How can I tell a real COA from a forged one?

A professional-looking PDF proves nothing — anyone can fabricate purity numbers in a document. What can't be faked is a matching record in the testing lab's own database. Reputable independent labs (e.g., Janoshik) print a unique verification key on each report; entering it on the lab's verification page returns the original data. Red flags: no verifiable key or QR code; the lab will only "confirm by email"; the batch/lot number on the vial doesn't match the COA; purity, molecular mass, compound name, or date differ between the portal and the document; or the vendor only shows a generic "independently tested" claim with no named lab. Be wary of identical chromatograms reused across different batches. If you cannot independently verify a report at the issuing lab, treat it as unverified.