VIN decoder FAQ: privacy, NHTSA data, recalls and check digits
Answers about decoding a VIN with PlateVIN: where the data comes from, what the recall list does and does not show, the check digit, missing fields and privacy.
Is the VIN I type sent to PlateVIN?
No. The site is a set of static files and has no server that receives VINs. Your browser sends the VIN directly to NHTSA’s vPIC decoding service, which is the same request NHTSA’s own decoder makes, and shows the answer. NHTSA sees the request and your IP address as any web server would. Nothing about the VIN is stored in your browser either.
Where do the specifications come from?
From NHTSA. The decode result is the answer of NHTSA’s vPIC API, which applies the coding keys manufacturers file under 49 CFR § 565.16. The dimensions and weights on the make, model and year pages come from NHTSA’s Canadian vehicle specifications dataset. PlateVIN adds no figures of its own, and the method page describes how the data is cleaned.
Does the recall list tell me whether my car has an open recall?
Not by itself. NHTSA’s recalls API answers for a make, a model and a model year, so the list shows the campaigns filed for that kind of vehicle. Whether a campaign is still open on your exact car depends on repair records, which only NHTSA’s VIN lookup and the manufacturer have. The result links to NHTSA’s lookup for that purpose.
Why does the decoder say the check digit is wrong?
Position 9 of a North American VIN is calculated from the other 16 characters, and a mismatch usually means a typo, so check the characters against the vehicle first. The letters O and I are never valid, and 0/O, 1/I, 5/S and 8/B are the usual confusions. Vehicles built for other markets often carry a 17-character VIN that does not follow the North American check, so a mismatch on an imported car is not by itself a warning.
Why are some fields empty or missing?
Because NHTSA has no data for them. NHTSA states in every response that a missing value should not be read as the absence of a feature. PlateVIN leaves empty fields out instead of guessing, so a car with driver-assistance systems can show none if the manufacturer did not submit them.
Which vehicles can be decoded?
vPIC is built for vehicles sold in the United States, Canada and Mexico, with a 17-character VIN. Cars made for Europe or Asia and later imported may be decoded only in part. Vehicles made before 1981 have shorter VINs of varying format and cannot be decoded here.
Which makes and years have their own pages?
Twelve makes, with model years 2015 to 2025, where NHTSA’s data has at least one specification row for the model year. The makes are Chevrolet, Ford, Honda, Hyundai, Jeep, Kia, Mazda, Nissan, Subaru, Tesla, Toyota and Volkswagen. The tool itself decodes any VIN and is not limited to those makes.
Can PlateVIN tell me the history of a used car?
No. A VIN decoder translates the factory’s build codes; it does not know about accidents, owners, mileage, liens or title brands. Use the decode to check that the car is what the listing says, then get a history report from a provider you trust and have the car inspected before you buy.
How current is the data?
The decoder and the recall list on the result are live: they are fetched from NHTSA when you press Decode. The make, model and year pages are built from a snapshot, and each page shows the date NHTSA’s data was fetched. A scheduled job refreshes the snapshot, so a campaign filed this week may only appear on those pages after the next refresh and publish.
How is PlateVIN paid for?
By a small number of clearly labelled ads that load only after you accept cookies. Ads never appear above the VIN field or inside a result, and they do not change what is shown. The privacy and cookie pages list what is loaded and when.
How do I report a mistake?
Write to the address on the contact page and include the VIN-free details: the make, model and year page and the figure you think is wrong, with a link to the NHTSA page that shows the correct one. Do not send a VIN you do not want to share.