Lab Testing 101 for the Grey-Market Peptide Scene

A practical, neutral guide to reading lab data on grey-market peptides, SARMs, and hormones — who tests them, what the tests actually prove, what they cost, and how to tell a real certificate from a fake.

This is a harm-reduction explainer about reading lab results, not about using the drugs — no dosing or medical advice. Prices are point-in-time (June 2026) and change constantly; always confirm on the lab's own page. Figures attributed to "our corpus" come from TitrateLab's archive of 22,271 third-party certificates of analysis (COAs), queried read-only; the corpus and its limits are at the end.

This guide is the companion to our data report on 22,271 grey-market certificates. That report is the evidence; this is the field manual — the labs, the tests, the costs, and how to tell a real certificate from a fake.

Why this matters

In an unregulated trade, a certificate of analysis is the only receipt of trust that exists. No regulator asks a grey-market vendor for one; products get tested anyway, because a third-party lab report is the only credibility a seller can buy.

But "it has a COA" is where most buyers stop thinking, and that is the wrong place to stop. A certificate answers a narrow question, and its most-quoted number — purity — is the single most over-relied-upon and misunderstood figure in the scene.

The core idea of this guide is one sentence: purity, quantity, identity, and sterility are four different questions, answered by four different tests, and no one of them tells you about the others. A vial can be 99% pure and half-dosed and the wrong molecule and not safe to inject — at once. This isn't hypothetical: of the 10,493 certificates in our corpus that tested ≥98% purity with a dose measurement, 1,130 (10.8%) were still at least 10% underdosed, and 81 were at least half-empty — at high purity. The reassuring purity number could not see any of it.

Part 1 — The labs

One lab dominates. In our corpus, Janoshik ran 57.3% of all 22,271 certificates (12,763). Most of the rest flow through one aggregator that republishes several labs under coded names — so the market looks multi-lab while the community stream has standardized on Janoshik almost completely. One overseas lab has become the de-facto trust backbone of the English-speaking research-chemical world.

Janoshik Analytical — the dominant lab. EU-based: the entity (Janoshik s.r.o.) is registered in Prague, Czech Republic; the founder is Slovak, which is why "Slovakia" circulates. ("Jano" is just shorthand for Janoshik.) It offers HPLC purity, quantity, mass-spec identity, endotoxin, sterility, heavy metals, and solvent screening, on a ~96-hour advertised turnaround (plan for up to ~2 weeks). It dominates for three reasons: longevity, independence (it publishes failures, not just passes), and one structural lever — many Chinese manufacturers honor refund claims only when the result comes from Janoshik, making it the settlement layer of the whole trade. Every genuine COA carries a Task Number (e.g. #79605) and a case-sensitive Unique Key (e.g. L1SUYDCMGJU5) plus a QR code, checked at janoshik.com/verify — that server-side lookup is the whole point (Part 5). The honest caveat: Janoshik is not ISO 17025-accredited (nor are the other community labs) and has had documented errors. It's the best available option in an unregulated market, not pharma-grade QC — credible-but-fallible.

The others worth knowing:

• Finnrick — not a lab; a testing broker + public database. It tests (largely customer-submitted, anonymized) samples vendors didn't choose, to show "what people actually receive," and publishes vendor ratings. Useful — but it runs paid vendor tiers, so it's a watchdog layer, not neutral ground truth.
• Peptide Test (peptidetest.com) — US broker with the most transparent pricing we found, verified on its order page (June 2026): $200 for common peptides (BPC-157, CJC-1295, Ipamorelin), $300 for GLP-1s and for Endotoxin or Sterility add-ons, $400 for Retatrutide/NAD+/MOTS-c.
• MZ Biolabs (Tucson, AZ) — a DEA-licensed US lab doing purity + mass-spec identity only; it requires a DEA license to ship samples, so it's mostly used by vendors.
• Colmaric Analyticals (Tennessee) — a general contract lab; verify a lot by phone.
• Simec AG (Switzerland) — the genuinely accredited outlier (ISO 17025 + GMP), but primarily a steroid/AAS lab (it powers AnabolicLab); used far less for peptides.
• Emerging US labs (Chromate, Kovera, TrustPointe) surface as vendors diversify — newer, thinner track records, weaker verification. Lab exists ≠ lab is established.

Part 2 — The tests, and what each proves

Here is the one-line map; the rest is detail.

