The Certificate of Analysis is the gray market's security blanket. Here's why it's full of holes.
Know Your Vial Research TeamPublished April 17, 2026 · Updated April 18, 2026
The community's strongest defense is "I test every batch with Jano." They're right that testing is better than not testing. They're wrong that it makes their vial safe. Here's the complete picture of what COAs actually prove, what they miss, and how often they're outright fabricated.
Fundamentals
What Is a Certificate of Analysis?
A Certificate of Analysis is a document from a testing lab stating what's in a sample. It reports the identity of a compound, how much is present, and what percentage of the sample is the target molecule versus impurities.
In the pharmaceutical industry, COAs are issued by accredited laboratories under strict regulatory oversight. Every batch of an FDA-approved drug comes with a COA that covers identity, potency, sterility, endotoxin levels, particulate matter, pH, stability, and more. The COA is part of a regulated chain of custody, and falsifying one is a federal crime.
In the gray-market peptide world, COAs come from two sources: the vendor themselves (second-party, or "2P") or independent labs like Janoshik and Finnrick (third-party, or "3P"). The community mantra is clear: "3P or it didn't happen." But even third-party testing has massive gaps that most buyers never consider.
The Testing Ecosystem
The Two Labs Everyone Uses
An HPLC machine like the ones Janoshik uses. It confirms identity and purity — but can't detect endotoxin, sterility failures, or heavy metals.
Janoshik Analytical
Prague, Czech Republic
The dominant name in gray-market peptide testing. Owner "Peter Magic" (publicly known real name), a former Slovak amateur weightlifter, founded the operation around 2012-2013. The company was formally registered on October 25, 2022. Today it employs roughly 30 people and processes hundreds of tests per day. GLP-1 peptide testing alone accounts for approximately 100 tests daily, with semaglutide and tirzepatide making up 70-80% of total peptide volume.
Janoshik Pricing
GLP-1 blind peptide test: $300. Full GLP-1 panel: ~$828. GC-MS contamination screen: $170 extra. Endotoxin (LAL): $170 extra. Most buyers opt for the base $300 test. Most buyers therefore skip the tests that would actually tell them if their product is safe to inject.
Methods: HPLC with UV detection (primary), LC-MS/GC-MS for identity confirmation, endotoxin testing via LAL (Limulus Amebocyte Lysate), heavy metals via ICP-MS, sterility via TAMC + TYMC. But most of these are add-ons, not included in the base test. The standard $300 blind test covers identity, quantity, and basic purity. Everything else costs extra.
Error margins: ±5% for oils and orals, up to ±10% for liquid suspensions. A vial labeled at 10mg could contain anywhere from 9mg to 11mg and still pass.
Critical Limitations
No ISO 17025 accreditation. COAs lack detailed method specifications. Raw chromatograms require additional payment. Results are not accepted for any regulatory submission. The public database contains cherry-picked results — vendors only post passing COAs. And in February 2026, a customer PII breach resulted in an extortion attempt against Janoshik's clients.
43%
Of all peptides Janoshik tested in 2024 failed their own label purity claims
Janoshik Analytical, 2024 aggregate data
~100/day
GLP-1 peptide tests processed daily — semaglutide and tirzepatide dominate the queue
Janoshik operational data
Finnrick Analytics
The venture-backed newcomer. Founded by Michael Carter (Play.co) and backed by Naval Ravikant, Cameron Teitelman (StartX), and Walter Kortschak. Finnrick has tested 6,626 samples from 203 vendors across 15 peptides — offering free tests for retatrutide, tirzepatide, and BPC-157 with paid add-ons for additional analysis.
~30%
Of peptides are mislabeled, underdosed, or contaminated
Finnrick Analytics, 2024
8%
Of tested samples contain measurable endotoxin contamination
Finnrick Analytics, 2024
15%
Potency discrepancy between labs testing the same product — one lab initially misidentified a peptide entirely
Inter-lab comparison, 2024
Finnrick's retatrutide dataset is especially damning: 2,446 samples from 163 vendors, with quantity diverging up to ±46% from label claims and 10% of samples failing sterility, purity, or dosing thresholds. This is a drug that has no FDA approval for any indication — and the gray market can't even get the dosing right.
Standard ~$300 Blind Test
What the Test Actually Covers vs. What It Misses
Covers (3 of 10)
1. Identity
Is this peptide actually semaglutide? Confirmed via HPLC retention time matching and LC-MS molecular weight. The test verifies the molecule is what the label claims.
