How to verify a cannabis COA is real
A certificate of analysis is a claim, and claims can be forged. These are checks anyone can run on a certificate a seller hands them, using only what the certificate prints and the public records of the lab and the state.
How do I verify a cannabis COA is real?
Start with the QR code or result URL printed on the certificate and check where it leads. The strongest evidence is a results page on a portal the testing laboratory operates, because the brand cannot edit it. Then check the laboratory’s license number against the state regulator’s own records, confirm the sample or batch ID matches the lab’s results page, and confirm the batch ID matches the package in your hand. A PDF or screenshot with no QR code and no license number gives you nothing to check, because anyone can edit a PDF.
1. Follow the QR code, then judge the destination
Many certificates print a QR code or a result URL. What matters is not that one exists but where it lands. A laboratory's result portal is a page the lab controls and the brand cannot edit; a brand's own website, a file-sharing link, or a plain image proves only that someone uploaded a file.
Every record in this index links to a copy of its certificate that anyone can open. Where a certificate was shared with this index privately, the link is the brand's own public lot page when one is live, otherwise the destination of the QR code printed on the certificate. Where it came through a retailer, the link is the lab's portal when the printed QR code leads there, otherwise the retailer's copy. A certificate with no public copy to link is held back rather than published. Today 2,657 of 7,143 records link to a lab-operated result portal. The other 4,486 link to a copy hosted by the brand, a COA-hosting service or a retailer.
2. Lab-operated result hosts seen in this index
These are the laboratory and LIMS result portals that records in this index link to, with the number of published records on each and the laboratories that issued them. It is not a list of every lab portal in every state, only the ones these 7,143 certificates use.
| Host | Platform | Issuing labs in this index | Records |
|---|---|---|---|
| ny.yourcoa.com | Kaycha Labs result portal | Kaycha Labs | 850 |
| app.confidentlims.com | Confident LIMS result portal | Encore Labs, Smithers CTS New York LLC | 652 |
| lims.tagleaf.com | TagLeaf LIMS result portal | Certified Testing and Data, Infinite Chemical Analysis Labs | 517 |
| orders.confidentcannabis.com | Confident Cannabis result portal | Biotrax Testing Laboratory Inc., DRS Testing, Phyto-Farma Labs, Smithers CTS New York LLC | 343 |
| client.sclabs.com | SC Labs result portal | SC Laboratories California LLC | 164 |
| phyto-farma.qbench.net | QBench LIMS portal (Phyto-Farma Labs) | Phyto-Farma Labs | 55 |
| ga-ny.qbench.net | QBench LIMS portal (Green Analytics NY) | Green Analytics NY, LLC | 38 |
| portal.anresco.com | Anresco Laboratories result portal | Anresco Laboratories | 22 |
| ny-keystonestatetesting.grow.labware.cloud | LabWare LIMS portal (Keystone State Testing) | Keystone State Testing of New York | 16 |
3. Check the license numbers
A compliance certificate names the laboratory that ran it, and lab licenses and permits are public records. Check the lab's number against the state's own list, linked on the regulator directory. A certificate that prints no lab license number is not automatically fake, but it has given you nothing to check. This site's lab pages show the license numbers the indexed certificates print, or say plainly that none is printed. This index does not check those numbers against state records itself.
4. Match the batch, not just the product
Testing is per batch. A certificate for the same product name but a different batch or lot number says nothing about the unit in your hand. The batch ID on the package, the batch ID on the certificate, and the batch ID on the lab's results page should all agree. You can also search this index by sample ID or METRC batch ID: if the batch is here, its values were extracted from the certificate itself, and its page links to the copy they came from.
Red flags
- No QR code and no result-portal URL anywhere on the document.
- A QR code that leads to the seller's own website rather than a laboratory's result portal.
- No laboratory license number, or one that does not appear in the state's records.
- A batch ID on the certificate that does not match the batch ID on the package.
- Potency on the label that does not match the certificate's own totals.