How to Verify a Certificate of Analysis Is Real

A Certificate of Analysis is a document, and a document is a claim. Verification is the step that moves the proof off the paper and onto a record held by the laboratory named on it, which is a record the person selling you something cannot edit.

It takes about two minutes. Most people who attempt it get one step wrong, and it is the step that makes the rest of them pointless.

What verification is for

Everything printed on a certificate is under the control of whoever produced the file. The purity figure, the method, the laboratory name, the address, the disclaimer. A convincing certificate can be produced by anyone with a design tool, and the better fabrications copy layout and limiting language precisely, because those are what readers pattern-match on.

The one thing outside that control is whether the laboratory holds a matching record. That is what verification queries, and it is why a verification route is the single most important field on a certificate. Without one, the document is the only evidence that the document is real.

The step people get wrong

Here is the failure mode, stated as plainly as possible.

Do not scan the QR code. Do not click the link on the certificate.

The code and the link are printed on the document you are trying to check. Whoever produced the document decided where they point. A code that resolves to the supplier's own website, to a folder of PDFs, to a file-sharing service, or to any page the seller can edit has verified nothing at all: the party making the claim is hosting the confirmation of the claim, which is a closed loop wearing the costume of an independent check.

The correct route is to arrive at the laboratory independently. Read the laboratory's name off the certificate, type its domain into the address bar yourself, find its verification page, and enter the key by hand.

If the certificate is genuine this costs thirty seconds and changes nothing. If it was not, this is the step that finds out.

The sequence

1. Locate the verification key. On Novagen certificates it is printed on the document and encoded in the code alongside it.
2. Navigate to the laboratory yourself. Type the domain. For our certificates that is this site, and the verification page is at /verify.
3. Enter the key. A match returns the recorded result. No match means the key was not issued by that laboratory.
4. Compare the record to the document. Compound, batch, method, result, date. If the register and the paper disagree, the register is authoritative, and a discrepancy is more informative than a clean fail.
5. Check the client name. Covered below, and it is the one that catches what the other steps miss.
6. Match the batch to the vial. The batch identifier on the certificate should correspond to the batch marking on the physical product. If the vial carries no batch marking, no certificate can be matched to it by anyone.

The client name is the check that matters

Assume the key resolves and the record is real. There is still a question, and it is the one that gets skipped almost universally.

Who was this certificate issued to?

A genuine certificate belonging to a different company is a real analytical record that says nothing whatsoever about the product in front of you. Passing off another supplier's certificate is effective precisely because it survives every check except this one. The key is valid. The laboratory exists. The result is authentic. It simply describes somebody else's batch.

Our register shows the client each certificate was issued to for exactly this reason. When the name on the record is not the company that gave you the document, the right conclusion is not that the certificate is fake. It is that the certificate is not theirs, and the material you were sold remains untested as far as this document is concerned.

Reading the four possible outcomes

The key matches, details agree, client is your supplier. The certificate was issued by that laboratory to that supplier, and the recorded result is what the document says. This is the intended outcome and its scope is still narrow, which is the next section.

The key matches, client is a different company. Genuine record, wrong subject. It describes a batch you were not sold.

The key matches, details disagree with the document. The register is the authoritative version. A document edited after issue is a specific and deliberate act, and this outcome is worth more attention than a simple no-match.

The key matches nothing. The laboratory has no record. Either the certificate was not issued by them, or the key was mistyped, and it is worth retyping carefully before drawing conclusions. Keys are short strings and transcription errors are common.

What a successful verification does not prove

Verification is a narrow instrument and it should be described narrowly, because overstating it is its own kind of misinformation.

A confirmed key establishes that the named laboratory issued that certificate to that client, and that the recorded result matches. It establishes nothing further.

• It does not prove the vial in your hand is from the tested batch. That link is the batch identifier and the physical marking on the product, not the verification.
• It does not prove the sample was representative. Whether a result describes a production run depends on how the material was drawn, which happens before the laboratory sees anything. See single vial versus batch representative testing.
• It does not prove current condition. A result is a measurement at a point in time. Peptides degrade, and storage between the test and today is outside the laboratory's knowledge.
• It does not prove safety. A Certificate of Analysis reports a measurement. It is not a product approval, not a safety certification and not an authorization for any purpose. Chromatographic purity is also not a sterility or endotoxin result.
• It does not vouch for the supplier. A laboratory measures samples. It does not underwrite the companies that send them.

What verification removes is one specific failure: the possibility that the document itself was invented. That is a narrower guarantee than most people assume they are getting, and it is a real one, which is more than can be said for an unverifiable certificate.

When the laboratory has no public register

Not every genuine laboratory operates one. Their certificates are still real, they are simply not checkable by you, and you are relying on the supplier's word that the document belongs to them.

The workable alternative is to contact the laboratory directly, using contact details you found by searching for the laboratory rather than details supplied alongside the certificate, and ask whether a report with that reference exists and who it was issued to. Some will answer, some will not for confidentiality reasons, and a refusal is not evidence of anything.

The point is to know which position you are in. A verifiable certificate and an unverifiable one are different objects, and treating the second as though it were the first is where most of the damage in this category gets done.

Check a verification key, or read how to spot a fabricated certificate.