---
title: "How to Decode a VIN Number with Node.js Using Free NHTSA Data"
description: "Learn how to decode any 17-character Vehicle Identification Number (VIN) with Node.js using the free NHTSA vPIC database — or skip the plumbing and call the leeworks.dev VIN Decoder API directly."
date: "2026-05-30"
author: "leeworks.dev"
tags: ["vin-decoder", "nodejs", "automotive", "api", "tutorial"]
---
import Base from '../../layouts/Base.astro';
# How to Decode a VIN Number with Node.js Using Free NHTSA Data
Every vehicle sold in the United States since 1981 carries a unique 17-character fingerprint stamped into the chassis: the **Vehicle Identification Number**, or VIN. Decode it and you unlock make, model, year, trim level, engine type, body class, transmission, plant of manufacture, and more — without paying Carfax $40 per report.
In this tutorial you'll learn how VINs are structured, how to query the free NHTSA vPIC database directly in Node.js, and how to call the **leeworks.dev VIN Decoder API** for a production-ready solution that handles caching, error handling, and batch decoding out of the box.
---
## What Is a VIN?
A VIN is a 17-character alphanumeric string divided into three logical sections:
| Section | Characters | Name | What It Encodes |
|---------|-----------|------|-----------------|
| **WMI** | 1–3 | World Manufacturer Identifier | Country of origin + manufacturer |
| **VDS** | 4–9 | Vehicle Descriptor Section | Model, body style, engine type, check digit |
| **VIS** | 10–17 | Vehicle Identifier Section | Model year, plant, sequential serial number |
### Breaking down a real VIN
Take `1HGCM82633A004352` — a 2003 Honda Accord EX:
- `1HG` → Manufactured in the USA by Honda
- `CM826` → Accord EX 4-door sedan, 2.4L i-VTEC engine (position 9 = check digit `3`)
- `3` → Model year 2003 (position 10)
- `A` → Marysville, Ohio assembly plant (position 11)
- `004352` → Sequential production number
VIN characters deliberately exclude `I`, `O`, and `Q` to avoid confusion with `1`, `0`, and `0` respectively — something to remember when validating user input.
---
## Why NHTSA vPIC?
The **NHTSA Product Information Catalog and Vehicle Listing (vPIC)** is a US federal government database maintained by the National Highway Traffic Safety Administration. It covers:
- All model years 1981 to present
- Every manufacturer registered with NHTSA (domestic and imported)
- 70+ decoded attributes per VIN including engine displacement, fuel type, GVWR, and more
- **No API key, no rate limits** (beyond fair-use throttling), **public domain** under 17 U.S.C. 105
The base endpoint is:
```
https://vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues/{vin}?format=json
```
---
## Calling NHTSA vPIC Directly in Node.js
Here's a minimal Node.js script using the built-in `fetch` API (Node 18+):
```js
// decode-vin.js
const VIN = process.argv[2] ?? '1HGCM82633A004352';
async function decodeVin(vin) {
// Validate: 17 chars, no I/O/Q
if (!/^[A-HJ-NPR-Z0-9]{17}$/.test(vin)) {
throw new Error(`Invalid VIN format: ${vin}`);
}
const url = `https://vpic.nhtsa.dot.gov/api/vehicles/DecodeVinValues/${vin}?format=json`;
const res = await fetch(url);
if (!res.ok) {
throw new Error(`NHTSA returned HTTP ${res.status}`);
}
const json = await res.json();
const r = json.Results[0];
return {
vin: r.VIN,
make: r.Make,
model: r.Model,
modelYear: r.ModelYear,
trim: r.Trim,
series: r.Series,
bodyClass: r.BodyClass,
driveType: r.DriveType,
engineDisplacementL: r.DisplacementL,
engineCylinders: r.EngineCylinders,
