants with little or no use in drug manufacture [4]. A good panel reports each element with a detection limit. “Not detected” is only as meaningful as the limit behind it.

The verification key

A COA is a PDF, and PDFs are easy to edit. Some independent labs (Janoshik Analytical is a well-known example in the peptide world) give each report a task number and a unique verification key. Entering both on the lab’s own website pulls up the original result, so you can check that the numbers in front of you match what the lab issued.

That proves the report is genuine. It does not prove the tested sample came from the batch you’re holding, or that the batch hasn’t changed since. Look for a batch or lot number on the report that matches your vial, and a test date that is recent.

A quick checklist

Red flags

• Only a purity figure. It says nothing about identity, dose or contamination.
• No lab name, no way to verify. An unverifiable PDF is a claim, not evidence.
• The seller’s own lab. In-house testing isn’t worthless, but independent testing is the point.
• Batch numbers that don’t match, or a single report reused across months of stock.
• Suspiciously round results, such as exactly 10.00 mg and 99.00% on every product.
• Nothing on endotoxin or sterility for a product that will be injected.
• Dates that don’t add up: a test dated before the batch was made, or years old.

What a COA can’t tell you

Even a perfect set of results says only that one sample, on one date, contained the right molecule at the right amount without detectable contamination. It says nothing about whether the peptide works, whether it’s safe for you, or how it was stored on the way to your door. Clean material is a floor, not a recommendation.

Educational content only — not medical advice. Many peptides discussed on HPR are not approved for human use. Talk to a qualified clinician before making any decision about your health.

Free live webinar · Thursday 1 October · 7pm UK time

Join the next webinar: Introduction to Peptides

with Mitch O’Callaghan, ISSCA Peptide Therapist · Founder, Proper Protocols

Save my free placeHPR×Proper Protocols