How We Check Every Certificate

What This Page Covers

Every carried product in our catalogue is scored from the certificate of analysis on file for it, using the lab rule published on How We Rate (rules A1 to A9). This page does not add a second set of rules. It explains how we check the evidence those rules score, and it rolls up, vendor by vendor, the same per-product results each vendor page shows in its “Lab credibility” working.

Of 2,359 carried products scored across 100 vendors, 1,436 (61%) have a certificate whose key we confirmed at the issuing laboratory, 175 have a certificate scored the flat 2.0, and 567 score 0, 526 of them because no certificate is published (figures as of November 6, 2026).

All 100 vendors in the directory are in this table.

What You See on Vendor and Product Pages

Each vendor page has a Lab credibility panel that lists every carried product, the certificate used, its laboratory and that laboratory's tier, the test date, and every point the lab rule gave it, then the mean, each adjustment with its code and reason, and the rounded result. The certificate column on vendor and product pages links to the certificate the vendor publishes, labelled by the same rule:

• ✓ Verified: we read and checked the certificate, or confirmed its key with the issuing laboratory, and the rule credits it (it is not a flat 2.0 or a 0).
• View COA: a certificate is published and scored, but we have not yet read it in full or confirmed it.
• View COA (key not found at lab): the key printed on the certificate was not found at the laboratory (rule A5).
• View COA (differs from lab copy), with a link to the Lab copy: the vendor's posted copy differs materially from the laboratory's own copy (rule A4).
• View COA (lab record: fail): the laboratory's own record reports a FAIL (rule A4).
• Vendor-issued, Vendor report (lab not established) or No lab named: a document scored the flat 2.0 (rule A3).
• No public COA (or None): no certificate was published for the product when we checked. Login-gated means certificates sit behind the vendor's account wall (rule F3 on How We Rate).

Earlier versions of this page described document badges such as “OCR” and “PDF text”. The site no longer shows them: a certificate's score depends on what it contains and what the laboratory's record shows, not on how we read the file.

How a Certificate Is Checked

1. Read the certificate. For every product we list, we open the certificate the vendor publishes and record the laboratory, product, batch, test date, the tests run (identity, purity, endotoxin, sterility), the purity figure and the verification key, the report number or access code the laboratory issues for that test.
2. Check it at the laboratory, not the vendor. Where the laboratory offers a lookup or hosts its own copy of the report, we look the key up there. A copy hosted on the vendor's own site is not a confirmation. We also check that the lookup really belongs to the laboratory: the laboratory's own site must point to it, and its domain must not be newer than the reports it serves.
3. An invented-key control on every laboratory route. Each route is also tested with a key we made up. A lookup that returns a report for an invented key cannot confirm anything, and results from it are not counted as confirmations.
4. Letter-case variants and retries. Some laboratory hosts are case-sensitive. Before a key is recorded as not found, we try it as printed and in its other letter-case forms, through the laboratory's own lookup, and we retry later.
5. An error is never “not found”. A server error (5xx), a timeout or a bot challenge page tells us nothing about the report. It is recorded as unchecked and tried again; it is never scored as a missing record (rule A5).
6. Some lookups need a real browser. A few laboratory lookups, including those of MZ Biolabs, Janoshik and BioRegen, do not answer automated requests. Those are checked by hand in a real browser, and the result is recorded with the date.
7. Compare the record with the vendor's copy. When the laboratory's record is found, we compare it with the copy the vendor posts: product, quantity, purity, client and test date. Formatting, a re-saved file, or a hyphen or typo in a lot label is not a material difference (rule A4).

Per-Vendor Breakdown

Each carried product is counted once, in the column for the result the lab rule gives its certificate. Gate is the number of products with a lab-confirmed certificate that counts under rule A9, out of all scored products; “(cap)” means fewer than half, so the testing cap applies. Lab is the vendor's lab sub-score (rule A8). Evidence is the 0 to 100 reader summary described under “Evidence Tiers” on How We Rate; it does not feed the rating. Vendors are ordered by lab sub-score.

When a Finding Goes Against a Vendor

A finding that lowers a score, such as a key not found, a copy that differs from the laboratory's, a laboratory FAIL, a laboratory whose independence is not established, or an adjustment under rule A7, is not relied on until it has passed two steps.

