How to Read a Peptide Certificate of Analysis (and What It Cannot Prove)

A certificate of analysis is a lab report on one sample from one lot. Read properly it answers four questions: is this the right molecule, how much of it is there, what else is in it, and is it safe to inject. A seller’s PDF usually answers one of them, and that one can be true while the vial is wrong. When researchers bought semaglutide from illegal online sellers, the paperwork claimed at least 99% purity. The powder in the vials was 7.7% to 14.4% semaglutide by weight, bacterial endotoxin was detected in every vial, and each held 29% to 39% more drug than its label said.^[1][2] A certificate cannot tell you what is in your vial. It can tell you whether the seller is even trying.

What a certificate of analysis is, and who it is for

In the regulated drug supply, a certificate of analysis is a document passed between businesses. The company that makes a raw drug ingredient tests each lot and sends the results with it. Federal law requires one: a 503A compounding pharmacy may only use a bulk ingredient that comes with “valid certificates of analysis,” and a 503B outsourcing facility may only use bulk ingredients “each accompanied by a valid certificate of analysis.”^[4][3]

Even then, the buyer is not allowed to take the certificate at its word. FDA’s manufacturing rules say a drug maker may accept a supplier’s report of analysis only if it runs at least one specific identity test of its own on that ingredient and periodically checks that the supplier’s results hold up.^[5] The finished batch is then tested again before release, for “the identity and strength of each active ingredient.”^[6]

So the system that invented the certificate treats it as a claim to be checked, between professionals who can check it. A peptide seller that emails a PDF to a consumer has reversed that. The document now goes to the one party with no way to test it.

The lines on a peptide COA, and what each one can and cannot tell you

FDA’s draft guidance for outsourcing facilities lists the minimum a finished sterile batch should be checked for before release: identity and strength of the active ingredient, purity, and, for products sold as sterile or free of fever-causing substances, sterility and a limit for bacterial endotoxins. It names USP <71> as the sterility method.^[8] A certificate that reports only purity has covered one row of that list.

Purity is not content: the 99% that was 8%

The most common number on a peptide certificate, and the most misread, is HPLC purity. The instrument separates the sample into peaks, and purity is the main peak’s share of the signal. That number says the detected material is mostly one substance. It says nothing about how much of the powder that substance makes up. Salts, water, fillers and anything the detector does not register are outside the calculation.

The Hungarian study shows the gap in practice. Researchers at the University of Pécs placed test orders for semaglutide with six illegal online sellers; three vials arrived, and the three orders for Ozempic pens were never delivered.^[1] The sellers’ documentation claimed purity of at least 99%. On the chromatogram, each sample showed a single semaglutide signal with no peptide-like impurities, so a seller could honestly print a high purity figure. Weighed against the whole powder, though, semaglutide made up 7.7%, 9.0% and 14.4% of what was in the vials.^[1]

Two things went wrong at once, and they point in opposite directions. Most of each vial was something other than semaglutide. And the semaglutide that was there ran 29% to 39% above the label, which the authors note means users could inject up to 39% more drug per dose than they intended.^[1][2] For comparison, a genuine Ozempic pen tested in the same lab came in 5% over its stated content.^[1] The study’s own conclusion is the useful one for a buyer: research-grade “99% purity” and pharmaceutical quality are different things.^[1]

That is why the assay line matters more than the purity line. An assay reports milligrams of peptide in the vial, measured against a reference standard. If a certificate gives purity but no content figure, it has not told you the dose. Our guide to what is in a compounded GLP-1 vial covers why the milligram figure and the concentration you mix to are the numbers that decide what you inject.

Identity: is it the molecule on the label?

HPLC alone cannot prove identity. A peak at the expected time is consistent with semaglutide, but another substance can sit in the same place. Mass spectrometry weighs the molecule, and a matching mass is the usual identity evidence on a peptide certificate. A useful identity line shows the expected mass, the observed mass, and the trace. A bare “conforms” shows nothing.

Identity failures are not hypothetical. In the Netherlands, two people with neither diabetes nor obesity injected semaglutide bought without a prescription and arrived at hospital in a coma with severe low blood sugar. The cause was synthetic insulin.^[12] The authors note that semaglutide on its own does not cause significant low blood sugar in healthy people. FDA warns that counterfeit Ozempic could contain the wrong ingredients, too little or too much of the drug, or none at all.^[10]

Identity also includes the form of the molecule. FDA has said that semaglutide sodium and semaglutide acetate “are different active ingredients than are used in the approved drugs,” that it does not know whether they behave the same way, and that it is not aware of any lawful basis for compounding with them.^[10] A certificate is often the only place a salt form shows up. If the product name on the COA ends in “sodium” or “acetate,” that is the answer. What cannot legally be compounded covers the rule.

