How to Read a Hemp COA (Certificate of Analysis)

A Certificate of Analysis (COA) is a third-party lab's report on what's actually in a hemp product. Real ones are dense and a little boring; faked ones are easy to spot once you know what's normally there.

What every real COA includes

• Lab name, address, and ISO 17025 accreditation number. ISO 17025 is the international standard for testing labs. Look for the accreditation body's logo (A2LA, IAS, ANAB in the US).
• Sample ID and chain-of-custody dates. When the sample arrived, when it was tested, who handled it.
• Batch / lot number that matches the product's packaging. This is the most-faked field. The number on the COA must match the number printed on the jar or bag.
• Cannabinoid profile. THCA, Δ9-THC, CBD, CBG, CBN, sometimes Δ8 and others — usually as a table with mg/g and %.
• Pesticide, heavy metal, and microbial screens. "Pass" or numeric results with LOD/LOQ values.
• QR code or unique URL linking back to the lab's website where you can verify the document independently.

What's optional but reassuring

• Terpene profile
• Residual solvent analysis (only meaningful for extracts, not raw flower)
• Mycotoxin screening

Red flags

• No lab address or accreditation number. A COA from "XYZ Labs" with no street address is meaningless.
• QR code links to the vendor's site, not the lab's. The whole point of a COA is third-party verification. If the document lives on the vendor's server, they could have edited it.
• Batch number doesn't match the product. Take a photo of the jar's lot number before you smoke; if it doesn't match the COA linked from the product page, that's not your product's COA.
• "Total THC" missing. Post-2025 COAs should include a combined total-THC line — that's the number federal regulators are focused on. Its absence isn't necessarily fraud (some labs split it out as math you'd do yourself) but it suggests the lab isn't keeping current.
• Cannabinoid totals over 100%. Mathematical impossibility. The percentages of all measured compounds should add up to less than 100% (the rest is plant matter, terpenes, etc.).

How to verify independently

Most legitimate labs host their COAs on their own server with a unique URL or QR code. Scan the QR code from a fresh browser session (not from the vendor's page). The URL should resolve to a lab domain — not the vendor's. If you can pull up the document directly from the lab's site with the same batch number, the document is real.

Labs commonly used by US hemp vendors include ACS Laboratory, Steep Hill, InfiniteCAL, Green Scientific Labs, and CannaSafe. Knowing a few trusted names helps — a COA from a lab with no web presence at all should be treated as suspect until verified.

This article is for informational purposes. thcadeals.co does not make therapeutic, medical, or wellness claims about any cannabinoid product. All products discussed are hemp-derived and federally legal at the time of writing; this may change. 21+ only.