Home / Verify
Check a report
No account, no email address, no waiting on us. If somebody has handed you a certificate with our name on it, this page tells you whether we wrote it.
Check a certificate by its number
Enter the report number printed at
the top right of the certificate, for example CL-7KQ4-M2XD-4, or the sender’s lot reference
from the vial. The last character of a report number is a check that
catches a mistyped number.
What the lookup can answer
A number can be wrong in more than one way, and right in more than one, and collapsing those into a single “not found” throws away the information the person holding the certificate needs most. Each answer below is worded on the page as it is here.
Every answer, in the order the questions are asked
- Not a report number. The text is not the shape of any number
we print. Use the report number printed at the top right of the
certificate, for example
CL-7KQ4-M2XD-4. A number pasted with words round it, or with typographic dashes, is read as the number inside, and capitals, spaces and hyphens do not matter. - Fails its check. The last character is computed from the others, so one character mistyped or two neighbouring ones swapped is caught. It catches copying mistakes; anyone can compute a check character, so it is no defence against forgery and we do not claim it as one. Report numbers are random, so one number tells nobody another and the register cannot be read by counting.
- Not a report we issued. The check holds, we searched, and no report has the number. If someone handed you a report bearing it, we did not write it.
- Logged, awaiting report. The number is ours: it was assigned when the sample was logged on receipt, and the report has not issued yet. A number logged for a sample that was returned or never tested says that no report was issued under it, and none will be.
- Issued by us. The result in plain terms, the headline figures, the hash, and the full report. A report we have since retracted says so first and points to its correction.
- Add the lot number. A report issued before this site opened is found by the number printed on it together with the lot printed on it, so a second field asks for the lot. Historical report on file then shows its figures as originally reported, and no earlier report matches means the number and the lot do not belong to one report: check both against the certificate.
- Lot reference found, or no report carries it. A lot reference from a vial is matched against the lots printed on our reports.
- A worked-example number. A few numbers are kept for the
examples on this site,
CL-7KQ4-M2XD-4among them; no report is issued under them.
The hash, and what it shows
Every report prints a SHA-256 of its own data, and the
data is published beside it: record.json on a two-page
certificate, payload.json on a long-form report, the file
the certificate names under the hash. Recompute
the hash over that file, here in your browser with the button in the
result above or with any tool you trust, and compare it with the
printed number. If they differ, the file you hashed is not the one
the number was issued with. A match proves the served file is that
one; whether the paper in your hand says what the file says is
settled by comparing its figures with the report at its address,
which is the step that catches a copied hash on an altered PDF.
A long-form report prints a second, longer hash,
of record.json: the result record every page was composed
from, every trace point and both signatures included, served beside
the summary. The order it came from and any hold correspondence are
kept apart from it and are not in the file. The
summary hash is committed to it, so a page altered deeper in the
document fails the check too.
That is all it shows: whether a file matches its printed hash. It does not vouch for us. We publish the report, the data and the hash, so agreement between them cannot show that we measured correctly; the method, the signatures and the report under its number are what you weigh for that.
Check the PDF you were sent
Choose the certificate file and your browser computes its SHA-256 here; the file is not uploaded. The register records the fingerprint of each certificate when it issues, so a file that is byte for byte the one we issued says so, with its number and date, and a file that differs says so too, and why that is not by itself proof of anything. A certificate issued before fingerprints were kept has none on file; the lookup says so and you compare the figures instead.
What verification does not establish
It tells you a number was issued by us and what we measured. It cannot tell you that the vial in front of you is the vial we were sent, that a seller has not reused one of our reports across several lots, or that nothing happened to the material after it left us. A certificate is evidence about one container at one moment, and no amount of cryptography changes that.
Nothing issued is ever removed: the corrections log has the policy.