On this page

SMS & messages

Remove your data from a text

API · Pro

Coverage: Works with messages from any country and in any language. It removes links, emails, IBANs, cards with their CVV and expiry date, phone numbers, verification codes and ID numbers: Spain’s DNI and NIE, Mexico’s CURP, Italy’s codice fiscale and the UK National Insurance number. ID numbers made only of digits are removed as numbers.

Open tool
On this page

Purpose

Paste a text or a message and remove card numbers, IBANs, codes, phone numbers, emails, links and ID numbers before you forward it or attach it to a report.

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

Going to forward a suspicious text, post it to warn others or send it to your carrier? Paste it here and we remove your personal data. It runs in your browser: the message is never sent or stored.

How to use it

  1. Message

  2. Remove my data

  3. Copy text

Synthetic example

Note

Invented example, not a real lookup. Do not call or open its links.

Synthetic example
Card 4111 1111 1111 1111, call +44 1632 960123

Interpret the result

Links

Emails

Bank accounts (IBAN)

Cards

CVV codes

Expiry dates

ID numbers

Phone numbers

Codes and numbers

Limitations

Warning

Names and addresses aren’t detected: if the message contains any, delete them yourself before you share it.

It runs in your browser: the message is never sent to NoCall or stored.

Troubleshooting

Paste a message to remove its data.

The message is too long: paste 2,000 characters at most.

Use with the API

Warning

Needs an API key and credits. Each completed call costs 1 credit, even when there is no data. An active Pro account includes 20 credits per UTC calendar month, shared by every API route and spent first; unused monthly credits do not roll over. Credits bought on your account page work without Pro and never expire.

Note

Errors are never charged: 401 invalid_api_key (missing or invalid key), 403 pro_required (no Pro credits and no purchased credits), 422 invalid input, 429 quota_exceeded (no credits left), rate_limit_exceeded or ai_busy (the AI of sms-check is at capacity), 503 tool_warming (the data is still being prepared) or tool or provider unavailable. After a 429 or 503, retry once the seconds in the Retry-After header have passed.

Removes personal data from a message before it is shared: links, emails, IBANs, cards with their CVV and expiry, ID numbers, phone numbers and codes become placeholders, with a count per kind. Nothing is stored.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

Endpoint
POST https://api.nocall.io/v2/sms-redact
POST https://api.nocall.io/v2/tools  {"tool":"sms-redact","message":"BBVA: su tarjeta 4111 1111 1111 1111 ha sido bloqueada. Llame al +34 612 34 56 78 o entre en https://bbva-seguro.com/login"}

Parameters

NameTypeRequiredDescription
messagestring (1–2000)YesThe message to clean, up to 2000 characters; line breaks are kept.
bash
REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/sms-redact' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"message":"BBVA: su tarjeta 4111 1111 1111 1111 ha sido bloqueada. Llame al +34 612 34 56 78 o entre en https://bbva-seguro.com/login"}'

Example response (200)

This is the documented example from the API reference. Lookups use a fictional number, and aggregates and AI answers show the shape of the result, not live data.

JSON
{
  "data": {
    "tool": "sms-redact",
    "result": {
      "text": "BBVA: su tarjeta [CARD] ha sido bloqueada. Llame al [PHONE] o entre en [URL]",
      "counts": {
        "url": 1,
        "email": 0,
        "iban": 0,
        "card": 1,
        "cvv": 0,
        "expiry": 0,
        "id": 0,
        "phone": 1,
        "code": 0
      },
      "total": 3
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

Result fields (data.result)

FieldTypeDescription
textstringThe message with each match replaced by its placeholder: [URL], [EMAIL], [IBAN], [CARD], [CVV], [EXPIRY], [ID], [PHONE] or [CODE].
countsobjectHow many matches of each kind were removed: url, email, iban, card, cvv, expiry, id, phone and code.
totalintegerTotal number of matches removed.

Frequently asked questions

Why remove my data before forwarding a scam text?

Because the message may carry your name, your phone number, a code or a link that identifies your account. If you post or forward it as it is, someone else could use them.

Is the scam link removed too?

Yes: every link is replaced with [LINK]. If you want to know where it leads, check it first with NoCall’s link checker, without opening it.

Can I use the text in a report?

To warn other people or your carrier, yes. To report it to the police or your bank, also keep the full original message, with the sender, date and time: that is the evidence.