HPLC purity — the famous, narrow number. HPLC separates a sample's components; the UV detector (~214 nm, where the peptide bond absorbs) draws peaks, and purity % = main-peak area ÷ total area of all detected peaks — a relative ratio of the peptide fraction. Its limits are the whole reason for this guide: it is not a milligram count (a ratio has no scale — 5 mg and 50 mg both read "100%"); it is blind to water, salts, and TFA counter-ions (they don't absorb UV); and it does not prove identity (a peptide missing one amino acid can read 99% pure and be the wrong molecule). In our corpus, purity is near-universal (71.9% of certs) and uniformly high — mean 99.04% — and barely separates vendors. That's the trap: the number everyone checks varies least and proves least.

Quantity / amount — the number that actually protects the buyer. This answers the different question: how many mg of active are in the vial vs. label, measured against a reference standard. Because purity and quantity are independent, a vial can be 99% pure and 50% short. This is the corpus's central finding. Dose accuracy is reported on only 50.9% of certs — so for half of all certificates, the buyer-protective number isn't even there. Where it is, the underdose tail is real and compound-specific — the boring, less-scrutinized peptides are worst:

Underfilled by ≥10%, by compound (our corpus): CJC-1295 ~26% · GHK-Cu ~26% · Melanotan II ~25% · Tesamorelin ~18% · Ipamorelin ~17% — versus Retatrutide ~9% and Tirzepatide ~9%.

The sharpest case is GHK-Cu: the purest compound in the archive (99.81% average, 99% of vials at 99%+) is simultaneously among the most short-changed (~26% underfilled), with 50-mg-labeled vials assaying 13–16 mg. They nail the molecule and skimp the pour — and purity testing alone calls every one a pass. (Two subtleties: the typical vial actually runs slightly over label — our median deviation is ~+3.8%, an overfill cushion — so it's the underfill tail, not the median, that matters; and a "% deviation" can be against the printed label or a vendor batch/overfill claim, which give different numbers — deviation-vs-label is the meaningful one for a buyer.)

Mass spectrometry — the identity check. The molecule is weighed by mass-to-charge ratio and compared to the theoretical mass of the claimed sequence — confirming it is what it claims, the thing HPLC can't do. (A documented case: a "semaglutide" sample returned ~2,847 Da against an expected ~4,113 Da — a different compound a purity number would have waved through.) Limits: it doesn't quantify by itself, and can't separate same-mass isomers. The practical gap: on most grey-market COAs, identity is a paid add-on that's simply not run — so absence means "not tested," not "fine."

Purity vs. net peptide content — the hidden mass tax. A peptide ships as a salt (usually TFA, from synthesis) and holds water — so the actual peptide mass is less than the gross powder weight, and purity doesn't show this either (it's a ratio of the peptide fraction only). A peptide can be 99% pure yet only ~70–85% net peptide content — completely normal — because counter-ions and water (invisible at 214 nm) make up the rest. Most grey-market COAs don't report net content; the mg quantity figure partly stands in. The point: "99% pure" is not "99% peptide by weight," and neither is "the labeled dose."

Endotoxin and sterility — the injection-safety axis nobody tests. Two different safety questions, neither addressed by purity or quantity. Endotoxin is the toxic residue of Gram-negative bacteria — a pyrogen causing fever and, at high exposure, a shock-like cascade — and it does not require live bacteria. It's measured by the LAL test in EU/vial, and its pass limit is dose-dependent (it scales with how much you inject), so there's no single universal "safe EU" number; community labs commonly reject around 40 EU/vial. Sterility asks whether anything is alive (a ~14-day culture) and is different — a vial can be sterile yet pyrogenic, or carry live organisms with low endotoxin. You need both, and grey-market lyophilized powders are essentially never validated-sterility-tested.

This is, by the numbers, the single biggest gap in the corpus. Only 659 of 22,271 certificates (3.0%) carry any real endotoxin result — 97% don't. The most common machine-readable concern in the whole archive is literally "no endotoxin test," flagged on 10,473 certificates. For a product class that is injected, the dominant defect isn't a failed value — it's the absence of any sterility data. (Among the few that test, contamination is real: values run up to 600, 984, even 2,306 EU/vial — orders of magnitude above any plausible injectable limit.)

The rest, briefly: heavy metals (ICP-MS — lead, arsenic, cadmium, mercury; limits ~10× stricter for injectables), residual solvents (GC), water/moisture (Karl Fischer — residual water ~5–12% is part of the gross mass), and appearance (a visual check; weakest test, but a discolored or clumped cake is an instant flag). All are rare on grey-market COAs.