fuelTypePrimary: r.FuelTypePrimary,
transmissionStyle: r.TransmissionStyle,
manufacturerName: r.Manufacturer,
plantCity: r.PlantCity,
plantState: r.PlantState,
plantCountry: r.PlantCountry,
errorCode: r.ErrorCode,
errorText: r.ErrorText,
};
}
decodeVin(VIN)
.then(data => console.log(JSON.stringify(data, null, 2)))
.catch(err => { console.error(err.message); process.exit(1); });
```
Run it:
```bash
node decode-vin.js 1HGCM82633A004352
```
Expected output (abridged):
```json
{
"vin": "1HGCM82633A004352",
"make": "HONDA",
"model": "Accord",
"modelYear": "2003",
"trim": "EX",
"bodyClass": "Sedan/Saloon",
"driveType": "FWD/Front-Wheel Drive",
"engineDisplacementL": "2.4",
"engineCylinders": "4",
"fuelTypePrimary": "Gasoline",
"transmissionStyle": "Automatic",
"manufacturerName": "HONDA OF AMERICA MFG., INC.",
"plantCity": "MARYSVILLE",
"plantState": "OHIO",
"plantCountry": "UNITED STATES (USA)"
}
```
---
## The Problem with Rolling Your Own
Calling NHTSA directly works great for a quick script. But for a production application, you'll quickly run into friction:
1. **No caching** — every request hits the NHTSA servers. At scale, this is slow (NHTSA p99 ≈ 800ms) and risks being throttled.
2. **Raw NHTSA response** — the flat key/value array has 80+ fields, many empty; you need to map and filter these yourself.
3. **No batch support** — decoding 50 VINs means 50 sequential round-trips.
4. **No SLA** — the NHTSA API is a government service; it has no uptime guarantee.
5. **Header boilerplate** — proxy-secret validation, request IDs, CORS headers — you write it every time.
---
## Using the leeworks.dev VIN Decoder API
The **leeworks.dev VIN Decoder API** wraps NHTSA vPIC with a 90-day SQLite cache, pre-mapped response schema, and batch endpoint — all available on RapidAPI.
### Single VIN decode
```js
// Using the leeworks.dev VIN Decoder API
const VIN = '1HGCM82633A004352';
const API_KEY = process.env.RAPIDAPI_KEY; // Your RapidAPI key
const res = await fetch(`https://vin.leeworks.dev/v1/decode?vin=${VIN}`, {
headers: {
'X-RapidAPI-Key': API_KEY,
'X-RapidAPI-Host': 'vin.leeworks.dev',
},
});
const data = await res.json();
console.log(`${data.make} ${data.model} (${data.model_year})`);
// → HONDA Accord (2003)
// Check cache status
const cacheStatus = res.headers.get('X-Cache'); // "HIT" or "MISS"
console.log(`Cache: ${cacheStatus}`);
```
### Batch decode (up to 50 VINs)
```js
const vins = [
'1HGCM82633A004352', // 2003 Honda Accord
'1FTFW1ET5DFA18803', // 2013 Ford F-150
'WBA3A5G59DNP26082', // 2013 BMW 3 Series
];
const res = await fetch('https://vin.leeworks.dev/v1/batch', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-RapidAPI-Key': API_KEY,
'X-RapidAPI-Host': 'vin.leeworks.dev',
},
body: JSON.stringify({ vins }),
});
const { results, count, cached_count } = await res.json();
console.log(`Decoded ${count} VINs, ${cached_count} from cache`);
results.forEach(r => {
if (r.error) {
console.log(`${r.vin}: ERROR — ${r.error}`);
} else {
console.log(`${r.vin}: ${r.make} ${r.model} ${r.model_year}`);
}
});
```
### Health check
```js
// No auth required on /health
const health = await fetch('https://vin.leeworks.dev/v1/health').then(r => r.json());
console.log(`Status: ${health.status}, Cache: ${health.cache.total_entries} entries`);
```
---
## Real-World Use Cases
### Automotive apps and dealership software
Show instant vehicle details when a user types a VIN at checkout or trade-in. Cache the result — the same VIN is often looked up dozens of times across different users.
