Home / Verify
Check a report
No account, no email address, no waiting on us. If somebody has handed you a certificate with our name on it, this page tells you whether we wrote it.
Enter the number printed on the
certificate, in the form CL-YYYY-NNNNN-C, or the sender’s lot
reference from the vial. A mistyped number is caught before anything is
looked up.
Three questions, five answers
A number can be wrong in more than one way, and right in more than one, and collapsing those into a single “not found” throws away the information the person holding the certificate needs most. The questions are asked in this order.
The three questions and the five answers, in order
- Is it the right shape? Four digits of year, five of serial, one check digit. If not, nothing is looked up, and we say so rather than implying we searched.
- Does the check digit hold? The last digit is computed from the other nine. A number copied wrong by hand, one digit mistyped or two swapped, fails here, before anything is looked up. This catches copying mistakes; it is not a defence against forgery, since anyone can compute a check digit, and we do not claim it as one.
- Is it in the register? Only now. A well-formed number we never issued returns a different answer from a number that failed step two — if those two looked the same, the check digit would be decoration.
The five answers
- Not an accession number. Wrong shape. Nothing was looked up.
- Fails its check digit. Right shape, one digit wrong or two swapped. Nothing was looked up.
- Well formed, and not ours. The register was searched and the number is not in it. We did not issue it.
- Logged, awaiting report. The number is ours: it was assigned when the sample was logged on receipt, which is when every number is assigned, and the report has not issued yet. The answer gives the date it was logged and the analyte name, nothing else, and the report appears under the same number when it issues. A number logged for a sample that was returned or never tested says so instead: no report was issued under it, and none will be.
- Issued by us. The result in plain terms, the headline figures, the hash, and a link to the full report. A report we have since retracted says so first and points to its correction.
The hash, and what it shows
Every report prints a SHA-256 of its own data, and the
data is published beside it as payload.json. Recompute
the hash over that file, here in your browser with the button in the
result above or with any tool you trust, and compare it with the
printed number. If they differ, the file you hashed is not the one
the number was issued with. A match proves the served file is that
one; whether the paper in your hand says what the file says is
settled by comparing its figures with the report at its address,
which is the step that catches a copied hash on an altered PDF.
The certificate prints a second, longer hash, of
record.json: the result record every page was composed
from, every trace point and both signatures included, served beside
the summary. The order it came from and any hold correspondence are
kept apart from it and are not in the file. The
summary hash is committed to it, so a page altered deeper in the
document fails the check too.
That is all it shows: whether a file matches its printed hash. It does not vouch for us. We publish the report, the data and the hash, so agreement between them cannot show that we measured correctly; the method, the signatures and the published register are what you weigh for that.
Check the PDF you were sent
Choose the certificate file and your browser computes its SHA-256 here; the file is not uploaded. The register records the fingerprint of each certificate when it issues, so a file that is byte for byte the one we issued says so, with its number and date, and a file that differs says so too, and why that is not by itself proof of anything. A certificate issued before the register kept fingerprints is not in the list; its page says so.
What verification does not establish
It tells you a number was issued by us and what we measured. It cannot tell you that the vial in front of you is the vial we were sent, that a seller has not reused one of our reports across several lots, or that nothing happened to the material after it left us. A certificate is evidence about one container at one moment, and no amount of cryptography changes that.
Reports issued: 0. Samples logged, awaiting report: 0. Corrections: 0. Retracted: 0. Nothing has ever been removed. The corrections log has the detail.