Two peptide sellers argued about who has a real certificate. Nobody could settle it, so we checked all 41 vendors we track.

Every figure below is computed from the TitrateLab certificate corpus and the vendor catalogues we ingest, as of August 1, 2026. The exact queries ship alongside this article in who-actually-has-a-coa.queries.sql so you can re-run them and disagree with us using our own data.

The argument that started this

On BlackHatWorld in April, someone asked why his Google ads for peptides went nowhere while other companies showed up in Canadian search results. A reply explained that the companies advertising legally in permissive markets “have different regulations and valid certifications/licenses.” The original poster answered in one line: “these website, do not have certificates guaranteed.”

Then the thread moved on, with the point unsettled.

That exchange is worth more than it looks. Two people who sell this product for a living reached opposite conclusions about whether the certificates in their market are real, and the argument ended not because someone won but because there was nothing either of them could point at. They were not even discussing the same object. One meant advertiser licensing. The other meant lab certificates. The word “certificate” was doing two jobs and nobody noticed.

There is no third party in that conversation. We are trying to be it, so this is the check.

What we checked

We track 41 vendors in vendor_pricelists_canonical, our reconciled catalogue table. Between them they carry 11,554 offer rows, of which 1,003 are currently in stock across 21 vendors. 6,227 of those rows carry a China origin and 4,089 a US one, with 27 of the 41 vendors shipping at least some China-origin stock. These are source-tier manufacturers and wholesale channels, not consumer brands, which is an important limit and we come back to it at the end.

The corpus we check them against holds 62,079 published certificates attributed across 3,860 distinct manufacturers.

Three questions, one per column:

1. Does this vendor have any published certificate at all?
2. Does it have one from a laboratory we can name?
3. Does it have one tested in the last twelve months?

The second question needs a definition, because a large minority of certificates in this market do not tell you who ran the test. Across the whole corpus, 52,383 certificates name a laboratory, 8,944 are published under an anonymised lab letter (LabA through LabG, the convention Finnrick uses when it publishes a result without disclosing which lab produced it), 413 record no lab at all, and 339 carry a placeholder string instead of a lab name. For this article a certificate counts as coming from a named third-party lab only if the lab is identified and is not the vendor itself. Two vendors in our set have self-tested certificates, ABC and QST, and those rows are excluded from their own named-lab column.

For the third question the cutoff is a test date on or after 2025-08-01. Note that 957 published certificates in the corpus carry no test date at all. They count in the “any certificate” column and can never satisfy a recency test.

Every vendor we track, and what we hold

Sorted by live in-stock rows, then by certificate count. “Named” is certificates from an identified third-party lab. “Since Aug 2025” and “since Feb 2026” count certificates by test date.

Totals: 36 of 41 vendors have at least one published certificate, 35 have at least one from a named lab, 36 have at least one tested since August 2025, and 34 have one tested since February 2026. Five have nothing.

The blunt version of the finding is that the pessimist in that forum thread was wrong about this tier of the market. Most of these vendors do have certificates, most of those certificates are recent, and the biggest ones have hundreds. If you buy from a source manufacturer that publishes into the group-buy channels, third-party testing is normal rather than exceptional.

The optimist was also wrong, in a different way, and the rest of this article is about how.

The five with nothing, stated carefully

ANGELIA, EMMY, FG, HNYH and TRT have no certificate in our corpus. That claim needs its guardrails visible, because it is the kind of sentence that can be unfair even when the query is right.

HNYH and TRT both exist in our manufacturer table as identified companies with full alias sets, HNYH Peptides and TRT Peptides, and have zero certificates attached to either. ANGELIA, EMMY and FG have no manufacturer row at all: nothing in the corpus has ever been attributed to them.

Before publishing that, we swept the free-text vendor fields on every published certificate for each name, in case the resolver had missed an attribution. HNYH, ANGELIA and EMMY return zero text hits. The TRT sweep returns five rows: four belong to a different seller trading as TRTarSauce, and the fifth has Wholesale in the vendor field. The FG sweep returns one row belonging to LFG LABS. None of those are the vendors in question. The zero survives the sweep.

Four of the five are also not currently selling anything through the channels we watch. ANGELIA has not updated since March 3, EMMY since July 28, HNYH since June 5, TRT since June 2, and none of them show a single in-stock row today.

