Remove credit card numbers from text
Customers paste full card numbers into emails and chats constantly. This page finds them — with or without spaces and dashes — and replaces each one with a placeholder, leaving order numbers, invoice references and amounts alone.
Detection is verified, not guessed: a candidate must be 13 to 19 digits, pass the Luhn check digit, and start with a prefix that a real card network actually issues.
Your text
Safe to paste
Preset: payment card numbers only.
Mapping — 0 values (only visible in this tab)
| Placeholder | Real value | Uses |
|---|
Check a few rows before you paste — this is the fastest way to spot a detector that grabbed the wrong thing. Nothing here is stored or sent anywhere.
What to look for — 30 detectors, custom terms, exceptions
People & organisations
Government & health IDs
Financial
Technical & secrets
Location
Step 3 — paste the AI’s answer here to put the real values back
The model replies using the placeholders. Paste its answer below and every
[NAME_1] becomes the real name again — using the mapping held in this tab, which
is the only copy that exists.
How it works
- Open this page — the detectors are already set for “Remove card numbers”.
- Paste your text, or drop a .txt, .md, .csv, .json or .log file onto the panel.
- Check the highlights: every match is coloured by type, and one click keeps a type as-is.
- Copy the safe version and paste it into the AI tool of your choice.
- Paste the model’s reply back into step 3 to restore the real values.
Why three checks instead of one
A pattern of “16 digits with optional spaces” matches order IDs, tracking numbers and IMEIs. Adding the Luhn check removes most of them, because only one number in ten passes it by chance. Adding the issuer-prefix test removes almost all of the rest: Visa starts with 4, Mastercard with 51–55 or the 2221–2720 range, American Express with 34 or 37, Discover with 6011 or 65, and the lengths are fixed per network under ISO/IEC 7812.
The sample above shows the effect: the four card numbers are replaced and the sixteen-digit order number — which is Luhn-valid but has no issuer prefix — stays exactly where it was.
What is deliberately not detected
The last four digits are left alone. They are the identifier businesses legitimately use to discuss a payment, they cannot be used to charge anything, and redacting them would break support workflows for no gain.
CVV codes and expiry dates are also not detected, because three digits and a MM/YY pair are indistinguishable from ordinary numbers in text. If they appear beside a card number in your documents, put them in custom terms — and treat any document containing a full PAN with a CVV as an incident, not a redaction task: storing that combination is prohibited under the card-industry rules.
Tips
- Test numbers like 4111 1111 1111 1111 are detected too — they are structurally valid cards.
- If a real card has already been pasted into a chatbot, treat it as compromised and have it reissued.
- For statements and invoices, the financial preset also covers IBANs, routing numbers and account references.
Detectors are pattern-based and imperfect: read the highlighted output before you paste it anywhere, and confirm your own confidentiality obligations against the current rules for your profession, employer or jurisdiction. Compiled 2026-07-29.
Frequently asked questions
Does it detect card numbers split across lines?
Only when the digits are on one line, possibly separated by spaces or dashes. A number broken by a line break is not matched — worth knowing when you paste from a PDF, where wrapping is common.
Is the number checked against a bank?
No. The Luhn check and the prefix test are arithmetic performed in your browser. No lookup service is contacted, which is the whole point of the tool.
Does this make my process PCI DSS compliant?
No. PCI DSS is about how your systems store, process and transmit card data end to end. Removing a number from one piece of text before pasting it elsewhere is a sensible habit, not a control framework.