Informational Only · Not Medical Advice · Every Claim Names Its Source · Editorial Policy

Peptide Certificates of Analysis: What a COA Can and Cannot Prove

A peptide certificate of analysis (COA) is a test report for one sample, from one batch, run by one lab on one date. It can support a claim about that sample’s identity and purity. It cannot prove that your vial came from that batch, that it holds the labeled amount, or that it is sterile and free of endotoxins. For anything injected, those last two matter more than a purity percentage.

This guide explains what a COA does in regulated drug manufacturing, what peptide COAs usually leave out, and what independent testing of online peptides has found.

What a certificate of analysis is supposed to be

In regulated manufacturing, a COA is a supplier’s report on a batch of raw material, and even there it is not taken on trust. Under FDA manufacturing rules, a drugmaker may accept a supplier’s “report of analysis” in place of its own purity and strength testing only on two conditions. It must run at least one specific identity test on the material itself, and it must establish the reliability of the supplier’s analyses “through appropriate validation” at regular intervals.

Advertisement

Pharmacy compounding follows the same logic. The FDA’s interim policy for 503A compounding requires a valid COA. But that is only one of four conditions, alongside an FDA-registered original manufacturer and compliance with every other legal requirement. The FDA also tells compounders to “know your bulk drug substance” suppliers, including what testing they actually do. It gives an example of a supplier whose ingredient, shipped to compounders labeled as quinacrine, was later identified as artemisinin.

A COA attached to a peptide sold online sits outside that system. No one has validated the lab, no identity test is repeated on receipt, and no regulator holds the seller to the document. The research use only guide explains why these products are labeled the way they are.

Peptide certificate of analysis: what each line can and cannot tell you

COA line What it can show What it cannot show
Purity by HPLC (for example “99%”) The share of the detected signal that comes from the main peptide, in the sample tested Material the method cannot see. It is also not the amount of peptide in your vial
Identity by mass spectrometry That a molecule of the expected mass was present in the sample That nothing else is present, or that your vial matches the sample
Batch or lot number Which batch the seller says was tested That the vial you hold came from that batch
Lab name and date Who reportedly ran the test, and when Whether the lab is competent, independent, or real, and whether the peptide has degraded since
Usually missing: sterility When reported, whether living microbes grew from the tested sample Contamination introduced after testing, or in other vials
Usually missing: bacterial endotoxin When reported, the level of bacterial cell-wall residue in the sample Levels in other vials of the batch

Why “99% pure” can mislead

Purity methods detect only what they are set up to detect. In a 2020 study, chemists at the University of Illinois used NMR spectroscopy on two custom synthetic peptides bought from a commercial source. They found that 20% and 43% of the material by weight was mannitol, a sugar alcohol that was not declared (Choules et al., J Pharm Biomed Anal, 2020). Standard liquid chromatography checks can be “blind” to impurities like this. The authors concluded that “experimental verification supersedes trust in both pharmaceutical and research QC.”

Purity and quantity are also different things. A vial can be pure and still hold much more or much less peptide than its label says. That difference matters for anyone measuring an injection; the dosing errors guide shows how measuring problems turn into overdoses.

What independent testing of online peptides found

When researchers have bought peptides online and tested them, the results did not match the labels.

📨 Get Free Peptide Risk Guides Alerts

Free · No spam · Unsubscribe anytime

  • Semaglutide, 2024. Three vials were bought without a prescription from illegal online sellers (Ashraf et al., J Med Internet Res, 2024). Measured purity was 7.7% to 14.37%, though labels claimed 99%. The semaglutide content was 28.56% to 38.69% above the labeled amount. Bacterial endotoxin was detected in every sample, even though no living microorganisms grew at the time of testing. The authors noted that “research-grade 99% purity and pharmaceutical-grade product quality are distinctly different.”
  • Melanotan II, 2015. Vials bought from three online shops held between about 43% and 88% of the labeled amount, and two shops’ vials contained 4.1% to 5.9% unknown impurities (Breindahl et al., Drug Test Anal, 2015). More on this peptide is in the melanotan II guide.

Both studies are small, covering three vials and three shops. They cannot say how common these problems are across the market. They do show that a printed purity claim and the contents of a vial can be very different.

Why sterility and endotoxin matter more for injected peptides

Anything injected skips the body’s surface defenses. FDA rules require that every batch of a drug product meant to be sterile or pyrogen-free undergo appropriate laboratory testing before release. The FDA’s guidance on pyrogen and endotoxins testing (Edition 2, March 2026) sets out how manufacturers should run those tests.

The two tests answer different questions. A sterility test asks whether living microbes are present. An endotoxin test looks for residue from the cell walls of Gram-negative bacteria, which the Ashraf study authors describe as “residuals and remnants” left behind even when no live bacteria remain. That is why the semaglutide vials above could pass a sterility check and still contain endotoxin. A purity percentage says nothing about either. The injection infection guide covers the warning signs of a contaminated injection.

Impurities and the immune system

The FDA’s concerns about many popular peptides are partly about impurities. On its compounding safety-risk page, the agency lists immunogenicity risk for BPC-157, TB-500, CJC-1295 and others. Immunogenicity means the chance that the body mounts an immune response to the product. The FDA links it to peptide-related impurities, aggregation, and how well the substance is characterized. A COA reporting one purity figure does not describe what the remaining material is.

A COA cannot answer the bigger questions

Even a genuine, accurate COA describes material, not a medicine. It cannot tell you whether a peptide works or is safe in people. For many peptides sold with COAs, the FDA’s own reviews found little or no human safety data. A COA also does not change a product’s legal status, which the peptide legality guide explains.

If you are trying to judge a COA, these questions show how far it falls short of a medicine’s quality controls:

  • Does the lot number on the report match the vial, and was the report issued for that lot rather than a generic sample?
  • Does it report the amount of peptide, not only purity?
  • Does it include sterility and endotoxin results for the finished vials?
  • Can the testing laboratory confirm it issued the report?
  • Is any regulator holding the seller to the document? For research use only products, the answer is no.

A “yes” to every question still would not make an unapproved peptide safe. If a product you used caused a reaction, you can report it to the FDA through MedWatch, including the lot number and a copy of any COA that came with it.

Sources

Owed money from a settlement? Check what is open at OpenClassActions.com. Caring for someone with dementia? Find practical guides at HelpDementia.com. Working out a skin routine? Evidence-based answers at AcneAdvocate.com. Forgot the name of a movie? Identify it at FindThisMovie.com. Was your data exposed? Track active breaches at DataBreachRadar.com.

We use cookies to run this site, measure how it’s used, and show ads. Choose “Essentials only” to limit cookies to what the site needs to work. Privacy Policy.