Random VIN Generator: What the Federal Decoder Does With a Made-Up VIN

“Random VIN generator” is two different searches wearing one phrase. One of them is a developer with a form to test, a database seed to write or a screenshot to take, who needs seventeen characters that will not be rejected by a validator. The other is somebody who wants a number that will pass as a car’s. This page is written for the first and is deliberately unhelpful to the second, and the reason it can be both is that the federal rules make the difference visible.

The seventeen characters are not free-form. Four separate constraints sit on them before the check digit is even calculated, all of them written into one section of the Code of Federal Regulations, and a generator that ignores any of them produces a string the federal decoder rejects on sight. A generator that honours all of them produces something else — a number that decodes cleanly, describes a plausible vehicle, and corresponds to nothing.

Everything below was tested rather than asserted. The arithmetic was run against the worked example printed in the regulation itself. The generated numbers were fed to vPIC, the federal decoder, and what came back is reported as it came back, including the one place where the decoder’s own error message is wrong.

What a generator can build, and what it cannot

Start with the distinction that decides everything else. A VIN is not a record. It is a label attached to a record, and the two live in different places. The seventeen characters encode a description of how a vehicle was built; the title history, the odometer readings, the recall campaigns and the insurance claims are held in databases that use the number as a key.

A generator operates entirely on the label. It can compose characters that satisfy the format, and if it is well written it will satisfy the format completely. What it cannot do is create the row in the register that the label is supposed to point at. That row exists because a manufacturer built a vehicle and filed the paperwork, and there is no arithmetic that produces one.

This is why the honest description of a well-formed generated VIN is “syntactically valid, semantically empty”. It will pass a validator. It will pass most form fields. Handed to the federal decoder it will often produce a make and a model year, because the decoder reads the format rather than a vehicle register. It will never produce a title, because the title office has never heard of it.

The trap is that the two failures look nothing alike from the outside. A badly generated VIN fails instantly and loudly. A well-generated one fails silently, and only at the point where somebody tries to attach a real record to it — which, in a used-car transaction, is usually the point at which money has already moved.

Position nine, computed forwards

Anyone building a VIN needs the check digit calculator, so here is the calculation in the direction a builder uses it: you choose sixteen characters and the seventeenth is then decided for you.

Give every character a value. Digits are worth themselves. Letters take the values the regulation assigns them: A through H run 1, 2, 3, 4, 5, 6, 7, 8. The counting restarts at J and runs J, K, L, M, N, P, R for 1, 2, 3, 4, 5, 7, 9 — note the jump from 5 to 7, which is the sequence stepping over the slot where an O would sit. Then S, T, U, V, W, X, Y, Z take 2, 3, 4, 5, 6, 7, 8, 9. There are no I, O or Q values because those three letters are barred from VINs entirely, so a character that looks like an I is a 1 and one that looks like an O or a Q is a 0.

Then give every position a weight. Reading left to right they run 8, 7, 6, 5, 4, 3, 2, 10, 0, 9, 8, 7, 6, 5, 4, 3, 2. The weights add up to 89, and the one to notice is the 0 sitting at position 9 — the check digit is not allowed to weigh itself, so whatever ends up there contributes nothing to the total that decides it. That is what makes the calculation possible in the forward direction. You can compute the answer before you know it.

Multiply each value by its weight, add the seventeen products, divide the total by 11 and keep the remainder. The remainder is the check digit. A remainder of 10 cannot be written as one digit, so it is written X, which is why an X at position 9 is entirely ordinary rather than a sign that something is wrong.

The regulation prints its own worked example, and running it is the fastest way to confirm an implementation. Its sample number’s products add to 411; divide 411 by 11 and the remainder is four elevenths, so the check digit is 4. Our own implementation returns 4 for it, which is the only reason we are willing to print any of the arithmetic on this page.

Two more cases are worth keeping as tests. The standard worked example 1M8GDM9AXKP042788 has an X in position 9, and computes to X. A VIN of seventeen 1s is self-checking: every character is worth 1, so every product is just the weight, the total is the weight sum of 89, and 89 divided by 11 leaves a remainder of 1 — which is what sits at position 9. If a calculator gets both of those right, it is doing the regulation’s arithmetic. Our page on validating a VIN you have been given works the same sum in the other direction, on numbers somebody else produced.