```js
async function enrichListing(listingVin) {
const vehicle = await decodeVinCached(listingVin);
return {
title: `${vehicle.model_year} ${vehicle.make} ${vehicle.model} ${vehicle.trim}`,
engine: `${vehicle.engine_displacement_l}L ${vehicle.engine_cylinders}-cyl ${vehicle.fuel_type_primary}`,
drivetrain: vehicle.drive_type,
body: vehicle.body_class,
};
}
```
### Insurance tech and underwriting
Premium calculators, claims systems, and underwriting platforms need reliable vehicle specs. A VIN decode call returns body class (sedan vs. SUV vs. pickup) and engine details in under 50ms with a cache hit — fast enough for real-time quote generation.
### Fleet management platforms
Decode entire fleets in a single batch call. The `/v1/batch` endpoint processes up to 50 VINs per request, making it practical to seed a database of 10,000 fleet vehicles with 200 API calls rather than 10,000 sequential hits.
### Used car marketplaces
User-generated listings often contain VIN typos or incorrect specs. Validate and auto-fill vehicle details server-side on listing creation:
```js
app.post('/listings', async (req, res) => {
const { vin, ...listing } = req.body;
// Validate + enrich
const vehicle = await vinApi.decode(vin);
if (vehicle.error_code !== '0') {
return res.status(422).json({ error: 'Invalid or unrecognised VIN' });
}
const enriched = { ...listing, vin, make: vehicle.make, model: vehicle.model, year: vehicle.model_year };
await db.listings.create(enriched);
res.status(201).json(enriched);
});
```
---
## VIN Validation
Before calling any API, validate the VIN client-side to save an unnecessary round-trip:
```js
function isValidVin(vin) {
// 17 chars, alphanumeric excluding I, O, Q
if (!/^[A-HJ-NPR-Z0-9]{17}$/.test(vin)) return false;
// Optional: verify check digit (position 9)
const weights = [8,7,6,5,4,3,2,10,0,9,8,7,6,5,4,3,2];
const transliteration = { A:1,B:2,C:3,D:4,E:5,F:6,G:7,H:8,
J:1,K:2,L:3,M:4,N:5,P:7,R:9,S:2,T:3,U:4,V:5,W:6,X:7,Y:8,Z:9 };
const vals = vin.toUpperCase().split('').map(c =>
/\d/.test(c) ? parseInt(c) : transliteration[c]
);
const sum = vals.reduce((acc, v, i) => acc + v * weights[i], 0);
const check = sum % 11;
const expected = check === 10 ? 'X' : String(check);
return vin[8].toUpperCase() === expected;
}
console.log(isValidVin('1HGCM82633A004352')); // true
console.log(isValidVin('1HGCM82633A00435X')); // false (bad check digit)
```
---
## About the Data Source
The NHTSA vPIC database is maintained by the US Department of Transportation under its statutory mandate (49 U.S.C. § 30111). Manufacturers are legally required to register VIN patterns with NHTSA, so coverage is comprehensive for vehicles sold in the US market.
Key facts:
- **Coverage**: Model years 1981–present; 1980 and earlier VINs were not standardised and are not covered
- **Accuracy**: Authoritative for the original vehicle specification; does not reflect modifications, title brands, or recall status
- **Update frequency**: NHTSA updates the database when new model variants are registered, typically months before vehicles reach dealerships
- **Licence**: US federal government work, public domain under 17 U.S.C. 105 — free to use commercially with no attribution requirement
---
## Get Started
The leeworks.dev VIN Decoder API is available on RapidAPI with a free tier (100 requests/month, no credit card required):
👉 **[VIN Decoder API on RapidAPI](https://rapidapi.com/leeworks/api/vin-decoder)**
Full API reference, including request/response schemas and error codes:
👉 **[API Documentation](/vin-decoder)**
---
*Built with ❤️ by [leeworks.dev](https://docs.leeworks.dev) — production-ready data APIs powered by free public-domain data sources.*