A standard peptide certificate also leaves out whole classes of contaminant. Belgian regulators tested the ten falsified peptide drugs they saw most often, bought from three suspected illegal internet pharmacies. They found purity as low as 5% for some peptides, plus arsenic and lead, with several samples at up to ten times the international toxicity limit for injected drugs.^[13] Metals and residual solvents need their own tests. A purity percentage does not cover them.

Endotoxin and sterility: the lines that matter most for an injection

In its warning letters to research-peptide sellers, FDA explains why injectables worry it most: they go directly into the body and “bypass some of the body’s key defenses against toxins and microorganisms.”^[11] Two tests address that, and many seller certificates include neither.

• Bacterial endotoxin is residue from the cell walls of bacteria. It survives after the bacteria are dead, so a product can be sterile and still contaminated. FDA’s draft guidance for outsourcing facilities says endotoxins “can lead to reactions ranging from fever to death in patients receiving injections.”^[8] The standard test is USP <85>.^[9]
• An endotoxin number needs a limit beside it. FDA says the right limit is calculated from the dose and dosing schedule using the USP method.^[9] A line reading “2 EU/mg” with no limit and no pass or fail is a measurement, not a verdict.
• Sterility is tested by trying to grow microbes from finished units, and FDA points outsourcing facilities to USP <71>.^[8] A sterility result applies to the units tested, under the conditions tested.

The Hungarian vials passed one of these and failed the other. No live microbes grew from the powders at the time of testing, but the authors reported endotoxin in all three. One sample, at about 9 EU per milligram, they read as a sign of contamination during production.^[1] None of the sellers’ documents reported an endotoxin limit to compare against. A sterility pass on a freeze-dried powder also stops at the vial. It cannot account for the water, syringe and handling a buyer adds at home.

What a 503B batch has behind it, and what a research seller’s PDF has

A 503B outsourcing facility is held to federal manufacturing rules, and a batch it releases sits on a stack of records. A 503A pharmacy must still use bulk ingredients that come with valid certificates, but it answers mainly to its state board rather than to the federal manufacturing standard. 503A vs 503B pharmacies explains the difference. A research-labeled seller sits outside both.

Neither column makes a compounded drug FDA-approved, and a 503B record does not prove that a given vial is perfect. It does mean that someone with authority can ask for the batch record and compare it to the vial. Nobody can do that with a research seller’s PDF.

Impurities a purity number can hide

A purity percentage only covers impurities the test method was built to separate and detect. Two laboratory studies, both written by employees of the brand manufacturers, show what that leaves out. Testing for Eli Lilly found a previously unknown impurity across compounded tirzepatide products that contain vitamin B12, formed when tirzepatide reacts with certain forms of the vitamin.^[14] Testing for Novo Nordisk of 16 injectable semaglutide versions found new impurities that the brand product did not have, including high-molecular-weight proteins, trace metals, counterions and residual solvents.^[15] Both companies have a commercial interest in those findings. The underlying point is still standard chemistry: a method only finds what it is designed to look for. If you are weighing a combination product, see why compounded semaglutide is mixed with B12.

Red flags on a certificate of analysis

• No lot number, or a lot number that does not match your vial. A certificate describes one lot. Without a match it describes someone else’s product.
• The same certificate on every lot. If the test date, results and lot number never change across months of sales, the document is a marketing asset, not a test result.
• No laboratory named, or a lab you cannot reach. “Third-party tested” means nothing without a lab name, an address and a way to confirm the report with the lab directly.
• Purity of 99% or higher with no chromatogram. The trace is the evidence. A round number without it is an assertion.
• Purity but no assay. Without milligrams of peptide per vial, the certificate has not told you the dose.
• Identity marked “conforms” with no expected and observed mass. The mass spectrum is the identity evidence.
• No endotoxin or sterility result for a product meant to be injected.
• A salt form in the product name, such as semaglutide sodium or acetate, which FDA treats as a different active ingredient.^[10]
• Test date long before you bought it. A peptide tested at production can degrade in storage and transit.

The reverse is not true. A certificate with a lot number, a named lab, a chromatogram, a mass spectrum, an assay, endotoxin and sterility results is a better document. It still describes a sample the seller chose and sent. It cannot show that your vial came from that lot, or that it was stored cold on the way to you.

What FDA’s warning letters say about research-only sellers

FDA does not judge these sellers by their paperwork. It judges them by what the product is for. Our register of FDA warning letters naming GLP-1 drugs holds at least nine letters, dated 2024 to 2026, in which FDA quotes a seller’s “research purposes only” or “not for human consumption” labeling and then finds that its website shows the products are drugs meant for people.^[11] FDA’s position is that semaglutide, tirzepatide, retatrutide, survodutide and mazdutide sold this way are falsely labeled, sold for human use with dosing instructions, and “of unknown quality.”^[10]

A certificate does not change that status. A clean-looking COA on an unapproved, research-labeled vial is a well-documented unapproved drug. Buying tirzepatide as a research chemical covers what the label costs the buyer, and how to verify an online GLP-1 pharmacy covers the checks that do have public records behind them.