• An independent second check. The finding is checked again from the primary source, the laboratory's own record or the vendor's live page, by a second check that did not make the original finding. Every report a finding rests on is resolved on its own; checking one document from a set does not stand in for the others.
• Preserved evidence. Before the finding is published, we save timestamped copies of every page and file it rests on, byte for byte, with the HTTP status and headers of each request (a “not found” answer is evidence too) and a SHA-256 fingerprint of each file, so any later copy can be shown to be identical. These copies are kept privately and are not published; they exist so that the finding can be reproduced and checked later.
• Re-tested every day. Per-certificate findings (a key not found under A5, a copy that differs or a laboratory FAIL under A4) are re-tested at the laboratory each day. If a key that was not found now resolves, or a record changes, it is flagged for correction at once.

Standing Checks

• Daily. The per-certificate findings above are re-tested at the laboratory. A rotating share of lab-confirmed certificates is looked up again at laboratories whose lookups can be queried automatically, so a record that is withdrawn or amended after our audit does not stay marked as confirmed. Certificate links, product pages and store status are sampled for changes.
• Weekly: a blind re-audit. The vendors whose audits are oldest are re-audited from their live sites by a check that cannot see our stored scores or findings. Its results are compared with the published record, and every disagreement is opened for review. It never changes data on its own. Vendors whose sites block automated access are re-audited the same way by hand.
• Monthly: the public-notes check. The notes shown on every vendor page are compared with the underlying data by one review and then confirmed by a second, independent one. Anything that no longer matches is reported for correction.
• On every update: the publish gate. The site cannot be updated unless the data integrity check passes (every sub-score must be derived from its itemised basis, and a certificate cannot be marked lab-confirmed without a key on record), the methodology self-test passes, and the built site passes its audit.
• The methodology self-test. The scoring code is run against the rules printed on How We Rate, point by point, on test data, before every update. If the code and the published rules disagree, the update is blocked. The test also checks that the rule numbers this page cites are the ones How We Rate prints.

How Laboratories Are Graded

Every laboratory in our lab directory is graded by the same six checks, and only from evidence we can cite with a link and a date:

• L1 Real business. A business-registry entry for the operating company, or a physical street address together with named staff.
• L2 Independence. The laboratory's domain predates the earliest report we hold from it; its reports name more than one unrelated client, or it publicly offers testing to the public; it has no ownership, address, staff or hosting link to a vendor we list; and its lookup does not run on a vendor's site.
• L3 Verification route. A public lookup or laboratory-hosted copy that returns the report for a real key and rejects an invented one. A library that lists only what clients choose to publish counts as partial.
• L4 Identity method. Identity by mass spectrometry passes; identity by HPLC retention time alone is partial.
• L5 Track record. At least 12 months of dated reports and at least three unrelated clients.
• L6 Accreditation. ISO/IEC 17025 accreditation shown as active on the accrediting body's own public register, with a scope that covers peptide testing. A laboratory's own claim or a logo on a certificate does not count.

The tier follows from the checks: D when L1 or L2 fails; C or B- when L3 fails; B when L3 is partial; B+ when L4 is partial; A- when L1 to L4 pass but L5 does not; A when L1 to L5 pass; and A+ when L6 passes as well. A laboratory's tier enters a vendor's score only through rule A2 (+2 for tiers A+ to B-, nothing for tier C, and +1 for accreditation when L6 passes, on certificates tested on or after the date the register shows it active) and rule A3 (the flat 2.0 for tier D). Each laboratory's tier and the evidence for it are on its profile in the lab directory.

What Our Checks Cannot Tell You

• We verify documents and laboratory records, not vials. We check the certificates vendors publish against the laboratories' own records. We do not buy products and send them for testing ourselves.
• A confirmed certificate describes the sample that was tested. It tells you who tested a sample and what they found. It does not prove that the vial you receive came from the same batch, or that the vendor itself sent the sample.
• Client-published libraries are only as complete as the client makes them. Where a laboratory lists only the reports its clients choose to publish, a match confirms that report, but an absence proves nothing, which is why it counts as “not confirmed” rather than “not found”.
• Everything is dated. Each observation is what we saw on the date recorded on the vendor page. Sites, certificates and laboratory records change; check them yourself before you buy.

If something on a vendor page is wrong, tell us through the Submit page with the evidence. We check it, and if we were wrong we correct the page and record the change in the vendor's audit history.