NHTSA vPIC and Recall Lookup: What Each One Tells You

Hand NHTSA's vPIC decoder the string 1FTFW1ET5BFC12345 and it answers without hesitation: 2011 Ford F-150, pickup, six cylinders, four-wheel drive, GVWR "Class 2F: 7,001 - 8,000 lb," Error Code 0 — "VIN decoded clean. Check Digit (9th position) is correct." The last five characters there are 1-2-3-4-5, filler typed in on 20 August 2026 to see what would come back. Whether a truck carrying that serial was ever built is not a question the decoder asks.

Now break one on purpose. 1G1JC5444R7252367 decodes to a 1994 Chevrolet Cavalier. Change the ninth character from 4 to 5 and run it again: 154 fields come back and 151 of them are byte-for-byte identical to the clean decode — same make, same model year, same engine, same plant. Three fields move: the VIN you typed, ErrorCode from 0 to 1, and ErrorText from "VIN decoded clean" to "Check Digit (9th position) does not calculate properly." Nothing else in the response so much as flinches.

That error line is what most people scroll past, and reading it is most of what separates someone who trusts a VIN decode from someone who reads one. NHTSA runs two free public tools that answer completely different questions, and the confusion between them is what a lot of paid VIN report sites quietly sell against — repackaging one of these two free lookups, or both, behind a card-number wall.

Two tools, two different questions

vPIC — the Vehicle Product Information Catalog, at vpic.nhtsa.dot.gov — answers "what does this string of 17 characters encode." Feed it a VIN and it returns the make, model, model year, body class, engine, plant, and dozens of other attributes the manufacturer built into the character positions when the VIN was assigned. It does this the same way whether the car exists, was scrapped in 2015, or was never built at all — vPIC decodes the pattern, not a database entry for a specific unit.

The recall lookup at nhtsa.gov/recalls answers a completely different question: "has NHTSA or the manufacturer filed an open safety campaign against this specific VIN." That tool, and the technical service bulletins and complaints sitting alongside it, are covered in full in checking a VIN for open recalls — the how-to, the six categories that search deliberately leaves out, and what an open campaign is actually worth at the negotiating table. This piece does not repeat that ground.

What matters here is that neither tool checks the other's homework. A VIN can decode perfectly clean in vPIC and still carry three open recalls. A VIN with an open recall decodes exactly the same as one with none, because recall status lives in a separate system entirely, tied to the specific 17 characters, not to anything vPIC reads out of them.

Where vPIC's data actually comes from

vPIC is not NHTSA's own record of which cars were built. It is a lookup against tables that manufacturers are legally required to file.

49 CFR 565.15, read on the eCFR on 19 August 2026, specifies what each VIN position has to encode — a manufacturer identifier in positions one through three, then five characters in positions four through eight that must be "decipherable with information supplied by the manufacturer." Section 565.16(c) is the part that actually creates vPIC's dataset: "Manufacturers of vehicles subject to the requirements of this part shall submit to NHTSA the information necessary to decipher the characters contained in its VINs." That submission has to arrive at least 60 days before the manufacturer sells the first vehicle using that code, under 565.16(d).

In plain terms: a manufacturer decides what its own character codes mean, tells NHTSA in writing, and vPIC decodes new VINs against that filing. The manufacturer identifier in positions one through three is assigned separately — NHTSA contracts that job out to SAE International under 565.16(a), free of charge, and SAE confirms each assignment in writing. A high-volume manufacturer is identified by those first three characters alone. A low-volume manufacturer is not: 565.15(a) gives it a six-character identifier split across positions one through three and positions twelve through fourteen, because three characters cannot keep every small-batch builder apart. The rule makes that arrangement announce itself — "A '9' shall be placed in the third position of the VIN if the manufacturer identifier is six characters," and "a '9' in the third position always indicates the presence of a six-character manufacturer identifier." A 9 in slot three, in other words, means the decode depends on characters most people never look at.

