StopNCII.org: What It Is, Is It Real, and How to Use It From India

StopNCII kya hai? What the tool is and who runs it

NCII stands for non-consensual intimate imagery: nude, partially nude or sexual photos or videos of a person shared, or threatened to be shared, without consent; in plain Hindi, bina sahmati ke saajha ki gayi nijee tasveerein ya video. Indian law does not use the acronym, but Rule 3(2)(b) of the IT Rules 2021 covers exactly that content.

There is no stopncii.gov.in; we checked in September 2026 and the address does not exist. India's official route is the National Cyber Crime Reporting Portal at cybercrime.gov.in and the 1930 helpline. Anyone who tells you StopNCII is a sarkari portal, or that a fee is payable to file it, is wrong on both counts.

Is StopNCII.org real or fake?

Real. It is a working service with a published partner list, a privacy policy and a case-status page, and Facebook, Instagram, TikTok, Reddit and X publicly participate in it. The genuine site is recognisable by what it does not ask for.

The address is stopncii.org and nothing else. It charges nothing. It never asks you to upload a photo or video, because the hashing happens on your own device. It does not ask for your name, an Aadhaar number or a payment. It has no phone line; the site publishes no telephone number on its home page, FAQ or case-status page. And its FAQ says it cannot reset your password or recover your case number, because it does not keep them.

The fakes come in two kinds. Lookalike sites that ask you to upload the image, or to pay to register it, are collecting the very material you are trying to protect. And anyone who offers, for a fee, to file StopNCII for you cannot do what they are offering: the hash must be generated on the device that holds the image, by the person who holds it. Anyone taking money for it is doing nothing, or asking you to send the file.

How it works: the hash never leaves your phone

The tool creates a hash, which the site calls a digital fingerprint, from each image or video you select. The site states that hashes are created directly on your device and that the hash is the only file shared with StopNCII.org. The image is not uploaded, nobody at StopNCII sees it, and StopNCII does not store it; a hash cannot be turned back into the image. Participating platforms look for matches within their own systems and remove or block them, and the site periodically re-checks after the case is created.

When a case is created you receive a case number and set a password; keep both. The Check Case Status page takes them and shows whether the image has been blocked, and the case number is also what you use to withdraw your hashes later. If either is lost, the FAQ says StopNCII cannot retrieve it, because it does not save that information.

StopNCII.org kaise use kare: step by step

Eligibility first. The image must be of you, you must have a copy of it, it must be intimate, meaning nude or sexual, you must be currently over 18, and you must have been 18 or older when it was taken. If any one is not met, do not use it; the under-18 route is in the last section.

The steps, as the site sets them out. Open stopncii.org on the device that holds the image and start a case. Answer the eligibility questions. Select the image or video; the hash is generated on the device and only the hash is sent. Note the case number and the password you set. The partner platforms then look for matches and block or remove them; progress shows on the Check Case Status page.

It works before anything is posted. StopNCII's FAQ recommends creating a case where someone is threatening to share your images, or you fear they might, so the hash is already with the partner platforms if an upload is attempted. In a sextortion matter, create the case the day the threat arrives, alongside the report at cybercrime.gov.in.

Do it yourself, on your own device. RepuLex cannot do this step for a client: the hash must be generated where the file is, we never ask for the file, and the case number and password are the client's alone. We put it on day one of the plan and confirm it is done.

Which platforms honour StopNCII hashes, and which do not

A hash only helps on a platform that has agreed to receive it. The partner page at stopncii.org/partners listed nineteen organisations when we read it in September 2026, and the list changes; check it before relying on any table, including this one.

Microsoft uses the hashes in Bing search; Google runs a separate request of its own. Telegram is the gap that matters most in India: leaked files move through its channels faster than anywhere else, and no hash stops them there.

What StopNCII cannot do

It removes nothing by itself that is already posted. Where content has already been shared, StopNCII's FAQ says the first step is to report it to the platforms, with the images added to StopNCII for future protection; a live URL still comes down only on a complaint to its host.

It does not act on non-partner sites, and says so: it works only with the platforms on its partners page and does not prevent sharing across the whole internet. A file on xHamster, Telegram or a mirror host is untouched by it, and it does not de-index Google. It promises nothing: a cropped, re-encoded or screen-recorded copy may not match the original's hash.

RepuLex does not operate StopNCII, has no access to it, and cannot check a case's status for a client, because the case number and password are the client's alone. Hashing happens on the client's own device, and RepuLex uploads client images to no third-party database.

