How to verify a certificate at the laboratory

This is the strongest check available to a reader without a laboratory of their own, and it is also the rarest, because it depends entirely on what the issuing laboratory chooses to publish. Most do not publish anything a reader can query. That is a fact about the laboratory rather than about the vendor whose certificate it issued, and it is why an unverifiable certificate is not the same as a doubtful one.

1. A public, lab-wide index. A searchable list of every certificate the laboratory has issued, each resolving to a PDF on the laboratory’s own domain. Among the laboratories Prof. Peptide cites, Freedom Diagnostics is the only one that publishes one, and it covers tens of thousands of search codes. Anyone holding a search code can resolve it without the vendor’s involvement.
2. A per-record verifier. A lookup page that confirms one certificate at a time and requires an access code printed on that certificate. Kovera Labs runs one; there is no queryable list behind it. A reader holding a certificate can confirm it; a reader without one can learn nothing.
3. A login portal, or nothing at all. Some laboratories serve certificates by code without publishing an index; at least one runs an account-gated portal. Neither offers a route that starts at the laboratory.

The practical consequence: the cheap check — looking a vendor up at its laboratory — works for one laboratory. For every other, a certificate has to come from the vendor’s own COA page first, and confirmation is a per-vendor visit rather than a lab-wide sweep. That asymmetry shapes what any certificate-verification claim can honestly cover.

The method has three parts. The certificate is taken from the vendor’s own COA page. The search or access code printed on it is resolved on the laboratory’s domain, producing the laboratory’s copy of the same record. The two files are then compared by checksum rather than by eye — a visual comparison of two PDFs of the same certificate will always look like a match.

What it has returned. On one vendor, five incretin certificates were checked against the laboratory’s own domain: four resolved byte-identical to the vendor’s copies, and the fifth matched in content while differing as a file. On two other vendors the same check was run end-to-end on individual certificates and returned byte-identical results. Those outcomes are recorded per vendor rather than generalised — a clean result covers the certificates that were checked and no others.

Measured across every vendor in Prof. Peptide’s registry backed by the one laboratory with a public index, every four-character prefix held certificates from more than one company. A prefix matching one vendor’s name also returned two other companies with similar names. Another returned a second, unrelated company. One four-character prefix covered thousands of codes belonging to several businesses at once.

An exact per-vendor certificate count therefore requires reading the client field of every code under a prefix, one at a time. Prof. Peptide published two such counts before measuring this and withdrew both. No certificate count appears anywhere on this site unless the vendor or the laboratory publishes it as a figure about itself — a paginator reading “Showing 1–10 of 91” is search-result state, not a vendor’s statement, and seven numbers that looked exactly like vendor figures were refused on that basis.

1. It proves the laboratory issued that record. The document is not fabricated and the relationship between vendor and laboratory is real for that certificate.
2. It does not cover the catalog. One confirmed certificate covers one lot of one compound. Extending it to everything the vendor sells is the same error as reading a specimen page as proof of testing.
3. It does not date the vial. A certificate confirms a lot tested on a date. Whether a vial shipped today belongs to that lot is a separate question, answerable only where the lot is printed on the vial.
4. It says nothing about accreditation. Whether a laboratory holds ISO/IEC 17025 is a separate fact, stated separately or not at all. Accreditation stated as pending is not accreditation held.
5. A failure to resolve is often about access. Roughly one in twelve certificates sampled from the public index were scans with no text layer, unreadable to automated tools and perfectly legible to a person. A page returning an error to an automated request frequently opens in a browser. Prof. Peptide recorded three vendors as blocked on a single failed request and found all three readable on retry.

The client field on a certificate is how the laboratory recorded the company that commissioned the test. It is more reliable than the laboratory’s own website, more reliable than the vendor’s prose, and considerably more reliable than any third party’s summary — this site’s included. Where Prof. Peptide’s registry names a laboratory as verified for a vendor, the record behind it is a certificate whose client field was read directly.

1. How to read a certificate of analysis — the fields that tie a document to a vial, and the difference between a specimen and a certificate.
2. Testing laboratories — the laboratories named across the vendor registry.
3. Vendor COA and testing-transparency index — what each vendor publishes, and which laboratory is named on its certificates.