SMS & messages
Remove your data from a text
Coverage: Works with messages from any country and in any language. It removes links, emails, IBANs, cards with their CVV and expiry date, phone numbers, verification codes and ID numbers: Spain’s DNI and NIE, Mexico’s CURP, Italy’s codice fiscale and the UK National Insurance number. ID numbers made only of digits are removed as numbers.
Open toolOn this page
Purpose
Paste a text or a message and remove card numbers, IBANs, codes, phone numbers, emails, links and ID numbers before you forward it or attach it to a report.
Requirements
Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.
Going to forward a suspicious text, post it to warn others or send it to your carrier? Paste it here and we remove your personal data. It runs in your browser: the message is never sent or stored.
How to use it
Message
Remove my data
Copy text
Synthetic example
Invented example, not a real lookup. Do not call or open its links.
Card 4111 1111 1111 1111, call +44 1632 960123Interpret the result
Links
Emails
Bank accounts (IBAN)
Cards
CVV codes
Expiry dates
ID numbers
Phone numbers
Codes and numbers
Limitations
Names and addresses aren’t detected: if the message contains any, delete them yourself before you share it.
It runs in your browser: the message is never sent to NoCall or stored.
Troubleshooting
Paste a message to remove its data.
The message is too long: paste 2,000 characters at most.
Use with the API
Needs an API key and credits. Each completed call costs 1 credit, even when there is no data. An active Pro account includes 20 credits per UTC calendar month, shared by every API route and spent first; unused monthly credits do not roll over. Credits bought on your account page work without Pro and never expire.
Errors are never charged: 401 invalid_api_key (missing or invalid key), 403 pro_required (no Pro credits and no purchased credits), 422 invalid input, 429 quota_exceeded (no credits left), rate_limit_exceeded or ai_busy (the AI of sms-check is at capacity), 503 tool_warming (the data is still being prepared) or tool or provider unavailable. After a 429 or 503, retry once the seconds in the Retry-After header have passed.
Removes personal data from a message before it is shared: links, emails, IBANs, cards with their CVV and expiry, ID numbers, phone numbers and codes become placeholders, with a count per kind. Nothing is stored.
Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.
POST https://api.nocall.io/v2/sms-redact
POST https://api.nocall.io/v2/tools {"tool":"sms-redact","message":"BBVA: su tarjeta 4111 1111 1111 1111 ha sido bloqueada. Llame al +34 612 34 56 78 o entre en https://bbva-seguro.com/login"}Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| message | string (1–2000) | Yes | The message to clean, up to 2000 characters; line breaks are kept. |
REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/sms-redact' \
--header "Authorization: Bearer $NOCALL_API_KEY" \
--header 'Content-Type: application/json' \
--header "Idempotency-Key: $REQUEST_ID" \
--data '{"message":"BBVA: su tarjeta 4111 1111 1111 1111 ha sido bloqueada. Llame al +34 612 34 56 78 o entre en https://bbva-seguro.com/login"}'import json
import os
import urllib.request
import uuid
api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
raise SystemExit('Set NOCALL_API_KEY')
request = urllib.request.Request(
'https://api.nocall.io/v2/sms-redact',
method='POST',
data=json.dumps({'message': 'BBVA: su tarjeta 4111 1111 1111 1111 ha sido bloqueada. Llame al +34 612 34 56 78 o entre en https://bbva-seguro.com/login'}).encode(),
headers={
'Authorization': 'Bearer ' + api_key,
'Content-Type': 'application/json',
'Idempotency-Key': str(uuid.uuid4()),
},
)
with urllib.request.urlopen(request, timeout=30) as response:
result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])import { randomUUID } from 'node:crypto';
const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');
const response = await fetch('https://api.nocall.io/v2/sms-redact', {
method: 'POST',
headers: {
Authorization: 'Bearer ' + apiKey,
'Content-Type': 'application/json',
'Idempotency-Key': requestId,
},
body: JSON.stringify({ message: 'BBVA: su tarjeta 4111 1111 1111 1111 ha sido bloqueada. Llame al +34 612 34 56 78 o entre en https://bbva-seguro.com/login' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);Example response (200)
This is the documented example from the API reference. Lookups use a fictional number, and aggregates and AI answers show the shape of the result, not live data.
{
"data": {
"tool": "sms-redact",
"result": {
"text": "BBVA: su tarjeta [CARD] ha sido bloqueada. Llame al [PHONE] o entre en [URL]",
"counts": {
"url": 1,
"email": 0,
"iban": 0,
"card": 1,
"cvv": 0,
"expiry": 0,
"id": 0,
"phone": 1,
"code": 0
},
"total": 3
}
},
"meta": {
"requestId": "req_example",
"unitsCharged": 1,
"usage": {
"periodStart": "2026-10-01",
"unitLimit": 20,
"unitsUsed": 3,
"unitsRemaining": 17
}
}
}Result fields (data.result)
| Field | Type | Description |
|---|---|---|
| text | string | The message with each match replaced by its placeholder: [URL], [EMAIL], [IBAN], [CARD], [CVV], [EXPIRY], [ID], [PHONE] or [CODE]. |
| counts | object | How many matches of each kind were removed: url, email, iban, card, cvv, expiry, id, phone and code. |
| total | integer | Total number of matches removed. |
Frequently asked questions
Why remove my data before forwarding a scam text?
Because the message may carry your name, your phone number, a code or a link that identifies your account. If you post or forward it as it is, someone else could use them.
Is the scam link removed too?
Yes: every link is replaced with [LINK]. If you want to know where it leads, check it first with NoCall’s link checker, without opening it.
Can I use the text in a report?
To warn other people or your carrier, yes. To report it to the police or your bank, also keep the full original message, with the sender, date and time: that is the evidence.