India's own hash bank: the MeitY NCII SOP, Sahyog and I4C

India is building a hash system of its own, and it runs through the state rather than a charity. In November 2025 the Ministry of Electronics and Information Technology published a Standard Operating Procedure to curtail the dissemination of NCII content (version 1, dated October 2025 on its cover), in line with the Madras High Court's directions in W.P. 25017/2025 (order of 15 July 2025).

The SOP directs significant social media intermediaries to deploy crawler or similar technology to identify the hashes of reported NCII content and take down similar content at other URLs, citing Rule 4(4) of the IT Rules 2021. Rule 4(4) was itself strengthened by the amendment notified on 10 February 2026: a platform no longer shall endeavour to deploy such tools but shall deploy appropriate technical measures, including automated tools, to proactively identify the listed content and anything exactly identical to content previously removed under Rule 3(1)(d).

Then the national layer. Hashes collated by a platform are to be communicated to the Indian Cybercrime Coordination Centre, I4C, through the Sahyog Portal where the platform is onboarded, for secure hash banks; I4C under the Ministry of Home Affairs is the aggregation point for the NCII hash bank and for every removal request received through One Stop Centres, the police and the National Cyber Crime Reporting Portal. Search engines are told to de-index, CDNs and registrars to render flagged content inaccessible, and the Department of Telecommunications coordinates ISP blocking.

The clock is the other half. The SOP repeats the figure Rule 3(2)(b) carried when it was drafted; the Rule itself now requires removal within two hours of the complaint (24 hours until 20 February 2026) for content that exposes a private area, shows nudity or a sexual act, or is impersonation including artificially morphed images. A StopNCII hash and an Indian complaint are different instruments: one stops uploads on partner platforms, the other starts the two-hour removal clock for any intermediary operating in India.

StopNCII not working? What to do next

Not working usually means the file is already live, the host is not a partner, or the case status shows nothing because no partner has yet seen an upload. Each has a next step that does not depend on StopNCII.

Report to the platform directly. Every Indian-regulated intermediary must publish a grievance officer and a complaint mechanism under Rule 3(2), a Rule 3(2)(b) complaint can be made by you or by anyone on your behalf, and the two-hour clock runs from that complaint. If the officer does not respond in time, the SOP records the appeal to the Grievance Appellate Committee under Rule 3A.

File Google's request. Its policy, Remove personal sexual content from Google Search, covers intimate imagery of you shared without consent and fake or AI-generated explicit imagery that falsely depicts you, through a form whose address ends in lr_idmec. It removes the result from Search, not the page from the site, so it runs alongside the host complaint.

Report at cybercrime.gov.in under Women/Children Related Crime, or call 1930. The SOP makes the portal the aggregation point and lists One Stop Centres and the local police as parallel routes. A police complaint is not a condition of removal, but it is how the person responsible is identified.

Where content has been posted, StopNCII goes on the client's day-one list, done by the client on their own device, and the paid sweep runs around it: mapping every mirror, Rule 3(2)(b) complaints to each host, Google's request, Telegram's abuse desk, notices under advocate signature by our partner law firm, Unified Chambers And Associates, where a host ignores the civil route, and monitoring for re-uploads. It is quoted as a sweep after the spread is mapped, at concessional rates for individuals, payable in advance and refunded in full for any URL not removed within the agreed timeline.

Under 18: do not use StopNCII

StopNCII's eligibility rules exclude anyone under 18 and anyone whose image was taken before they turned 18; its FAQ points such users to Take It Down, a free service of the National Center for Missing and Exploited Children in the United States. In India the route is not optional: report to the police and at cybercrime.gov.in under Women/Children Related Crime, immediately.

Section 67B of the Information Technology Act 2000 punishes publishing or transmitting material depicting children in a sexually explicit act in electronic form, and creating, downloading or distributing it, with imprisonment of up to five years and a fine of up to ten lakh rupees on first conviction, and up to seven years on a subsequent conviction; children means persons who have not completed 18 years. The Protection of Children from Sexual Offences Act 2012 applies alongside it, with its own provisions on the use of a child for pornographic purposes and the storage of such material.

RepuLex refuses these matters as reputation work. Where the person in the images is under 18, the engagement stops there, we help make the police and portal reports, and we do not accept an instruction to handle it quietly. Holding or forwarding the file, including to us, is itself an offence: send URLs only, never the file.