COA Verification: How to Tell if a Certificate Is Real

The only reliable way to confirm that a certificate of analysis (COA) is authentic is to check the file itself against a record made when it was issued. Appearance, logos and QR codes can all be copied. A cryptographic fingerprint of the file cannot be copied in the same way.

This post explains why certificates get altered, what to look for, and how file-hash verification works in plain terms.

Why COAs get altered or forged

A COA carries weight because people rely on it. A document that says a material has a certain purity can influence decisions, and that makes it worth tampering with.

Alteration is easy. A PDF can be edited in minutes: a purity figure changed, a date adjusted, a chromatogram swapped, a laboratory name and logo pasted onto an entirely different document. The result can look just as professional as the original.

There are two common situations:

• Editing a genuine certificate, for example changing a number to improve a result.
• Building a certificate from scratch that borrows a real laboratory's name, layout and report numbering.

In both cases, the reader sees a polished document. That is why visual inspection alone is not enough.

Warning signs on a certificate

Careful reading will not catch every problem, but some signs justify extra caution.

• Missing method details. No stated technique, instrument or conditions.
• No traceable identifiers. No report number, no sample ID, or identifiers that do not follow a consistent pattern.
• Inconsistent dates. Analysis dated before the sample was received, or a report issued long before the analysis.
• A chromatogram that does not match the numbers. A purity figure far higher than the picture suggests, or a main peak at a different retention time than the one reported.
• Unusually perfect results. Round figures with no visible small peaks across several unrelated samples.
• Mismatched formatting. Fonts, spacing or image quality that changes within a single page.
• No way to check it. A certificate with no mechanism for independent verification.

None of these signs proves that a document was altered, and the absence of all of them proves nothing either. They are prompts to verify, not substitutes for verification.

Why a QR code or logo does not prove authenticity

A QR code is simply an image that encodes a web address. Anyone can copy it from a genuine certificate and place it on a different document. The code will still scan and still open the same page.

This is the key point: the QR code only takes you to a verification page. It does not by itself confirm that the document in your hands is the one that was issued. A copied QR code on an edited certificate behaves exactly like the original.

The same applies to logos, signatures and letterheads. They are images, and images can be duplicated. They help a reader recognise who issued a document, but they do not show that the content is unchanged.

What cannot be copied across documents is the exact content of the file.

How file-hash verification works

A hash is a short, fixed-length string of characters calculated from the contents of a file. Think of it as a fingerprint for the file.

Three properties make it useful:

1. The same file always gives the same hash. Calculate it today or next year and the result is identical.
2. Any change gives a completely different hash. Alter one character, move one pixel or re-save the file, and the hash changes entirely. It does not change slightly. It changes completely.
3. The original cannot be recovered or forged from the hash. You cannot work backwards from a fingerprint to build a different document that produces the same one.

ANALITIKA uses SHA-256, a widely used hashing method. When a certificate is sealed at issue, its fingerprint is recorded. Later, anyone can calculate the fingerprint of the PDF they hold and compare it with the recorded value. If the two match, the file is the same as the one that was sealed. If they differ, the file is not the sealed original.

A useful way to picture this: a signed paper contract can be photocopied, but a photocopy with one altered clause no longer matches the original word for word. A hash performs that word-for-word comparison automatically, on every byte of the file, and reports only whether the two are identical.

Verifying an ANALITIKA certificate in three steps

Each ANALITIKA certificate has a unique report number in the form ACT-##### and is sealed when issued. Checking one takes under a minute.

1. Open the verification page. Go to www.analitikatesting.ca/verify.
2. Select the certificate PDF. Choose the file you received. It is fingerprinted inside your own browser. The file is never uploaded, so the document stays on your device.
3. Read the result. The fingerprint is compared with the one recorded when the certificate was sealed. A match confirms the file is unchanged. A failure means the file differs from what was sealed.

Because the check depends on the exact file, verify the PDF you actually hold. A screenshot, a printout or a re-exported copy will not produce the same fingerprint.

What verification confirms and what it does not

Verification answers one narrow question precisely: is this file identical to the certificate ANALITIKA sealed?

It confirms:

• The file is unchanged since it was sealed.
• The report was issued by ANALITIKA and recorded at the time of sealing.

It does not confirm:

• That the sample is representative of any wider lot or batch.
• That the material is suitable for any particular purpose. A COA contains analytical data only and is never an endorsement.
• That a different, unrelated document is genuine. Each file is checked on its own.

If a check fails, the sensible step is to ask the person who gave you the certificate for the original file as issued. A failure does not tell you what was changed, only that the file is not identical to the sealed original.

To understand what the numbers on a certificate mean once you know it is genuine, read Certificate of Analysis Explained: How to Read a COA. You can learn more about the laboratory on the about page, and see what we analyse on the services page. When you are ready to check a document, go to the verification page.