Part 3 — Costs (and why they keep moving)

There's no fixed price sheet; every figure is a snapshot. Roughly, June 2026:

• A single peptide purity + quantity test runs ~$80–$200 by lab and compound. (Janoshik's exact price could not be confirmed first-party — its pages are Cloudflare-protected — but is community-cited at ~€80–€150; Peptide Test's verified floor is $200.)
• GLP-1s cost more — commonly ~$300 standalone — because they need a more involved setup. Janoshik's screens are community-cited at ~$120 (steroids) and ~$170 (SARMs/contamination).
• Add-ons stack: endotoxin and sterility are typically $90–$300 each as separate line items. A full GLP-1 panel (purity + sterility + endotoxin + heavy metals) is cited at ~$828.
• Extras: rush ~doubles the price; international shipping to the EU lab is ~$50–$75 (you pay); and publishing a Janoshik result to its public showcase has historically been a paid add-on — part of why that showcase skews toward passes.

The reading: a complete safety-and-dose workup costs multiples of the bare purity test — which is exactly why the bare purity test is what you usually see, and why sterility data is almost always missing.

Part 4 — How to submit a sample, and how to read the COA

Submitting (the Janoshik workflow as the model): You order and pay first — browse the per-compound page (or email info@janoshik.com for an unlisted compound), and at order time specify the physical form (oil / oral / raw / liquid) and the analysis class (peptide vs. HGH vs. SARM vs. steroid), which are separate setups. Then ship the sample — lyophilized powder in its original vial is the usual case; the core assay needs only ~10–20 mg, but sterility and endotoxin add-ons need whole, unopened vials. Testing is destructive — the vial isn't returned. Two steps trip people up: write your order number on the outside of the parcel, and enter the tracking number into your order page before it arrives (Janoshik rejects un-pre-registered shipments). You get the COA by email + dashboard.

Vendor-commissioned vs. independent — the distinction that matters most: a vendor-supplied COA tests a vial the seller chose; an independent (third-party) test means a customer bought a normal sales vial and submitted it anonymously. The independent test is far stronger — the vendor controls nothing, can't pick the vial, can't bury a bad result. Group buys (a community splits one ~$300 test on a randomly chosen vial) extend this, but carry their own risks: an organizer absconding with pooled crypto, or chain-of-custody doubt that the tested vial matches yours.

Reading the COA, field by field:

• Compound / identity — must match your order and the verify page. The printed name is only a claim until mass spec confirms it.
• Purity % — floor ~95%, ~98% preferred, ~99% excellent. Good: a specific decimal (98.73%). Red flags: suspiciously round or identical numbers across products and months. (Some compounds legitimately run lower — ~96–97% retatrutide is normal.)
• Quantity (mg vs. label) — expect ~±5–10% of label; a small intentional overfill is benign. Underfill beyond ~10–12% is the buyer-harmful flag.
• Identity (mass spec) — observed vs. theoretical mass. The highest-stakes omission is no MS at all (but it's a paid add-on, so absence = "not tested").
• Endotoxin / sterility — in EU/vial or "not detected." Usually absent (paid add-ons) — normal for a basic COA, but a real safety gap. Red flag: an absolute "0" (the test has a detection floor, so exact zero suggests fabrication).
• Batch / lot ID — must match your vial's label. A missing batch number, a mismatched lot, or one COA reused across products are major flags.
• Test date — within ~6 months ideal; over a year is stale. A test date before the manufacture date is impossible — i.e. fabricated.
• Verification block + lab name — the Task Number, case-sensitive key, and QR (Part 5); a named, verifiable lab. Be skeptical of unverifiable "ISO-certified" claims and in-house-only testing.

Part 5 — Spotting fakes

The trust model in one line: anyone with Photoshop can fabricate a PDF with any number they want — but they cannot create a matching record inside the lab's verification database. The certificate image is not the evidence. The lab-side lookup is.

Two distinct failures get conflated:

• Document fraud — a forged, altered, recycled, or mis-linked certificate. Verifying on the lab's own server catches this.
• Sampling fraud — a genuine, perfectly-verifying COA describing a cherry-picked batch that isn't what ships. Verification does not catch this — only testing your own vial does.

The common scams:

• Photoshopped COAs — editing a real lab's template to bump a number or swap a name. The reliable catch is the server-side lookup; the strongest no-lookup tell is suspiciously perfect or identical purity across products. (There's an FDA warning-letter precedent for a maker pasting another lab's results onto its letterhead.)
• Recycled / reused COAs — testing one good batch once, then presenting it as if it covers every batch forever. Catch it with batch/lot mismatch (different batches get different keys) and stale dates.
• Mismatched or dead verification links — documented, not theoretical. In one well-traced case a vendor posted a Janoshik "NAD+" COA with the key/QR deliberately removed; the community matched the underlying test number to bacteriostatic water from a different supplier. In another, a buyer entered a posted task number and the key simply wasn't in Janoshik's database.
• Why you must originate the lookup yourself — the verifiable record lives on the lab's domain, which the vendor can't edit or hide, so a vendor-supplied image, PDF, or even a "screenshot of the verify page" can all be forged. Type the report number into the lab's own verify page yourself and confirm every field matches. A QR that's broken, missing, or that loops back to the vendor's site is a tell.
• The subtlest one — vendor-commissioned bias — where the COA is 100% real and verifies perfectly yet is weak evidence: the public showcases are pay-to-publish (you see what vendors want you to see), an honest lab can only test the vial it's handed, and in-house testing is "a student grading their own exam."