Why a random string almost never lands on it

The regulation names the permitted alphabet explicitly: the twenty-three letters left after I, O and Q are removed, plus the ten digits. Thirty-three characters, and every position in the VIN must be occupied by one of them.

Draw seventeen of those at random and the check digit is right by luck alone. We ran a million such draws against the repo’s implementation of the regulation’s arithmetic; the share that satisfied their own check digit came out at almost exactly one in thirty-three, which is what the structure predicts. Position 9 has to be one specific symbol, and a uniform draw from thirty-three characters finds it about one time in thirty-three.

You will also see the figure quoted as one in 11, and that is right about a different generator. There are 11 possible remainders, so if the tool restricts position 9 to the eleven symbols that can legally appear there — the digits 0 to 9 and X — then it is choosing among 11 and hits one time in 11. If it draws position 9 from the whole alphabet like every other position, it is choosing among 33. Which figure applies is a fact about the generator, not about the VIN.

Either way, the practical consequence is the same and it is the reason invented numbers collapse so quickly. Nobody reciting a plausible-sounding string down a phone line is doing modular arithmetic while they talk. A VIN that arrives by word of mouth, or off a handwritten note, and fails its check digit has almost always been mistyped rather than fabricated — but a VIN that was fabricated on the spot fails it too, and fails it in the same second, for free.

The rules that come before the check digit

Most discussion of generated VINs stops at the check digit, which makes the problem look easier than it is. The content requirements section of the federal VIN rule imposes several more constraints, and vPIC enforces them.

The first three characters have to belong to somebody. Positions 1 to 3 are the manufacturer identifier, assigned through SAE International on NHTSA’s behalf rather than chosen by the manufacturer. There is one wrinkle a generator has to respect: a 9 in the third position always signals a six-character manufacturer identifier, meaning positions 12, 13 and 14 are part of the maker’s identity rather than part of the serial. That convention exists for low-volume manufacturers, and it means the last six characters are not always purely a counter.

On a light vehicle, position 7 must be a letter. The rule is explicit: for passenger cars, and for multipurpose passenger vehicles and trucks rated at 4536 kg (10,000 lb) or less, the fourth character of the descriptor section — position 7 of the VIN — shall be alphabetic. A generator that puts a digit there has produced something that is not a legal light-vehicle VIN, and the decoder will read the number differently because of it. That last part is worth seeing directly. We built two numbers identical but for position 7, both carrying the model-year code E at position 10. With a letter at position 7 the decoder returned 2014. With a digit there it returned 1984. One character, thirty years, and the character is nowhere near the model-year position.

Position 10 comes from a fixed thirty-character alphabet. The model-year codes leave out U, Z and 0 on top of the I, O and Q that no VIN position may use — the decoder names all six in its own error text when you get it wrong. That leaves 30 valid codes out of the 33 permitted characters, so a generator picking position 10 freely lands outside the set roughly a tenth of the time. Our model-year chart sets out the full cycle and the ambiguity that comes of it repeating.

The tail must be numeric, and how much of it depends on the vehicle. The rule says the last five characters shall be numeric for passenger cars and for multipurpose passenger vehicles and trucks rated at 4536 kg or less, and the last four for everything else. That difference is not decorative, and the decoder applies it. Using a bus prefix, we submitted numbers with the last five numeric, the last four numeric, and only the last three numeric. The first two came back clean. The third was flagged. Using a light-vehicle prefix, a number with only the last four numeric was flagged — the same tail that was acceptable on the bus.

Add these together and the arithmetic gets unforgiving. Drawing seventeen characters uniformly from the permitted thirty-three, the chance of satisfying the light-vehicle rules on position 7, position 10 and the numeric tail and the check digit all at once is roughly one in twenty thousand. That is before the first three characters are asked to name a real manufacturer.