2. Quantity vs. Label
Does the vial contain 10mg if it says 10mg? Measured within a ±10% margin. A vial labeled 10mg could contain 9mg and still pass.
3. Basic Purity
What percentage is the main compound vs. impurity peaks? Measured by UV absorbance across the chromatogram. Reports a single number — 98.7%, 99.1% — that the community treats as gospel.
Does Not Cover (7 of 10)
1. Bacterial Endotoxin
Requires separate LAL test ($170 extra). Endotoxins cause fever, septic shock, and death. The JMIR study found them in 100% of gray-market samples. A 0.22μm filter does not remove them.
2. Sterility / Bioburden
Is the vial contaminated with bacteria or fungi? Separate test. A vial can pass HPLC at 99% purity and still contain viable microorganisms that cause septicemia.
3. Heavy Metals
Arsenic, lead, mercury, cadmium. Requires separate ICP-MS test ($170+). These contaminants originate from manufacturing equipment and reagents. Invisible to HPLC.
4. Residual Solvents
Leftover manufacturing chemicals — DMF, DCM, TFA, acetonitrile. Requires separate GC-MS test. Toxic at trace levels. Standard HPLC does not detect them.
5. Amino Acid Sequence
Is the peptide sequence correct, or does it have additions or deletions? Full sequencing is separate and expensive. Novo Nordisk found sequence errors in compounded semaglutide — errors invisible to standard HPLC.
6. Stereochemistry
D vs. L amino acid isomer errors. Completely invisible to standard HPLC. D-amino acid substitutions produce peptides that may be biologically inactive or trigger immune reactions.
7. Batch Consistency
A COA proves ONE vial was tested. It says nothing about the other 999 vials from that batch. The sample you tested isn't the sample you injected.
Purity Is Not Safety
The community conflates HPLC purity with safety. They are not the same thing. You can have a vial of 99.9% pure peptide that is contaminated with bacterial byproducts from a dirty lab — and the standard HPLC test will show 99.9% and give you a passing COA. — Dr. Hillary Lin, MD
COA Fraud
Forged, Fabricated, and Fraudulent
COAs are supposed to be the proof. In practice, they're the most exploited document in the gray-market ecosystem. Here are the documented cases — the ones we know about.
Modern Peptides — Forged Janoshik Certificates
Fabricated test results for products that were never sent to any lab. The COA was a PDF fiction — Janoshik's name, Janoshik's format, entirely fake data. Janoshik confirmed these certificates did not originate from their lab. Customers who checked the COA and felt reassured were relying on a forged document.
Coastal Peptides — Wrong Peptide Entirely
Vials labeled "semaglutide" contained cagrilintide — a completely different, unapproved peptide with different receptor binding and different pharmacology. The vendor's own COA said semaglutide. Third-party testing revealed the truth. Customers injected a substance they didn't consent to.
Peptide Sciences — The Most Trusted Vendor Falls
Finnrick rated their retatrutide "E (Bad)." 37 samples tested, scores averaging below 4 out of 10. Quantities diverging up to 50% from label. This was the community's most trusted vendor — $7.4M/month in revenue. They shut down in March 2026.
YourMuscleShop — "Way Underdosed"
Janoshik testing revealed product significantly below label claims. Customers paying full price received a fraction of the advertised quantity. The vendor's own COA did not reflect these findings.
Nantong Guangyuan Chemical (GYC) — Retracted for Large-Scale Fraud
Finnrick retracted an entire manufacturer's testing history. Not one bad batch. Not one bad product. The entire testing record was invalidated due to systematic fraud at the manufacturer level.
PSL — Wrong Compound Class
Primobolan-labeled product tested as testosterone propionate. Not a dosing error. Not a purity issue. A completely different compound from a completely different class of substances.
Tier-4 Vendor "Semaglutide" — Not Even Close
Molecular weight tested at 2,847 Da versus the expected 4,113 Da for semaglutide. The substance wasn't underdosed — it wasn't semaglutide at all. It was either a truncated fragment or an entirely unrelated peptide. Someone injected this.
The Round-Number Tell
"Real lab results almost never come out to exactly 99.00%." Legitimate HPLC results look like 98.73% or 99.14%. A perfect round number — 99.00%, 98.00% — is a red flag for a fabricated document. If you see one, ask for the chromatogram. If they can't produce it, you have your answer.
