NHTSA VIN Decoder: How vPIC Works and What It Shows

The NHTSA VIN decoder is the free vPIC tool at vpic.nhtsa.dot.gov/decoder, run by the National Highway Traffic Safety Administration. You enter a full or partial VIN and it returns what the manufacturer encoded in it: make, model, model year, body class, engine, drive type, plant of manufacture and a long list of safety equipment.

vPIC stands for Product Information Catalog and Vehicle Listing. It is also the data source behind many third-party decoders, including our own free VIN decoder. This guide explains what it returns, where that data comes from, how to read its error messages, and what it cannot tell you.

What the NHTSA VIN decoder is

The decoder page is simple: a VIN box, an optional model year box and a Decode button. It says partial VINs are accepted, and that if you enter a model year, the year from the VIN is ignored. When we checked it in October 2026, the page showed version 4.07, last updated July 18, 2026.

There is no account and no fee. NHTSA itself points to the Plant Information section at the bottom of the results as a quick way to see where, and in which country, a vehicle was built.

It is a decoder, not a history report. It reads the structure of the VIN against the manufacturer's coding rules. It does not look up what has happened to that particular car since it left the factory. If you are new to VIN structure, our guide on how to read a VIN walks through each of the 17 positions.

Where the data comes from

Every field vPIC returns comes from the manufacturer. Federal rule 49 CFR Part 565 sets out what a VIN must contain, and section 565.16 requires manufacturers to "submit to NHTSA the information necessary to decipher the characters contained in its VINs." They must do this at least 60 days before offering the first vehicle with that coding for sale, and file amendments when the coding changes.

The vPIC API documentation says the same thing from NHTSA's side: the dataset "is populated using the information submitted by the Motor Vehicle manufacturers through the 565 submittals." The decoder page adds that the information "is reported by the manufacturer" and tells you to contact the manufacturer with questions.

That has two practical effects:

• Coverage is as good as the submission. Mainstream makes submit detailed coding, so you get engine codes and trims. Small manufacturers, trailer builders and older vehicles often return only the basics.
• Blank does not mean absent. Every API response carries a note that a missing value means NHTSA does not have data on that variable. It should not be read as the feature being unavailable on the vehicle.

What fields it returns

The flat-format response from the API has 154 fields. On our test VINs, between 61 and 68 of them came back filled in. The ones most people care about:

Safety equipment is often marked "Standard" or "Optional". "Optional" means the feature was available on that VIN pattern, not that this car has it. For a deeper look at reading specs and checking them against the vehicle, see our guide to car specs by VIN.

Worked example: three VINs decoded in vPIC

We queried NHTSA vPIC in October 2026 with three VINs that follow real manufacturer patterns: a Toyota RAV4, a Tesla Model Y and a Honda Civic. Each has a valid check digit and a placeholder serial number (000001), so the decode reflects the pattern, not a specific car.

A few things stand out. The Toyota and Honda decodes are detailed down to the factory engine code. The Tesla returned the drive unit and electrification level but left trim and drive type blank, which is a good example of "missing means no data," not "no feature." Our Tesla VIN decoder page covers that brand's coding in more detail.

Partial VINs and wildcards

vPIC is one of the few free decoders that works with an incomplete VIN. The API documentation says partial VINs "will be decoded partially with the available characters," that a * can stand in for unknown characters, and that the 9th digit is not necessary.

We tested this with the Civic VIN above:

• First 8 characters only (2HGFE2F5): vPIC still returned Honda, Civic and a 2.0L engine, though it listed the engine model as K20C9 rather than K20C2. The ErrorCode was 6 (Incomplete VIN) plus 11, because there was no 10th character to give a model year.
• Same 8 characters with model year 2023 sent separately: the K20C2 engine and Sport trim came back, with error 6 and a code 12 warning that the entered year did not match position 10.
• Wildcard in position 9 (2HGFE2F5\*PH): a full Civic decode with model year 2023 and only error 6.

This is useful when part of a VIN plate is worn, or when you only have the first characters from a parts catalog or an auction listing. If you are hunting for a full VIN on the vehicle itself, our pillar guide on where the VIN number is lists every common location.

Error codes and what they mean

Every vPIC result includes an ErrorCode and an ErrorText. Several codes can appear at once, separated by commas. These are the ones we saw in our October 2026 tests:

Two details matter here. First, code 1 does not stop the decode. When we changed only the check digit on the Civic VIN, vPIC still returned Honda, Civic, 2023 and the K20C2 engine. So a "successful" looking decode can hide a typo. Our guide to the VIN check digit shows how the 9th character is calculated.

Second, when we replaced positions 8 and 9 with the letter O (a common misreading), vPIC returned codes 1, 4, 14 and 400, a Suggested VIN of 2HGFE2F!!PH000001 with ! marking the bad positions, and Possible Values of (8:23456789), meaning only those characters are valid in position 8 for that pattern. That is a handy way to fix a misread character. For the year code in position 10, use our VIN model year chart.

The vPIC API for developers

The same data is available through a free public API documented at vpic.nhtsa.dot.gov/api. The endpoints most people need:

Output can be JSON, XML or CSV. The documentation recommends always sending the model year and warns that API traffic is subject to automated rate control. For large volumes, NHTSA also offers standalone vPIC databases for download, linked from the API page.

Our own free VIN decoder calls DecodeVinValues behind the scenes and arranges the result into readable sections, so you get the same manufacturer-submitted data without scrolling through 154 rows.

What the NHTSA decoder does not do

Because vPIC only reads the manufacturer's coding, it cannot tell you anything that happened after the vehicle was built:

• No vehicle history. No accidents, service records or odometer readings.
• No title information. It will not show salvage, flood or rebuilt brands. Title history comes from NMVTIS-based reports; see Carfax vs NMVTIS for the difference.
• No theft or salvage check. Use NICB VINCheck for that.
• No owner details. Owner and registration records sit with state DMVs, not in vPIC.
• No open recalls. Recalls are a separate NHTSA tool at nhtsa.gov/recalls, where you enter the VIN or plate. It shows unrepaired recalls for that vehicle, not recalls that are more than 15 years old (unless the manufacturer offers more coverage) or ones already fixed. Our recall check by VIN guide covers it step by step.
• No options, paint or exact equipment. "Optional" in a decode means available, not fitted.

Used the right way, the NHTSA VIN decoder is the best free starting point: it confirms the VIN is valid and that the car is what the seller says it is. Then run the recall, theft and title checks before you buy.