What the federal decoder did with the numbers we generated

We generated three kinds of VIN and sent every one to vPIC, the National Highway Traffic Safety Administration’s decoder. The three kinds differ only in how much real information they start from, and the results separate cleanly.

Format-legal, random prefix. Twenty numbers built to satisfy every rule above, with the first three characters drawn at random. Fourteen came back with the register’s “manufacturer is not registered” response and no fields at all. Six did not — those six landed on a prefix somebody actually holds, and returned a manufacturer, a vehicle type and a model year. Four of the six also returned a make, and one returned a model. The names that came back belonged to small builders and specialist makers rather than to the marques anybody would think of, which is exactly what a crowded register looks like from the inside. The per-make register file behind this site’s decoder pages holds 542 distinct prefixes across 57 makes, and those 57 makes are a small fraction of everyone who has ever been assigned one.

Registered prefix, invented everything else. Twenty numbers using a real manufacturer prefix, with the descriptor block, the year code, the plant code and a numeric serial all generated. Every one returned a manufacturer. Every one returned a vehicle type. Every one returned a model year. Seventeen of the twenty returned a make. None returned a model, none returned a body class, none returned a trim, and exactly 1 returned an engine displacement.

That gap is the interesting part. Manufacturer and vehicle type come out of the prefix register, which is a lookup table — give it a registered prefix and it answers. Model, body class and engine come from the descriptor block, which the manufacturer files separately and which the decoder matches against submitted patterns. Invented characters do not match a filed pattern, so those fields stay empty. A blank model field on an otherwise populated decode is the clearest single tell that a number was composed rather than built.

Real prefix, invented serial. This is the third kind, and it is the one that should worry people. NHTSA publishes VINs in its complaint data truncated to eleven characters — the manufacturer prefix, the descriptor block, the check digit, the year code and the plant code, with the six-character serial withheld. The archived pull in this repository contains over sixteen hundred distinct eleven-character prefixes of that kind, each one taken from a real vehicle whose owner filed a complaint. A BMW X5 entry, for example, reads 5UXKT0C59G0 and stops.

We took twenty of those published prefixes and appended a six-digit serial of our own, choosing digits that left the published check digit still correct. Nineteen of the twenty came back with the decoder’s clean verdict; the twentieth came back clean with an advisory attached. All twenty returned a make, a model, a model year, an engine displacement, a body class and a fuel type. Nineteen returned a plant city. Eighteen returned a trim.

Nothing in any of those responses indicates that the vehicle does not exist, because the decoder was never asked to check. It reads the format and the manufacturer’s filed patterns, both of which are satisfied. Our page on what a partial VIN returns explains why eleven characters carry the whole decode; the corollary, which is this page’s business, is that the six characters a generator has to invent are precisely the six the decoder never reads.

The error message the decoder gets wrong

One finding here is worth flagging on its own, because it will mislead anybody debugging a generator.

We ran two matched sets of twenty numbers. Both sets used real manufacturer prefixes. Both sets had check digits computed by the regulation’s own arithmetic, verified locally against the worked example. The only difference was the tail: one set ended in five numerals as the rule requires on a light vehicle, and the other had letters in that space.

The numeric-tailed set came back without a single check-digit complaint. The letter-tailed set came back with a check-digit complaint on all twenty — the decoder reporting that position 9 “does not calculate properly” on numbers whose position 9 calculates perfectly. Alongside it, every one of the twenty also carried the decoder’s invalid-characters error, which is the real complaint. The check-digit message appears to ride along with it.

The practical rule that falls out: when the decoder reports a check-digit failure and an invalid-character error together, verify the arithmetic yourself before believing the first message. When it reports a check-digit failure on its own, believe it. And on a number that came off a real vehicle rather than out of a generator, a check-digit failure is nearly always a transcription error, which is a different problem again and covered on the validator page.

The six characters nobody can generate honestly

Positions 12 to 17 are the sequential number the manufacturer assigns during production, and they are the whole of what distinguishes one car from an identical one built the same week at the same plant. Everything a decoder can interpret sits ahead of them.