43%
Failed purity claims in Janoshik's 2024 aggregate data
Janoshik Analytical
~30%
Mislabeled, underdosed, or contaminated across Finnrick's database
Finnrick Analytics
8%
Measurable endotoxin contamination in tested samples
Finnrick Analytics
±46%
Quantity divergence in retatrutide samples from label claims
Finnrick Analytics
Chain of Custody
The Sample You Tested Isn't the Sample You Injected
This is the gap nobody in the community wants to talk about. You send one vial to the lab. You inject a different vial. The COA covers the first. It says nothing about the second.
Vendors can send their best batch to the lab and sell their worst batch to you. There is no lot tracking, no chain-of-custody protocol, and no way for the end user to verify that the COA on the website corresponds to the liquid in their vial.
The inter-lab data makes this worse. Finnrick and Janoshik show a 15% potency discrepancy between labs testing the same vendor's product. One lab misidentified a peptide entirely — reported it as the correct compound when it was a different molecule. If the labs themselves can't agree on what's in a vial, the COA is not the definitive proof the community treats it as.
Even the Community's Own Guide Agrees
Stairway to Gray — the community's own harm-reduction bible, written by gray-market users for gray-market users — says: "Vendor COAs are as good as toilet paper." They recommend independent testing. But even independent testing only covers 3 of 10 safety factors. The community's gold standard is bronze at best.
The Gap
What Real Pharmaceutical Testing Looks Like
The difference between FDA-approved testing and gray-market testing isn't a matter of degree. It's a difference in kind.
An FDA-inspected pharmaceutical facility. Every batch tested for 10+ safety factors before release.
FDA-Approved Drug
cGMP Manufacturing
Built in inspected cleanrooms under current Good Manufacturing Practice regulations.
Full Batch Testing
Every batch tested for identity, purity, potency, sterility, endotoxin, particulates, pH, and stability before release.
Regulatory Oversight
FDA inspection, ISO 17025 accredited labs, mandatory recall if any test fails. Criminal penalties for falsification.
Stability Data
Long-term and accelerated stability studies prove the drug maintains potency throughout its shelf life under labeled conditions.
Gray-Market with Jano
Unknown Manufacturing
No facility inspection. No environmental monitoring. No cleanroom verification. You don't know where it was made.
One Vial Tested
Identity + purity + quantity only. No sterility, no endotoxin, no heavy metals, no sequence verification. Three of ten factors.
No Regulatory Oversight
No ISO accreditation. No FDA inspection. No mandatory recall. No criminal penalty for selling product that fails. No recall mechanism even exists.
No Stability Data
No shelf-life studies. No storage verification. That lyophilized powder may have degraded during weeks in an unrefrigerated warehouse. The COA can't tell you.
The Reality
FDA-approved GLP-1s are batch-tested for 10+ safety factors in accredited labs. Gray-market vials get 3 tests from a non-accredited lab — if the buyer pays for it. If they don't, they're relying on a vendor PDF.
Forgery, in plain sight
A “COA” on the gray market is usually a JPEG. JPEGs can be edited.
When a vendor says “here’s the Janoshik test for batch 2087,” what you actually get is a screenshot, a PDF, or a photo of a printed page. None of those are tamper-proof. A teenager with Photoshop can change the purity number, the batch ID, the test date, the analyte name, and the signature in under five minutes.
Honest Peptide put it bluntly in their guide for buyers: “It is very easy for unscrupulous suppliers to photoshop results.” The peptide testing community has documented enough cases at this point that “trust the photo” is functionally a security failure mode.
The Modern Peptides case is the cleanest illustration. The vendor posted a Janoshik COA for an NAD+ product. A buyer noticed the QR-code verification key had been scrubbed off the certificate and ran the underlying test number through Janoshik’s public lookup. The actual test on file at Janoshik for that ID was not for NAD+. It was for QSC bacteriostatic water. The vendor had taken a real test of a different product and edited the labels to make it look like a NAD+ COA. The forgery was caught only because the buyer did the verification step almost nobody does.
This is not an isolated case. The Janoshik review at Peptide Protocol Wiki estimates that over 90% of COAs distributed by gray-market vendors contain at least one falsified element — recycled test numbers, fake QR codes, identical batch IDs reused across multiple products, scrubbed verification keys, or doctored purity values.
The verification step almost nobody does
Janoshik runs a public lookup. It takes thirty seconds. Most buyers never use it.
