Certificate verification
Verify a peptide COA
Enter the report number printed on the certificate. Two independent checks run against the laboratory record, and both results are shown.
How certificate verification works
A registry that only answers “this number exists” catches a made-up number and nothing else. It cannot tell you whether the document in your hand still says what the laboratory said, because the document and the database entry were never bound to each other.
Binding them is what the signature does, so the two checks answer two different questions:
- The record is signed. Every scientific field on a released certificate is covered by an Ed25519 signature. The private key is not in the database, so an edit to a purity figure, a mass, a lot number, or a date invalidates the signature and cannot be repaired from inside the system.
- The file is hashed. The released PDF is stored with the SHA-256 hash it had at release. The stored file is re-read and re-hashed on verification, which catches a document swapped after the fact.
- The key is published. The public half sits at /.well-known/coa-signing-key, so the check can be run with any standard cryptography library by someone who does not trust this site at all.
Common questions
What does a verified certificate actually prove?
That the analytical record in the laboratory database matches the one the certificate was issued from, and that the released PDF has not been altered by a single byte since release. It is a statement about the document, not an endorsement of the product.
What does it not prove?
It does not establish safety, efficacy, sterility, regulatory status, or that any other vial matches the one tested. A genuine certificate for one sample says nothing about the vial beside it. Anyone presenting a verified COA as proof of those things is overreading it.
Can I verify a certificate without trusting this website?
Yes, and that is the point of signing it. The public half of the signing key is published at /.well-known/coa-signing-key. Rebuild the canonical JSON of the signed record, SHA-256 it, and check the Ed25519 signature against that key using any standard cryptography library. You never have to take this page at its word.
My report number returns nothing. What does that mean?
Either the number was never issued by this laboratory, or the certificate was never released as public. Private results stay private and do not appear here. If you were handed a document with a number that returns nothing, treat the document as unverified.
What happens if a certificate is withdrawn?
A revocation stays visible. The record remains in place and reports its revoked status rather than disappearing, because a certificate quietly vanishing is indistinguishable from one that never existed.