How to check a certificate against the laboratory's own copy

A certificate of analysis is a laboratory's report, but the PDF that reaches a reader is a copy, and it may pass through several hands on the way. Where the laboratory publishes its own copy, the two can be compared. This page explains how, and what a match does and doesn't show, using certificates from our own library.

Why a file can differ from what the laboratory issued

PepsMartUSA doesn't order the tests behind our certificates. AxisPharm, LLC issued each one, our supplier, Protixa, provided the PDFs to us, and we publish each PDF as provided (see where the certificates come from). A PDF can be edited with ordinary software, and an edit can leave the page looking like the original. The files' own data show that some of the PDFs in our library were changed after their report dates, before they reached us. Publishing a file as provided doesn't make it the file the laboratory issued. The laboratory's own copy is the reference to check it against.

Where to find the laboratory's copy

The certificates in our library dated August 2026 print a QR code on each page. It links to a PDF on AxisPharm's website at an address built from the lot number: for lot NAD1000VAS0826, axispharm.com/wp-content/uploads/COA/NAD1000VAS0826.pdf. Scanning the code, or typing the address, opens the copy the laboratory hosts. Our certificates dated before August 2026 carry no QR code, and when we checked in October 2026, AxisPharm's website had no copy at the same kind of address for any of them.

In the certificate library, some entries link to the laboratory's copy as “Lab-hosted copy”, with the date we last compared it with ours. They include NAD+ 1000 mg (lot NAD1000VAS0826), KPV 10 mg (KPV10VAS0826), Epitalon 50 mg (EPI50VAS0826) and MOTS-c 40 mg (MOT40VAS0826).

How to compare the two

The first check is reading. Open both files and compare them field by field:

• the Certificate ID and the date of report;
• the lot number, the sample name and the date the sample was received;
• the results: net weight measured, molecular weight, detected ion, UV purity and endotoxin;
• who the certificate is addressed to, and who reported and approved the results.

A difference in any of these means the two aren't the same document. Agreement on all of them is a good sign, but a reader can miss a small change, and reading covers only what is printed.

The stronger check compares the files themselves. Identical files are the same sequence of bytes, so they have the same size and the same checksum, a fingerprint calculated from every byte. A SHA-256 checksum can be calculated with tools built into most computers: shasum -a 256 on a Mac, certutil -hashfile <file> SHA256 on Windows, sha256sum on Linux. Matching checksums mean every printed value, every image and the file's internal data are the same.

On October 6, 2026, our PDF for NAD1000VAS0826 and AxisPharm's copy were both 251,734 bytes, with the same SHA-256 checksum: a9f0b953eaf3f8dbd46d5a7aa80a530963655dfc5bc015df923821d31745a134. Different checksums show only that the files differ somewhere: a file saved again with nothing visibly changed gets a new checksum too. The field-by-field reading then shows whether anything printed differs.

What a matching copy shows

Identical files show that the PDF we publish is the file the laboratory hosts under that lot number. Whatever ours prints, the laboratory's copy prints too, including anything odd. The NAD1000VAS0826 Certificate ID, for example, is dated two days after the report date; because the files are identical, that difference is in the laboratory's own copy as well (see the NAD+ certificate guide).

A match doesn't change what the certificate is: the laboratory's report on a sample it tested from one lot. The lot number is what ties a vial to that report (see what a lot number does and doesn't prove), and a matching copy adds nothing the certificate doesn't report. It also describes the hosted file on the date of the comparison. A laboratory can replace a hosted file, which is why each of those library entries gives the date we last checked.

When there is no laboratory copy

Most certificates in our library have no QR code and no copy we have found on the laboratory's website, so they can't be checked this way. Some checks still work on the PDF alone:

• Do its own fields agree? On most of our certificates the Certificate ID begins with the report date; the lot number should fit the product and size; and the detected ion should sit close to the value calculated from the printed molecular weight.
• What do its file data say? Most PDF readers show a document's creation and modification dates among its properties. A modification date later than the creation date means the file was saved again after it was made, though not what, if anything, changed. Those dates can be edited too, so they are weaker evidence than a laboratory copy.

Our certificate guides note what a PDF's own data show where it matters: the ARA-290 guide, for example, notes a single creation on the report date and no later revision. For any other lot, contact us with the lot number and we can say what we know about where its certificate came from.