Our results show that systems that offer text-only access to a language model reveal information about their prompts. With enough queries, we can extract next-token probabilities at a given position, which can be used to reconstruct the input. Unlike text-based jailbreaks, our dense distribution inversion is less inhibited by post-pretraining reinforcement learning techniques such as RLHF to align the model. We also show that our inversion techniques transfer between models of the same family, and are not affected by language model scaling.