Methodology

How this decodes

Three public NHTSA services, no key, no account, and one important limit in how recalls are matched.

The sources

Specification: NHTSA vPIC DecodeVinValues, read live and cached for a day. Returns 154 fields, of which 50 to 70 populate for a modern vehicle.
Recalls: NHTSA recallsByVehicle, matched on make, model and year.
Manufacturer prefixes: vPIC GetWMIsForManufacturer. 888 prefixes across 45 makes, rebuilt 2026-08-09.
Structure: ISO 3779 and 49 CFR 565. The check digit and model-year cycle are computed here, not fetched.

Recalls are matched by model year, not by VIN

This is the one limit worth stating loudly. NHTSA's free API has no VIN-level recall endpoint; the per-VIN service sits behind a separate agreement. So a recall shown here applies to that make, model and year in general, and whether one particular car falls inside the affected range can depend on assembly plant and build date.

The consequence of getting this wrong in the reassuring direction is somebody driving a car with an open safety defect, so every recall list here says it, and points at nhtsa.gov/recalls for the VIN-level check.

What is computed locally rather than fetched

Length, the I/O/Q exclusion, the modulus-11 check digit and the 30-year model-year cycle are all determined by the standard, so they run before any network call. A mistyped VIN gets a specific answer instantly instead of a spinner and an empty result.

A failed check digit is reported as a caution and the decode continues. Vehicles built for markets outside North America are not required to satisfy it, and refusing to decode them would be wrong.

What no free decoder can tell you

Accident history. Lives in insurance and police data, not in the VIN.
Title status, salvage or flood branding. State DMV records.
Odometer readings. Captured at title transfer and inspection, not encoded.
Ownership chain. Same, and restricted under the Driver's Privacy Protection Act.

A VIN encodes what the factory built. Anything about what happened to the car afterwards is a different dataset, and any free tool promising it is selling a paid report on the next click.

Corrections

If a decode here disagrees with NHTSA's own decoder, NHTSA is right and this is a bug. Back to the decoder.