That structural fact is why generating a VIN is easy and generating a meaningful one is impossible. The interpretable part of the number describes a specification, and specifications are public: the manufacturer filed them, the decoder publishes them, and anybody can compose a set of characters that matches one. The individuating part of the number is a counter held by the manufacturer, and there is no rule, pattern or arithmetic that tells you which values it actually issued.

Federal rule closes the loop from the other side. VINs of any two vehicles built within a 60-year period beginning with the 1980 model year are required not to be identical. Uniqueness is not a convention that emerged; it is a requirement, and it is why the model-year code cycling every thirty years is not a collision problem. The consequence for a generator is uncomfortable: a well-formed number carrying a registered prefix is not a number in a void. It is a number in a space that a real manufacturer has been allocated and is required to keep unique, which means it either identifies a real vehicle already or is reserved against identifying one later.

Why this page does not print the numbers we made

We generated several dozen valid VINs to write this. None of them appears here, and the omission is deliberate rather than coy.

A well-formed VIN carrying a real manufacturer prefix and a plausible serial has a non-zero chance of belonging to somebody’s actual car. That is the direct consequence of the uniqueness rule above: the space is not empty, it is allocated. Printing a list of such numbers on a page that ranks for “random VIN generator” would be handing over a set of strings that some readers would use in exactly the way this page argues against, and a few of which would land on a real vehicle.

The numbers we do print are different in kind. 1M8GDM9AXKP042788 is the standard worked example that appears in teaching material everywhere, and seventeen 1s is a mathematical curiosity rather than a vehicle. The eleven-character prefix quoted above is published by NHTSA itself, truncated by NHTSA precisely so that it identifies a specification rather than a car. Those are safe to print because none of them individuates anything.

The legitimate uses, and how to keep them legitimate

Generated VINs have real work to do, and the good uses share a property: the number never leaves the system it was made for.

Test fixtures are the obvious case. If you are writing a form that accepts a VIN, you need inputs that pass validation and inputs that fail it, and you want them in the source tree rather than pulled from a live database. Generating them is the right answer, and the correct approach is the one this page has described: pick a prefix, honour the position-7 rule and the numeric tail, choose a model-year code from the legal set, then compute position 9 rather than guessing it.

Load and performance testing is similar. So is documentation, so are screenshots, so are demonstrations where a real customer’s number would be a privacy problem. In every one of those the generated string is a placeholder that gets thrown away.

Two habits keep this clean. First, if you can, bias the generated numbers away from plausible production serials — a manufacturer prefix that is not in use, or a serial pattern no assembly line would issue, makes accidental collision with a real vehicle less likely. Second, never let a generated number cross into a system of record. The moment a fabricated VIN is typed into a listing, an insurance form, a registration document or a report request, it stops being test data. Depending on the document, that can be fraud, and it is fraud regardless of whether the number happened to hit a real car.

There is one use case that deserves naming so it can be dismissed. Generating a VIN to put on a vehicle, or to substitute for one on paperwork, is a serious criminal matter, and it does not work anyway: the number has to survive comparison with the plate on the vehicle, the label in the door aperture, the title, and the record the state already holds. Our page on reading a VIN position by position covers where those readings live and how they are compared.

What a generated VIN can never do

It cannot pull a title record, because titles are filed against vehicles that exist and a state office has no row to return.

It cannot return recalls. The federal recall lookup answers per-vehicle, and it answers by matching a number against campaigns tied to production batches. A number that was never in a batch matches nothing, and the empty answer is not a clean bill of health.

It cannot produce a mileage history, an accident record, a lien, a brand or an insurance total-loss report, for the same reason in each case: those are retrievals, not calculations. The only thing about a VIN that can be computed rather than looked up is the check digit, which is why the check digit is the only claim a generator can honestly make about its output.

And it cannot be verified as genuine by anything a buyer does at a keyboard. The decode will look right. That is the whole problem, and it is why the checks that actually settle a used-car purchase are physical and documentary — the number read off the vehicle in more than one place, compared with the title, then run against the free federal lookups.