Janoshik issues every test report a unique sample ID. The only way to confirm a COA is genuine is to enter that ID at janoshik.com/verify and read what their database actually returns. If the analyte, batch, and purity match the certificate the vendor sent you, the test is real. If they don’t, you’re looking at a forgery.
In practice this almost never happens. The forum data we’ve seen suggests fewer than one in ten buyers who receive a COA actually verify it through the lab’s portal. The certificate gets glanced at, the percentage looks right, and that’s the end of the buyer’s due diligence. The Modern Peptides forgery sat live on the vendor’s site for an extended period before someone bothered to enter the ID into Janoshik’s lookup.
February 2026 footnote: Janoshik themselves were the target of a data breach. Customer shipping information and database entries were exposed; the attackers attempted extortion. The lab’s verification database is intact and the lookup still works, but it underscores the structural fragility of relying on a single non-accredited Czech lab as the gray market’s last line of defense.
Visual giveaways of a fake
If you’re going to look at a vendor’s COA at all, look for these.
A real Janoshik or MZ Biolabs report has consistent visual features: lab letterhead, named analyst, signature or stamp, ISO accreditation number where applicable, a unique sample ID with QR code, the chromatogram for that specific run, and a date that predates the product’s shipping date. A forgery usually fails at least one of those tests. Common red flags from documented cases:
Identical batch numbers across different products
The same lot ID appears on tirzepatide, semaglutide, and retatrutide listings. Real batch IDs are product-specific. Recycled IDs across product lines are a forgery tell.
Perfect round-number purity, every time
Real chromatograms produce results like 98.34% or 99.27%. A vendor whose COAs always read exactly 99.00% or 99.5% is reusing a template, not running new tests.
Scrubbed QR codes or removed verification keys
The Modern Peptides forgery was caught because the buyer noticed the QR code had been blanked out. A vendor who removes the very element that proves authenticity is removing it for a reason.
COA date predates the product’s manufacture date
If the COA says “tested 2024-03-15” but the vial was filled in October 2025, that test wasn’t for your batch. It was an old certificate stapled to a new product.
Vendor “tested by Jano” claims that don’t verify
A pattern documented across multiple glp1forum.com vendor threads: vendors claim Janoshik testing, but when buyers run the IDs through Janoshik’s lookup, nothing comes back. The verification just fails. The vendor never tested anything.
Even when the COA is real
The vial in your hand wasn’t the one tested.
Set forgery aside for a moment. Pretend every COA you ever see is authentic. There’s still a structural problem most users never think about: the test was run on one vial from one batch. Yours is a different vial.
Pharmaceutical-grade batch testing is supposed to sample multiple vials from the beginning, middle, and end of a production lot to confirm uniformity. Gray-market vendors run a single sample. If the API was unevenly distributed during reconstitution, if a vial was overfilled or underfilled, if a contaminant entered partway through the run — the COA can’t see it. Verified Peptides put the underlying issue cleanly: “A single vial from a batch may accurately represent the lot, or may not.”
This is on top of the fact that gray-market labs like Janoshik don’t test for endotoxin, sterility, heavy metals, residual solvents, or stereochemistry — the safety panel that determines whether the vial actually puts you in the ER. Even a clean COA only tells you the molecule was probably right, in the one specific vial they sampled, on one specific day. None of that travels with the vial you’re injecting.
FDA-approved medications are tested for all ten safety factors before they reach you. Gray-market vials are tested for three — if you're lucky — and the COA might not even be real.
This page documents the scope, limitations, and documented failures of the gray-market peptide testing ecosystem. Data is sourced from published lab reports, aggregate testing data, community documentation, and confirmed fraud cases. Primary sources include:
Janoshik Analytical — published test scope, pricing, methods, error margins, and 2024 aggregate failure data
Finnrick Analytics — 6,626 samples from 203 vendors, retatrutide dataset (2,446 samples from 163 vendors), endotoxin contamination rates
Novo Nordisk — amino acid sequence analysis of compounded semaglutide submitted to FDA
Community documentation — Modern Peptides COA forgery confirmation, Coastal Peptides identity fraud, Peptide Sciences shutdown, GYC retraction
Stairway to Gray (STG) — community harm-reduction documentation, testing recommendations
ISO 17025:2017 — requirements for competence of testing and calibration laboratories
Know Your Vial has no financial relationship with Janoshik Analytical, Finnrick Analytics, or any testing service. We do not sell testing, peptides, or harm-reduction products.
