System prompt
In shortA system prompt is a block of standing instructions, set by an app or developer, that shapes how a model behaves across a whole conversation.
In plain words
A system prompt tells the model who it is and how to act before your first message arrives. It often sets a role, a tone, rules and an output format. Developers pass it in a separate field of the API. Google's Gemini docs, for example, use a system_instruction parameter and show it with the line "You are a cat. Your name is Neko." Other providers offer the same idea under similar names.
In a chat app you usually cannot see the system prompt. The app builder wrote it, and it sits before your own prompt in every request.
Why it matters
- Consistency: The same rules apply to every user message, so the assistant keeps one voice and one set of limits.
- Cost: The system prompt is sent with every request. It uses tokens and part of the context window each time. Prompt caching can make a long, fixed system prompt cheaper.
- Safety: A system prompt helps, but it is not a lock. OWASP lists clear system-prompt instructions as one way to constrain a model and says no method is foolproof. Text from users or web pages can try to override it (prompt injection). Anthropic also has a guide on reducing prompt leaks, because a model can be coaxed into repeating its instructions.
- Rule of thumb: Never put passwords, API keys or private data in a system prompt.
Example
A bike shop builds a support bot with this system prompt: "You are the support assistant of a bike shop. Answer in German, in at most five sentences. Do not promise delivery dates. If you do not know, say so and offer to pass the question to a person."
A customer then writes: "My brake squeaks. What now?" The model sees the system prompt and the question together and answers in German, briefly, without a delivery promise. The customer never sees the rules, yet they shape each reply.
Common misconceptions
- "The system prompt is secret." Assume it can leak. Write it so that a leak does no harm.
- "It always wins over the user." Models weigh instructions, but a clever input can still pull them off course.
- "Only developers use it." Some chat apps let you set custom instructions, which act like a small system prompt.
Questions and answers
What is a system prompt used for?
To set a role, tone, rules and format for the whole conversation, so the model behaves the same way for each user message.
Can I see the system prompt of a chatbot?
Usually not. The app builder sets it. Some apps show or let you edit custom instructions, which work in a similar way.
Is a system prompt safe for secrets?
No. A model can be tricked into repeating it. Keep passwords, keys and private data out.
Read next
- Prompt
A prompt is the input you give an AI model: your question or task, plus any instructions, examples and text it should use.
- Prompt injection
Prompt injection is an attack where text a model reads, such as a web page or file, contains instructions that make it act against its user.
- Context window
The context window is the maximum amount of text, counted in tokens, that a model can read and write in one request.
- Prompt caching
Prompt caching lets an AI provider reuse the already processed start of your prompt, so repeated parts are cheaper and faster.