If somebody sent you a VIN and you want to know whether it is real

Run the check digit first. It costs nothing, needs no database, and eliminates most of what is wrong with numbers that arrive by text message. A failure at this stage is nearly always a transcription problem — an I read as a 1, a swapped pair, sixteen characters instead of seventeen — so go back to the source before concluding anything.

Then decode it and read the shape of the answer, not just the headline. A decode that returns a manufacturer and a vehicle type but no model, no body class and no engine is behaving exactly as our generated numbers behaved: the prefix is real and the descriptor block is not. A decode that returns the full set — model, trim, body, engine, plant — means the descriptor block matches a pattern the manufacturer actually filed, which is a much stronger signal, and which is also what a serial-only fabrication produces.

Then confirm that the decoded description matches the advert. Model year, model, body style, engine and drive type all come back from the federal decoder for a well-formed number, and a seller whose listing disagrees with the decode has some explaining to do before anybody travels.

Then leave the decoder behind, because it has finished its job. Read the number off the vehicle yourself, from the plate at the base of the windscreen and from the certification label in the driver’s door aperture, and check that the two agree with each other and with the title. Run the free federal theft and recall lookups. Buy the title history if the car is a serious candidate. Everything that separates a real vehicle from a well-formed number happens in that sequence, and none of it happens in the decode.

Common questions

Can a random VIN generator produce a valid VIN?

It can produce a VIN that is valid in the only sense arithmetic can establish: seventeen legal characters, formatted correctly, with a check digit that matches. It cannot produce one that corresponds to a vehicle. Those are different claims and only the first is achievable by computation.

How do I calculate a VIN check digit?

Give each character its value — digits are worth themselves, letters take the values fixed by 49 CFR 565.15 — multiply each by its position weight, add the products, divide by 11 and keep the remainder. The remainder is the check digit; a remainder of 10 is written X. Position 9 carries a weight of 0, so the check digit never affects its own calculation, which is what makes it computable in advance.

Will a randomly generated VIN pass the NHTSA decoder?

Often, yes, and that is the point people miss. In our tests, generated numbers on a registered manufacturer prefix returned a manufacturer, a vehicle type and a model year every time. What they did not return was a model, a body class or an engine, because those fields require a descriptor block matching a pattern the manufacturer actually filed.

What is the chance of guessing a valid check digit?

About one in thirty-three if the generator draws position 9 from the full permitted alphabet, and one in 11 if it restricts that position to the eleven symbols that can legally appear there. Neither is a strategy. Compute the digit instead.

Why did the decoder say my check digit is wrong when it is right?

Check the last five characters. On a light vehicle they must all be numeric, and when they are not, vPIC returns an invalid-characters error and a check-digit error together — the second one incorrectly. In a controlled test, twenty numbers with letters in the tail all drew a check-digit complaint despite arithmetically correct check digits, and twenty otherwise identical numbers with numeric tails drew none.

Is it illegal to generate a VIN?

Generating strings for test data is ordinary software work. What is prohibited is using a fabricated number as if it identified a vehicle — on a car, on a title, on a registration, on an insurance form or in a listing. The offence is in the use, not in the arithmetic, and the line is bright.

Can a generated VIN return a vehicle history report?

No. History reports are retrievals from title, insurance and recall databases, all of which are keyed to vehicles that exist. A fabricated number returns nothing, and an empty result should never be read as a clean record.

How would somebody tell a fabricated VIN from a real one?

Not from the decode alone, if the fabrication was built on a real prefix. The reliable checks are physical and documentary: read the number in at least two places on the vehicle, compare both with the title, and run the free federal lookups. A number that exists only on paper has nothing to compare against.

Why are I, O and Q not allowed in a VIN?

So nothing can be confused with 1 and 0 on a stamped plate, a printed label or a handwritten form. The permitted set is the remaining twenty-three letters plus the ten digits, thirty-three characters in total, and every position must be occupied by one of them.

Does a valid check digit mean a VIN is genuine?

No. It means the seventeen characters agree with each other. A VIN copied off a real vehicle and applied to a stolen one passes the check perfectly, because the arithmetic never asks where the number came from — and so does a number a generator computed correctly.