How Certificate of Analysis Verification Works
How QR and certificate-number verification let you detect an altered report, and why a public directory of certificates would be a confidentiality failure.
How do you verify a Certificate of Analysis is genuine?
Scan the QR code printed on the certificate, or enter its certificate number on the issuing laboratory's verification page. What that page displays comes from the laboratory's own database rather than from the document you hold. If the two disagree on customer, product, batch or result, the document has been altered. If the reference returns nothing, the laboratory did not issue it.
The check takes a few seconds and requires no account, no relationship with the laboratory and no technical knowledge. That is deliberate. A verification system that only the certificate holder can use does not solve the problem, because the certificate holder is the party whose claim is in question.
A PDF proves nothing by itself
Any competent forger can reproduce a laboratory's letterhead. Editing a number in a PDF takes seconds and leaves no visible trace.
A certificate emailed to you by the party who benefits from its contents therefore deserves independent confirmation, not because that party is presumed dishonest, but because the document carries no intrinsic evidence of its own authenticity.
What verification confirms
- 1
That the certificate exists
The laboratory issued a certificate under that number. A reference that returns nothing was not issued by them.
- 2
Who it was issued to
The named party. A certificate issued to one company does not transfer to another company reselling the same batch.
- 3
What it covers
The specific product and batch number. This is what catches a genuine certificate being attached to different material.
- 4
What was found
The recorded result. If the PDF says 99.2% and the verification page says 94.1%, the PDF was edited.
Revoked certificates should say so
Occasionally a certificate is withdrawn: a transcription error, a superseded revision, or material misidentified at receipt.
A well-designed system verifies a withdrawn certificate as revoked, with the reason shown, rather than making it disappear. Deletion would leave anyone holding a printed copy unable to discover that it is void, which is the opposite of what a verification facility is for.
If you are shown a paper certificate that verifies as revoked, treat the paper as void regardless of how recently it was handed to you.
Frequently asked questions
- What does it mean if a certificate number returns nothing?
- It means the laboratory has no record of issuing a certificate under that number. A properly built verification system has no unlisted or private register that a genuine certificate could be hiding in, so a reference that fails to resolve does not exist in that laboratory's records. Before concluding the document is fabricated, check the reference character by character, since the letter O against the digit zero and the letter I against the digit one account for most failed lookups.
- Can a QR code on a certificate be faked?
- A QR code can be replaced with one pointing somewhere else, which is why the destination matters more than the code. Check that the URL you land on is the laboratory's actual domain rather than a lookalike, and that the page is served over HTTPS. A verification link that resolves to a domain you have never heard of, or to a page hosted by the seller rather than the laboratory, is not verification.
- Do I need an account to verify a certificate?
- No. Verification is deliberately open to anyone holding a certificate number or QR code, because the people who most need to check a certificate are usually not the laboratory's clients. They are the downstream buyers, auditors and researchers being asked to rely on the document. A system that required an account would prevent exactly the people it exists to serve from using it.
About the author
REPLACE: Quality Manager
Quality Manager · Quality systems, ISO/IEC 17025
Placeholder profile for the reviewer who signs off certificates and owns the quality system. Replace with the real person before launch.
Have a sample that needs characterising?
Build a submission online and see an itemised estimate as you select assays. Every result is reported exactly as measured.
Related reading
Certificate Verification
How to Spot a Fake Certificate of Analysis
Seven checks that expose a fabricated or altered certificate, most of which take under a minute.
Certificate Verification
What a Certificate Hash Proves
How a cryptographic fingerprint detects tampering, and the narrow thing it actually proves.
Interpreting Results
How to Read a Certificate of Analysis
What each section of a COA tells you, which numbers matter, and the three most common ways a report gets misread.