FG is the exception and the sharp case. It carries 11 in-stock rows as of August 1, most recently refreshed on July 31, and we have never seen a certificate for it. All 11 rows are the same product at different strengths: HGH, China origin, US delivery, from 10mg through 217IU. So there is exactly one thing FG is selling right now, and we hold no certificate for it from this vendor. Two vendors have HGH in stock today. The other one, QSC, holds 32 HGH certificates, most recently tested 2026-03-24. Across the whole corpus, HGH is thinly evidenced by comparison: 280 certificates labelled HGH, plus 74 labelled Somatropin and 12 labelled rHGH, against 10,385 for retatrutide and 7,746 for tirzepatide.

A certificate is not a certificate

Here is where the optimistic reading falls apart.

Of the 3,641 certificates we can attribute to these 41 vendors, 2,276 name a third-party laboratory. That is 62.5%. The remaining 1,365 are documents that assert a result without disclosing an independent lab that produced it: 703 under LabE, 318 under LabG, 270 with no lab field at all, 42 carrying a placeholder string, 17 under LabA, 11 under LabF, and 4 where the vendor is recorded as having tested its own product.

Two vendors show what that looks like at the extremes.

ZJ has 59 certificates and zero named labs. Thirty-five are published as LabE and twenty-four as LabG. Every result ZJ has to show is a number attached to a laboratory nobody has identified. (ZJ is not currently selling through the channels we watch: 30 catalogue rows, none in stock, last updated July 4.) If you were the seller in that forum thread arguing that your competitor’s certificates are not real, this is the shape of the vendor you would be describing, and you would be half right: the tests appear to have happened, and you cannot audit who did them.

ERP is the version that matters commercially, because ERP is currently the second-largest live catalogue we track with 198 in-stock rows. It has 118 certificates, and 22 of them name a lab. The other 96 are anonymised letters.

And then the concentration. Of the 2,276 named-lab certificates across all 41 vendors, 2,137 are Janoshik. That is 93.9%. Freedom Diagnostics accounts for 80. Everything else, Vanguard Laboratory, Chromate, Uzorak, Krause Analytical, Numega, SR Bio Labs, MZ Biolabs and the rest, adds up to 59 certificates between them. (Seventeen of the 59 record the lab as “Finnrick,” which is the aggregator that published the result rather than the bench that ran it. We counted them as named because the source is at least identified, but they are a weaker form of the claim than the rest.)

So the honest translation of “this vendor has a COA” in this tier of the market is: one testing company has run something for them at some point. That is not nothing. It is a real independent check by a lab with a reputation to lose. But an entire market’s verification resting on a single laboratory is a fragility, not a system, and it is worth naming before something happens to that lab rather than after.

The certificate covers the bestseller, not the shelf

Vendor-level questions are the wrong resolution for a buyer. You are not buying a vendor. You are buying a compound from a vendor, and “they have certificates” tells you nothing about whether they have a certificate for the vial you are about to order.

So we took every vendor/compound pair currently in stock and asked whether that vendor has a published certificate for that compound. There are 324 in-stock rows. That reduces to 243 distinct vendor/compound pairs we can check cleanly: single-compound labels only, and only where the compound already exists somewhere in our certificate corpus, minus a short exclusion list of non-peptides, blend shorthand and anabolic steroids. Matching ignores case and punctuation, so a vendor selling “BPC157” gets credit for its BPC-157 certificates and a vendor selling “OXYTOCIN” gets credit for its Oxytocin ones. The filter runs on both sides, so it cannot manufacture a gap.

135 of 243 pairs are covered. 108 are not. That is 44.4% of what is on the shelf right now with no certificate from the seller for the thing they are selling.

The pattern is not random. Coverage tracks one thing, which is how much of the compound sells.

Split the 243 pairs by how widely the compound is stocked and the two halves barely look like the same market. The seven compounds carried by ten or more vendors account for 91 pairs, and 77 of them are covered: 84.6%. Everything else accounts for 152 pairs, and 58 are covered: 38.2%.

Seventeen of the 59 compounds in the eligible set have no vendor stocking them with a matching certificate at all: 5-Amino-1MQ, AHK-Cu, CJC-1295 no DAC, Cartalax, Cortagen, Dihexa, Eloralintide, HGH Fragment 176-191, IGF LR3, Kisspeptin, NA-Semax-Amidate, oxytocin acetate, Pinealon, SHB, SLU-PP-332, VIP and Vesugen.

This is a rational response to incentives and it is still a problem for the buyer. Testing costs money per assay. The GLP-1 agonists move enough volume that a certificate pays for itself in one batch, and buyers demand one loudly enough that not having one costs sales. A peptide that moves a handful of vials a month gets shipped on the strength of the vendor’s reputation for the peptides that do sell. The peptide most likely to be untested is the obscure one you picked precisely because you did your reading.

