What is a system prompt?

A system prompt is a set of instructions given to a language model separately from the user's messages, usually at the start of every request. It sets the model's role, the rules it should follow, the tone and the output format for the whole conversation. Chat apps and AI products use system prompts to turn a general model into a specific assistant.

3 min read·Checked September 25, 2026·Also called system message, system instructions, developer message

Read the free chapter →Prompt Engineering guide

The system prompt is the job description; each user message is a task handed over during the shift. It is where you put everything that should hold true for every turn of a conversation.

How is a system prompt different from a user prompt?

A system prompt is written by the developer of an application and applies to the whole conversation, while a user prompt is a single message from the person using it. Model APIs treat them as separate inputs: Anthropic's Messages API has a dedicated system parameter, and OpenAI's APIs use a system or developer message, or an instructions field. Models are trained to give system-level instructions more weight than conflicting user requests, which is why applications put their rules there.

Aspect	System prompt	User prompt
Written by	The developer of the application	The end user
Scope	The whole conversation	One turn
Typical content	Role, rules, tone, format, tools, background knowledge	A question or task
Changes	Rarely, with each release of the product	Every message
Priority when they conflict	Usually higher	Usually lower

What should go in a system prompt?

A strong system prompt covers who the assistant is, what it is for, how it should behave and what it must not do.

1
Role and purpose
"You are the support assistant for Acme's invoicing software. You help customers with billing questions."
2
Audience
"Users are small-business owners, not accountants. Avoid jargon."
3
Knowledge and context
Key facts, policies or product details the assistant needs on every turn.
4
Rules and boundaries
What to do, what to refuse, and when to hand over to a human.
5
Tone and style
Length, formality, formatting such as bullet points or plain paragraphs.
6
Output format
Any structure code depends on, such as JSON or specific headings.
7
Edge cases
What to say when information is missing or a request is out of scope.

Write the reason alongside a rule when you can. "Never give tax advice, because we are not licensed to and customers may rely on it" works better than "NEVER give tax advice", because the model can apply the reason to cases the rule did not name.

What does a system prompt example look like?

You are the in-app assistant for Ledgerly, an invoicing tool for freelancers.

Help users create invoices, understand payment statuses and fix common
errors. Answer in plain English in at most four short paragraphs.

Rules:
- Only answer questions about Ledgerly. For anything else, say briefly that
  you can only help with Ledgerly.
- Do not give tax or legal advice. Suggest they speak to an accountant,
  because the rules depend on their country and situation.
- If you are not sure how a feature works, say so and link the help centre
  at help.ledgerly.example instead of guessing.

The user's plan and country are provided in <account> tags on each turn.

Can users override a system prompt?

Sometimes, which is why a system prompt is not a security boundary. Models are trained to prioritise system instructions, but determined users can sometimes talk a model out of its rules, and instructions hidden in documents, web pages or tool results can hijack it. That second problem, prompt injection, is the more serious one. Anything that must never happen, such as leaking another customer's data or running a destructive action, needs enforcement in code, permissions and guardrails, not only an instruction.

Assume users can also extract your system prompt. Several AI companies now publish their own assistants' system prompts. Do not put secrets, API keys or anything embarrassing in one.

Do: Keep the system prompt stable so it can be cached; see prompt caching
Do: Put per-user or per-request details in the user turn, clearly labelled
Do: Explain why each rule exists
Do: Test the prompt against users trying to break the rules
Avoid: Store secrets or credentials in the system prompt
Avoid: Rely on the system prompt alone to prevent harmful actions
Avoid: Let it grow into thousands of words of rules nobody has tested

Frequently asked questions

What is the purpose of a system prompt?

A system prompt sets the model's role, rules, tone and output format for an entire conversation, turning a general-purpose model into a specific assistant for a product or task.

Is the system prompt sent with every message?

Yes. Models do not remember anything between API calls, so applications send the system prompt, along with the conversation history, on every request. Prompt caching can make that repeated content cheaper.

Can a system prompt be hacked?

It can be bypassed or revealed through jailbreaks and prompt injection, so it should not be relied on as the only protection. Enforce critical limits in code and permissions.

How long should a system prompt be?

As long as needed to cover the role, rules, context and format, and no longer. Many production system prompts run from a few hundred to a few thousand tokens. Test that every section actually changes behaviour.

Last checked for accuracy on September 25, 2026. Written by the solidcoder team.