None of this involves anyone checking a physical car against the string. It is entirely a paperwork match between what a manufacturer told NHTSA a code means and what you typed in. That is exactly why a mistyped, transposed, or fabricated VIN can decode into a coherent-sounding vehicle that never rolled off a line — the decoder has no way to know the difference between a real assignment and a string that happens to match one.

Coverage is also uneven by age and by manufacturer for the same reason. A submission a manufacturer filed in 2011 for a mainstream truck platform tends to be far more complete than whatever a low-volume specialty builder filed, or than nothing filed at all for the many years before Part 565 took its current form in 2008.

Reading an actual decode

Four of the twenty-five-odd vPIC endpoints decode a single VIN, and the difference between them is mostly format rather than content. DecodeVin and DecodeVinExtended return one row per variable, as key-value pairs with a numeric ID attached to each. Useful if you're writing code against it, unreadable if you're skimming by eye. DecodeVinValues and DecodeVinValuesExtended flatten that same information into a single record, one field per column, which is what most people actually want when they paste a VIN into a browser bar. The "Extended" pair adds fields tied to NHTSA's other programs, mainly crash-statistics research through the National Center for Statistics and Analysis. GetVehicleVariableList, a separate endpoint, currently enumerates 144 decodable variables in total — and that number lines up with what DecodeVinExtended actually returns: 144 key-value rows for a sample VIN checked on 19 August 2026, of which 38 held a non-blank value.

The flattened version tells the same story with different bookkeeping. A query against vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues/1G1JC5444R7252367?format=json, checked the same day, came back with 154 flat fields (a few more than 144, because it bundles in metadata columns alongside the decoded variables) and a clean check digit, Error Code 0. Of those 154, only 39 actually held a value: make (Chevrolet), model (Cavalier), model year (1994), body class (Sedan/Saloon), plant city and state (Lordstown, Ohio), engine cylinders (4), displacement (2.2 L), fuel injection type, and a scattering of others. Everything about advanced driver assistance, battery data, turbo presence, and specific airbag locations came back blank. Not because the car lacked those things in any meaningful sense, but because nobody was required to encode information about lane-keeping systems in a VIN filed for a 1994 compact. NHTSA attaches the same warning to every response it sends: "Missing value should NOT be interpreted as an indication that a feature or technology is unavailable for a vehicle."

One field in that same response is worth a second look precisely because it looks wrong: "Series" decoded as "Convertible" on a car whose body class field says "Sedan/Saloon." vPIC does not cross-check one decoded position against another. Each character range is read independently against the manufacturer's table, so an inconsistency between two fields is not necessarily a red flag about the vehicle in front of you — it can just mean the manufacturer's own filing was inconsistent, or that a position got reused across trims in a way that reads strangely once decoded thirty years later. Trust the fields that matter for a buying decision — make, model, model year, engine, and body class — well ahead of the ones that are closer to decoration for a used-car search.

AdditionalErrorText is the other field people skip, and it is where the decoder shows its work. Run a mistyped string through it — 5UXWX7C5BA123456, checked 20 August 2026 — and the response comes back carrying four error codes at once (5, 6, 14, 400), a SuggestedVIN reading 5UX!!!C5!A!23456 that flags every bad position with an exclamation mark, and a PossibleValues string, (4:F)(5:EFGH)(6:048)(11:0345789ABCDEFGJKLNPVW), spelling out which characters each of those positions is allowed to hold. It still names a manufacturer, BMW, and a model year, 2010. The answer and the reasons to doubt it arrive one field apart.

The code list is short enough to read once. GetVehicleVariableValuesList/Error Code returned fifteen entries on the same date, and several are warnings rather than failures: code 8, "No detailed data available currently"; code 11, "Incorrect Model Year - Position 10 does not match valid model year codes (I, O, Q, U, Z, 0). Decoded data may not be accurate."; code 12, which fires when the model year you supplied disagrees with the one encoded at position ten. Code 10 is the one to stop on. It reports that the string is not a motor vehicle VIN at all, because the manufacturer never certified the product to the federal motor vehicle safety standards.