Getting the join wrong is how you libel someone

This is the part of the method that took the longest and it is the part most likely to be repeated badly by someone else, so it belongs in the article rather than in a footnote.

Our catalogue table keys vendors by short code: QSC, ERP, TFC, ZLZSUNNY. Our certificate corpus stores long canonical company names: Qingdao Sigma Chemical, Shanghai Erp Peptide Biotechnology, Tianjin Finder Chemical Tfc. And one company routinely occupies several manufacturer rows, because certificates arrive from different sources with the vendor identified differently on each one.

Match the short code against the manufacturer name directly, which is the obvious thing to do, and here is what you get:

The naive join reports that 30 of 41 vendors have no certificates. Published, that is a false public accusation against 25 companies. QSC alone would have read as zero, because none of its 513 certificates sit under a manufacturer row literally named “QSC”; they arrive as Qingdao Sigma Chemical, and some of them through the alias Telegram @tracyfromqsc.

Even our own stored link table, which is supposed to be the fix, was wrong in three ways when we checked it. It omitted ZLZSUNNY entirely, whose 302 certificates sit across five separate never-merged manufacturer rows (Zlz Peptide, zlzpeptide.com, Zhuzhou Lusong Zhongtuo(ZLZ peptides), ZLZ Peptides and MGR/ZLZ). It omitted WKC, which has 30. And it pointed CHP at a manufacturer row that has since been merged into another one.

The QYC case is the cleanest illustration. Shanxi Qianyecao Biotech Qyc holds 175 certificates. A second row, just Qianyecao, holds 8 more and was never merged into the first. Same company, two rows, and a lookup that finds one and not the other is off by 8 certificates in a way that looks authoritative.

So the resolution here runs a four-step cascade: the stored link table, then the manufacturer merge graph so that every row collapsing into the same terminal company is counted together, then our canonical resolver for codes the link table never had, then a hand review of every remaining manufacturer row whose name, aliases or short codes overlapped a tracked vendor. Where a row plausibly belonged to a vendor, we credited it to them. The resolution leans toward crediting vendors, which means the certificate counts here run high and the absences are the conservative claim. That is the correct direction of error when the output is a public statement about a named company.

Five vendors were then checked certificate by certificate by hand before publication: QSC, ZLZSUNNY, QYC, HKMS and HHB. All five resolved correctly.

What we cannot tell you

Whether the certificates are genuine. This article counts documents and identifies who ran them. It does not authenticate them. A forged PDF and a real one both count as one certificate here.

Anything about Western retail brands. This is the limit that matters most, and it is the reason this article does not fully close the argument that prompted it. The forum thread was about consumer-facing companies buying Google ads in Canada. The 41 vendors here are the source and wholesale tier those companies buy from. A US brand can resell a fully certified Chinese batch under its own label and publish nothing, and it would not appear anywhere in this analysis. Our corpus holds certificates from 3,860 distinct manufacturers, nearly a hundred times the 41 vendors examined here, and it does include Western reseller brands. What we do not have is a reliable list of which of them are currently buying ads, so we have said nothing about that population rather than estimate it. That is the next piece.

Whether a certificate you were shown is the certificate for your vial. A batch number on a document is only as good as the chain between the batch and the box on your desk, and nothing in this dataset can inspect that chain.

Absence, in general. It bears repeating because it is the sentence most likely to get quoted without its qualifier: a vendor missing from our corpus means we have not seen a certificate. A certificate that circulates only as an emailed PDF, or only inside a private channel we do not read, is invisible to us by construction. If you are one of the five and you do publish, send it and we will ingest it.

How to check a vendor yourself

Every certificate behind every number above is on this site with the vendor, the compound, the lab, the test date and the purity figure attached.

• Vendor pages, one per short code: /v/qsc, /v/erp, /v/zj, and the same pattern for every code in the table above.
• Compound pages, which aggregate every certificate we hold for a compound across all vendors: /coa/tirzepatide, /coa/ss-31, /coa/dsip.
• The full queries behind this article ship next to it as who-actually-has-a-coa.queries.sql, including the resolved vendor-to-manufacturer map, so any number here can be reproduced or contradicted directly.

The useful habit is narrower than “does this vendor have a COA.” Ask whether they have one for the compound you are buying, from a lab you can name, tested recently enough to describe current production. On our numbers that is true of 135 of the 243 vendor/compound pairs in stock today, and false of the other 108.

Corrections and vendor responses: if a figure here is wrong, or you hold certificates we have not seen, we will re-run the query and publish the update with the date attached. We would rather be corrected than be confidently wrong about a company’s testing record.