Skip to content
NAD+ Picks
← Research
Safety

What a LegitScript badge on a NAD⁺ site actually proves

We requested four real seal images and two invented ones. The real ones were identical to each other, byte for byte — which tells you what the badge can and cannot establish.

Michael Reyes6 min read
What the badge proves, and what it does notIt does proveThe id on the badge has been issued to somebodyAn invented id is refused. A real one is not.It does not proveThat the id belongs to the site showing itThat the seller is certified — a pharmacy may be insteadAnything about the medicine itselfEvery valid id returns the same image. The picture carries no name.

Somewhere near the checkout button there is a small badge. It says LegitScript, and it is doing a job: telling you this is not one of the pharmacies you have read about. Of the 160 NAD⁺ sellers we review, 77 display or claim one.

It is a real accreditation and worth something. It is also narrower than it looks, in three specific ways, and one of them we measured ourselves.

What LegitScript is

LegitScript is a private certification company. It reviews healthcare merchants and pharmacies against a set of standards and legal requirements, and certified merchants can display a seal. Google and other advertising platforms require it before they will run pharmacy ads, which is the practical reason so many telehealth sellers carry one.

So a seller with certification has been through a real review by someone other than themselves. In a category where the product itself is not FDA-approved, an independent check on the business is not nothing.

The part we measured

The badge usually links to, or loads from, a seal image at LegitScript’s own address, with a number in the filename. That looks like something you could verify, so we tried to.

We requested four real seal numbers and two we made up. The four real ones all returned an image. The two invented ones were refused. So far so good — the number is genuine.

Then we compared the four images to each other. They were identical. Byte for byte, exactly the same file, 22,778 bytes each. The picture contains no company name, no number, nothing about who was certified. We re-ran the whole thing two weeks later and got the same result.

Which means the badge proves the number has been issued to somebody. It cannot tell you the number belongs to the site displaying it, because the image would look exactly the same either way. Any site can print any real number.

The second gap: certified who?

This one is easy to miss because the wording is usually accurate. A seller writes that it works with a “LegitScript-certified pharmacy partner”. That is a sentence about the pharmacy. The telehealth business you are giving your card to may or may not be certified itself, and the sentence does not say.

Both arrangements exist and neither is dishonest. But they are different facts, and the badge looks the same for both.

If you want to know which sellers name the pharmacy at all rather than just the designation, the reviews record it — and it is a shorter list than you would expect.

The third gap: it is not about the medicine

Certification examines a business — its licensing, its prescribing practices, its compliance. It is not a review of the drug in the vial. Compounded NAD⁺ is not FDA-approved whether or not the seller is certified, and certification says nothing about the dose, the purity or whether the thing works. Those are separate questions with separate answers.

The same caution applies to the safety picture generally: what is actually known about NAD⁺ safety comes from trials, not from badges.

How to actually check

Use LegitScript’s own lookup rather than the badge. Search the seller’s domain and see what comes back and in whose name. That is the only step that connects a certification to a company.

One warning from doing this at scale: the lookup is rate-limited, and after a number of searches it will tell you that you have reached your limit. That is a quota, not a finding. It does not mean the seller is uncertified, and treating it that way is how you end up publishing something false.

What we write, and why

In our reviews you will see phrasing like “states LegitScript certification” or “a seal appears in the page source”, rather than “LegitScript verified”. That is deliberate. We can observe what a site displays and what it claims. Confirming who holds the certification takes the lookup, and where we have not done that for a given seller we do not write as if we had.

It is a small distinction that took us a measurement to earn. A sister site published eleven rows saying a seal “resolves for this site” before we knew every seal resolves for every site, and those had to be rewritten. Worth knowing before you read a badge as an answer — and worth reading alongside what a 503A or 503B designation means, which has the same shape of problem.

Frequently asked

Does a LegitScript seal mean the NAD⁺ is safe?
No. Certification reviews the business — licensing, prescribing practices, compliance — not the medicine. Compounded NAD⁺ is not FDA-approved whether or not the seller is certified, and the badge says nothing about dose, purity or whether it works.
Can a website display a LegitScript seal it is not entitled to?
The seal image alone would not reveal it. We requested four valid seal numbers and the images came back byte-identical — the picture carries no company name or number. A real number proves it was issued to someone; it cannot prove it belongs to the site showing it. Use LegitScript's own lookup to connect a certification to a company.
My seller says it uses a LegitScript-certified pharmacy. Is that the same thing?
Not quite, and the wording is usually accurate. That sentence certifies the pharmacy. The telehealth business taking your payment may or may not be certified itself. Both arrangements exist and the badge looks identical for both.
The LegitScript lookup says I have reached my limit. Does that mean the seller is not certified?
No — that is a quota on searches, not a result about the company. Wait and try again. Reading a rate limit as a negative finding is a good way to publish something untrue.

Sources

    More in Safety