Quick "tells of a fake": perfect/round or identical purity; no batch number, or a lot ≠ your vial; old date, or one COA reused for "all batches"; an HPLC number with no chromatogram and no mass spec; an unverifiable lab name; a broken/missing QR, or one pointing at the vendor's domain; a verify lookup that 404s or shows a different result; "COA on request" only; in-house testing only.

Part 6 — The limits: what testing cannot tell you

Even a perfect, independently-commissioned, server-verified COA has hard boundaries:

• A certificate covers one sample — not a vendor, and not your vial. Quality swings batch to batch even within a single seller; a real COA from a tested batch tells you nothing about an untested batch shipped under the same label.
• The public record is filtered. Submission is selective (vendors choose what to send) and showcases are pay-to-publish, so the visible corpus flatters the market. One audit estimated that all submissions — including the private ones that never publish — fail at a far higher rate than the ~99.7% median purity of the public database suggests. (That exact rate isn't independently verifiable, but the direction — public results are rosier than reality — is well established.)
• Purity is the most over-trusted and narrowest number — blind to dose, identity, salt/water load, and sterility. Our 1,130 high-purity-but-underdosed certs make that concrete.
• Sterility is barely tested. 97% of certs carry no endotoxin result; no purity figure substitutes for it.
• Most COAs skip identity confirmation (mass spec is a paid add-on), so a typical COA proves "clean and roughly the right amount," not "definitely the right molecule."
• None of the community labs is accredited. They're fallible fee-for-service labs, not regulatory QC.

The honest bottom line: third-party testing is the single most useful tool a buyer in this market has, and a recent, batch-matched, independently-commissioned, server-verified COA reporting both purity and quantity is genuinely worth far more than a vendor's word. But it answers a bounded set of questions, the most-quoted answer is the least informative, and no certificate makes an unregulated product safe. The molecule has gotten clean. The dose is still a coin flip — and the vial in your hand was never on the certificate.

Methods, sources, and what we couldn't verify

Our data. "Our corpus" figures come from TitrateLab's archive of 22,271 third-party COAs, queried read-only (June 2026); 57.3% were run by Janoshik, most of the rest through one aggregator using coded lab names. Coverage is uneven and stated where it matters (purity 71.9%, dose-deviation 50.9%, a real endotoxin result only 3.0% / 659 certs). Dose accuracy is measured strictly as tested-vs-printed-label. About a third of the corpus is reconstructed from public dumps and dead links, so we report proportions, never raw growth, and never treat one bad certificate as proof of fraud.

Web research drew on lab pages, pharmacopeial/FDA primary docs, independent audits (vialaudit.com), and community forums (GLP-1 Forum, Reddit, MESO-Rx). Key domains: janoshik.com (+ verify./public.), finnrick.com, peptidetest.com, mzbiolabs.com, simec.ch, anaboliclab.com; plus USP/ICH chapters for the methods (USP <85> endotoxin, <71> sterility, <232>/<233> metals, <467> solvents, <1052> amino-acid analysis) and Bachem/GenScript guides for purity-vs-net-content.

Flagged as uncertain — read as cautions: Janoshik's exact base price isn't first-party-confirmed (Cloudflare-protected); the €80–€150 / $120 / $170 / $828 figures are community-corroborated, while Peptide Test's prices were verified on its live order page. Janoshik's location (Czech vs. Slovakia) and the free-vs-paid public listing are best-available evidence. Mass-spec match tolerance and net-content/TFA/water percentages are source- and peptide-specific ranges; endotoxin pass limits are dose-dependent (no universal EU number). Several viral statistics — "~40% of online peptides are photoshopped/underdosed," "43% of Janoshik submissions failed in 2024," "23% of retatrutide contains exendin-4" — could not be traced to a primary source and are deliberately not cited as fact. And Strate Labs, Amino Asylum, Tailor Made, and the FDA warning-letter wave are real enforcement cases about mislabeling / unapproved-drug marketing, not documented COA forgery — not fake-COA examples.

This guide documents an unregulated market; it does not endorse participating in one, and offers no medical or dosing advice. No vendor is "safe."