Every word in a prompt is billed, so each technique has a token cost. Here is what the vendors and papers say, with counts I measured using OpenAI's o200k_base tokenizer.
System prompts are billed on every request
My 225-word support-bot prompt is 275 tokens. At 1,000 requests a day that is 8.25M input tokens a month: $16.50 on Claude Sonnet 5.5 or GPT-6.1 Sol, $0.825 on Haiku 5.5. It will not cache on its own: Anthropic's minimum cacheable prompt for Sonnet 5.5 is 512 tokens and OpenAI's is 1,024 (Anthropic prompt caching, OpenAI prompt caching). To count your own prompts, a browser token counter works without uploading anything.
Few-shot: about 18 tokens per example
In a five-category email classifier, zero-shot is 44 tokens and each example adds about 18, so 10 examples add 181 tokens to every request, or $36.20 per 100,000 requests on Sonnet 5.5. Anthropic recommends 3 to 5 diverse examples (prompting best practices); the original result is Brown et al. (2020). Measure accuracy at 0, 3 and 5 examples before paying for more.
Chain-of-thought is paid as output
Wei et al. (2022) and Kojima et al. (2022) showed step-by-step reasoning helps 2022-era models: MultiArith went from 17.7% to 78.7% with "Let's think step by step" on text-davinci-002. Reasoning models now think internally, and OpenAI's guide says to give them high-level goals. The visible reasoning is output tokens: 1 token for a direct answer versus 58 for a worked one in my example, or $0.01 versus $0.58 per 1,000 answers on Sonnet 5.5. Skip it for classification and extraction.
Prompt injection: design for it
OWASP LLM01 lists prompt injection as the top risk. Indirect injection, hidden instructions in a page or file the model reads, is the harder case, and OWASP says no fool-proof prevention is known. Limit privileges, validate output with deterministic code, require human approval for risky actions, label untrusted content, and test adversarially.
A one-page summary of all of this is in this prompt engineering guide.