Comparing several listings without retyping anything

Shopping usually means more than one VIN at a time, and vPIC has a purpose-built endpoint for that rather than forcing 50 separate page loads. DecodeVinValuesBatch accepts a semicolon-separated list, vin,modelyear;vin,modelyear;..., with the model year optional on each entry, and decodes up to 50 VINs in a single call. That is the tool for the specific, common situation of three or four Craigslist tabs open at once and a spreadsheet you're trying to fill in without hand-typing each result: paste the VINs, run one request, paste the flattened output back into your comparison sheet.

No API key is required for any of this, batch or single. NHTSA does run "an automated traffic rate control mechanism" to keep the service stable under load, which mostly matters to people writing scripts, not to someone checking the four trucks they're actually cross-shopping this weekend.

What a clean decode is worth against a listing

The practical use for a private buyer is narrower than the tool's full field list suggests, and that is fine. Narrow and reliable beats broad and shaky.

Compare four fields against what the ad says: make, model, model year, and engine configuration or cylinder count. These come from the manufacturer's own required filing and are about as solid as free data gets. A seller who advertises a "2018 V6" on a VIN that decodes to a four-cylinder is either careless or misrepresenting the car, and either way it's worth a direct question before you drive anywhere to look at it.

Body class is next, and it is more useful than people expect for catching a mismatched or swapped listing (pickup versus SUV, coupe versus sedan), but it will not reliably tell you trim level, paint, or options. Trim came back empty on the sample above and series came back wrong, which is the usual pair of failure modes; where those fields do carry something, it can be inconsistent between manufacturers, between model years, or between two positions inside one VIN. Do not lean on vPIC to confirm a specific trim claim; that's a job for the manufacturer's own window-sticker lookup, which draws on equipment data the VIN character positions alone don't carry.

Plant city and country are small fields that earn their place, both because they let you rule out a listing that claims an import-market variant a domestic plant never built, and because certain recall campaigns are scoped by assembly location rather than by the broad model line.

GVWR arrives as a class range rather than a number. The F-150 string at the top of this piece returns "Class 2F: 7,001 - 8,000 lb (3,175 - 3,629 kg)." That is downstream of the filing, not of the car. Under 565.15(b), the GVWR information a manufacturer submits to NHTSA has to use the class designations in the regulation's Table II, where Class F covers 7,001 to 8,000 lb; the same paragraph adds that using those designations inside the VIN itself is not required. The class is what gets filed, so the class is what comes back. Against a listing that quotes a specific curb or towing figure, it is a ballpark check and nothing more.

One more limit before you lean on any of it. vPIC's logic assumes the modern standard: 565.13(b) fixes every VIN at seventeen characters, and 565.13(d) dates the scheme by running its no-duplicates rule for sixty years from the 1980 model year. Cars older than that, and some low-speed and specialty vehicles, carry shorter or differently structured identifiers this decoder was never built to read.

What neither free tool can see

vPIC tells you what the VIN was built to mean. The recall lookup tells you whether that VIN has an open safety campaign. Neither one has any way to know whether the car in the driveway actually matches its own paperwork, or what shape it's really in.

A rebuilt-title car with swapped panels can carry a VIN that decodes perfectly and shows zero recalls, because nothing about a body repair changes the character string or triggers a federal safety filing. A brand or an insurer total loss, if one was ever reported, sits in a third system again: the NMVTIS title check, which costs about ten dollars and answers five questions neither of these free tools touches. A curbstoned car, one flipped by an unlicensed dealer posing as a private seller, decodes exactly like any other example of that model, because vPIC has no field for "who is actually selling this." Confirming physical condition, checking for accident repairs, and verifying the seller's story against the car in front of you is a job for an independent pre-purchase inspection, not for either of NHTSA's free lookups. Free records tell you what's on paper. An inspection tells you what's under the paint.

That division is the whole reason both tools are worth two minutes each before you drive anywhere, and why neither one is worth mistaking for the whole picture. A clean vPIC decode and a zero on the recall search rule out exactly two things: a VIN that doesn't match the manufacturer's own filing, and an open safety campaign that hasn't been fixed. Everything else about whether the car is worth the price is still an open question, and it stays open until someone puts their hands on the vehicle itself.