How to Jailbreak ChatGPT: What It Is and Why It Rarely Works
To jailbreak ChatGPT means trying to trick it into ignoring its own safety rules, usually with a specially written prompt. It rarely works for long. OpenAI patches known jailbreaks, attempts break its Terms of Use and can cost you your account, and fake jailbroken ChatGPT downloads often carry malware. Here is what jailbreaking involves and what to do instead.
Jailbreaking ChatGPT is not a hack in the technical sense. Nobody breaks into OpenAI's servers. A jailbreak is a piece of writing, usually a prompt or a role-play frame, that tries to persuade the model to ignore the safety rules it was trained to follow.
The best known example is DAN, short for Do Anything Now, a fake persona that first appeared on Reddit in December 2022 and asked ChatGPT to answer as a chatbot with no rules. CNBC covered the craze in early 2023 as users pushed the model to break its own guidelines. Most versions stopped working within weeks, which set the pattern every jailbreak since has followed.
In this guide
What does jailbreaking ChatGPT actually mean?
The word comes from phone jailbreaking, where owners removed restrictions to install unapproved apps. With ChatGPT the term is looser. There is nothing to unlock. The model's limits are not a padlock on a door but part of how it was trained, so a jailbreak is simply an attempt to talk the model out of following that training.
Researchers who studied the phenomenon in detail catalogued 1,405 jailbreak prompts shared between December 2022 and December 2023, spread across 131 communities. They described the main strategies as prompt injection and privilege escalation: pretending the rules do not apply, or pretending the person writing has the authority to suspend them.
This article deliberately does not share any working prompts. Most are patched, sharing them would breach the rules described below, and copying one from a stranger is a common way accounts and devices get compromised.
Why do people try to jailbreak ChatGPT?
Three reasons come up again and again. Some people are curious and want to test the edges of the model. Some hit a refusal they consider overcautious, such as a reasonable question about medicine or history that got misjudged, and go looking for a way round it. A small minority want the things ChatGPT refuses for good reason: instructions for weapons, fraud or abuse.
The second group has a fair point, and there are better answers than jailbreaking. ChatGPT sometimes refuses legitimate requests, and rephrasing the question, adding context or asking it to explain the concern usually gets a useful answer. The last group is exactly who the safety rules exist to stop.
Do jailbreak prompts still work?
Briefly, and only for a while. The largest academic study of jailbreak prompts, published on arXiv in 2023, found five prompts that achieved a 0.95 attack success rate against ChatGPT running GPT-3.5 and GPT-4, and the longest-lived of those had persisted for more than 240 days.
That was the high-water mark. OpenAI treats each widely shared jailbreak as a defect and trains it out of later models, so a prompt that worked against GPT-3.5 in 2023 has no effect on the models of 2026. Guides promising working jailbreaks today are usually a year or more old, quietly rehashed for traffic, or bait for something else entirely.
Is jailbreaking ChatGPT allowed?
No. The Terms of Use that govern UK users, updated 16 January 2026, prohibit interfering with or disrupting the service, including circumventing any rate limits or restrictions or bypassing any protective measures or safety mitigations. A jailbreak attempt is precisely that, in OpenAI's own words.
OpenAI's Usage Policies, updated 21 October 2026, list circumventing safeguards alongside malware and harassment in the behaviour they prohibit. The policies are blunt about the consequence: breaking or circumventing the rules and safeguards may mean you lose access to OpenAI's systems, and enforcement can include removing content, limiting features, and suspending or terminating accounts.
What are the real risks of trying?
The account risk is the predictable one. The Terms of Use reserve OpenAI's right to restrict, suspend or terminate access when someone breaches them, including the Usage Policies. Losing a paid subscription that way is an expensive experiment.
The malware risk is nastier. Anything marketed as a jailbroken ChatGPT, an uncensored GPT or a filter bypass tool is by definition not run by OpenAI. TechRadar reported in June 2025 on criminals using search engine optimisation to push fake AI tools loaded with malware to the top of Google, and security researchers keep finding fake ChatGPT download pages serving infostealers to Windows and Mac users. If a site's main promise is that it breaks the rules, it is not a safe place to type your login.
The data risk follows from the second. A real jailbreak attempt happens inside your own ChatGPT account, but a third-party jailbreak service means pasting your requests, and sometimes your account details, into someone else's server with no contract and no recourse. For the everyday habits that keep your account safe, see our ChatGPT security tips guide, and if your account shows warning signs, our unusual activity guide explains the fixes.
What should you do instead of jailbreaking?
Almost every legitimate frustration that sends people looking for jailbreaks has a rule-abiding answer:
Rephrase the request. If ChatGPT refused something reasonable, say what the request is for and ask again with that context attached.
Ask it to explain the refusal. It will usually tell you which part of the request was the problem, and you can remove that part.
Set up custom instructions once, telling ChatGPT how direct you want its answers, and it applies to every chat afterwards.
Check whether the feature already exists. Custom GPTs, adjustable settings and the model picker cover many of the things people once tried to jailbreak for.
If your goal is a ChatGPT that is more useful rather than less safe, those get you there without risking your account or your device. For the wider picture on what the model does with your data, see our plain-English privacy guide.
Frequently asked questions
Is jailbreaking ChatGPT illegal?
Using a jailbreak prompt is not usually a crime in the UK by itself, but it breaks the Terms of Use you agreed to when you signed up, which is a contract. Anything you then ask the model to do can still be illegal, and responsibility for that sits with you, not OpenAI.
What was the DAN jailbreak?
DAN, short for Do Anything Now, was a fake persona that appeared on Reddit in December 2022. The prompt told ChatGPT to answer as a chatbot with no rules or restrictions. It was widely shared, heavily covered in the press, and largely patched out within months.
Can you get banned from ChatGPT for jailbreaking?
Yes. The Terms of Use that govern UK users let OpenAI restrict, suspend or terminate access for bypassing protective measures or safety mitigations. Enforcement can start with content removal or feature limits, and repeat or serious breaches can end the account.
Do jailbreak prompts still work in 2026?
Rarely, and never for long. A 2023 study of 1,405 jailbreak prompts found five with a 0.95 success rate against the models of that era, but every widely shared jailbreak gets trained out of later models. Prompts sold as working 2026 jailbreaks are typically outdated, exaggerated, or bait.
Are uncensored ChatGPT apps and websites safe?
Treat them as unsafe by default. Anything calling itself a jailbroken or uncensored ChatGPT is not run by OpenAI, and several have been found distributing malware or harvesting logins. There is no official uncensored version of ChatGPT.
Why did ChatGPT refuse my question?
Most refusals come from safety training that is deliberately broad, so legitimate questions sometimes get caught by mistake. Asking what the concern was, adding context or rephrasing usually gets a useful answer. Our guide to how accurate ChatGPT's information is covers where its answers still need care.
Key takeaways
Jailbreaking ChatGPT means using written prompts to try to make it ignore its safety training. Nothing is technically unlocked.
It breaks the Terms of Use that govern UK users, and can lead to content removal, feature limits, suspension or termination.
Jailbreak prompts age fast. The high-success prompts of 2023 do not work against the models of 2026.
Fake jailbroken ChatGPT apps and download pages are a common malware and credential theft vector.
Rephrasing, custom instructions and asking ChatGPT to explain a refusal solve most legitimate frustrations safely.
The bottom line
The honest answer to how to jailbreak ChatGPT is that it is a contract breach with weak odds and a real downside, aimed at limits that exist for reasons that are usually good. Learn the legitimate levers in our beginner's guide to ChatGPT, and you rarely need the illegitimate ones.
