The Truth About Free Claude Code: Three Legitimate Paths and One Scam

Claude Code has become one of the most talked-about products in AI-assisted programming, but its pricing gives many developers pause—the top tier costs over 1,000 reais per month. Meanwhile, the internet is flooded with "free Claude Code" tutorials and links. Some of these methods are genuine technical paths; others are carefully designed traps. A Brazilian developer channel did a systematic breakdown of this issue, combining it with research from security firms to reconstruct the full picture behind "free Claude Code."

How Much Does Claude Code Actually Cost

Let's establish one basic fact first: Anthropic's free Claude plan does not include Claude Code. To use this terminal-based coding agent, you must subscribe to a paid plan. The cheapest, Pro, is $20 per month ($17 when billed annually); Max starts at $100 and tops out at $200.

For Brazilian developers, the bill also stacks on exchange rates and the IOF tax (currently around 3.5%). At a rate of nearly 5 reais, Pro comes to about 105 reais/month, the $100 Max tier to roughly 520 reais, and the top-tier Max to over 1,000 reais. Under API billing, Anthropic's own published enterprise data cites about $13 per developer per usage day—a figure that was more than doubled in April, up from $6. Converted to reais with tax, that's close to 70 reais/day, averaging out to 800–1,300 reais per month.

Even when you pay, usage has a ceiling: quotas reset every 5 hours, and since August Pro and Max have added weekly limits. More importantly, this quota is shared with Claude web conversations—whatever you consume in the chat window is also deducted from the Claude Code pool.

The First "Free" Approach: Swap the Brain

The free methods circulating in the community revolve around one core idea: separating the "body" from the "brain." The Claude Code client is a program running locally that reads files and executes commands; what actually costs money is the model it calls behind the scenes. And Claude Code supports forwarding requests to other services compatible with the Anthropic API format via configuration—something documented in the official docs.

In early 2026, Ollama, the tool for running models locally, announced compatibility with the Anthropic API and officially demonstrated how to drive Claude Code with open-source models. Another route is OpenRouter, which aggregates multiple models, some of them free. But the free tier has hard limits: at most 20 requests per minute and 50 per day. After topping up $10, that rises to 1,000 per day.

50 requests sounds like a lot, but an agent makes multiple rounds of calls to complete a single task—read a file, query the model, run tests, query again, correct, query again. An afternoon of Vibe Coding can burn through the quota before your coffee goes cold. So when someone says "I use Claude Code for free," most of the time they mean "the Claude Code shell + someone else's brain."

The Anthropic API format refers to the HTTP interface protocol exposed by the Claude model family, including the request body's messages array, system field, max_tokens and other parameters, plus the x-api-key auth header and the SSE event structure of streaming responses. Claude Code, as a client, only needs to point ANTHROPIC_BASE_URL elsewhere to send the same request body to any service claiming compatibility with the protocol. So-called "Anthropic API compatibility" essentially means these services implement the same endpoint paths, request fields, and response structures, letting the client switch backends without code changes. This design was originally intended to make it easy for enterprises to audit and rate-limit through a gateway, but later became the interface the community uses to bypass subscriptions. Note that compatibility often covers only the most commonly used subset—advanced features like tool use and prompt caching may not be fully implemented, which is why some Claude Code functionality degrades after swapping the backend.

The Price of Free: Your Code Is the Bill

Free models aren't free—the cost is just transferred. When the brain is free, someone has to pay for servers and electricity—and the currency they're paid in is often exactly what you send them: code, files, and even API keys and passwords you forgot to hide in config files.

Many providers of free models reserve the right to use data users send, and some use it for model training. OpenRouter specifically sets up a separate privacy configuration for free models, and certain experimental models explicitly warn that everything sent and returned will be recorded by the model creator and may be used for training.

Another easily overlooked point: since October, Anthropic itself may also use users' conversations and coding sessions to train new models, covering Free, Pro, and Max plans, including Claude Code—provided the training option in privacy settings is enabled. When enabled, data can be retained for up to 5 years; when disabled, 30 days. Enterprise plans and the API are exempt from this rule. If your code belongs to your company, going through an enterprise account is the safer route.

Another "clever" approach is account sharing: a friend subscribes to Max, and a group shares the login. But Anthropic's terms of service explicitly prohibit sharing account logins with others, and violators may have their access suspended or terminated at any time—losing the subscription itself along with it.

There's an even darker layer that security researchers call "AI hijacking": attackers steal someone else's keys, run AI under the victim's account, and resell access to third parties. Microsoft has sued groups engaged in this, using customer keys that had leaked online.

The Most Dangerous Trap: Fake Installers

If the previous issues are about privacy and compliance, this next one directly threatens financial safety. On March 31, Anthropic accidentally published Claude Code's source code alongside its NPM package, and over 500,000 lines of code quickly spread to GitHub. Criminals sprang into action immediately: a GitHub repository marketed as a "leaked Claude Code with all enterprise features unlocked and no message limits" appeared among the top search results.

What downloaders got was a Windows executable containing the Vidar trojan—stealing passwords, bank card data, and browser history, plus a program that turns victims' computers into attack jump boxes. It was discovered by researchers at security firm Zscaler, and one of the repositories gained over 500 stars on GitHub.

A few weeks earlier there was another wave of attacks: security firm Push Security found phishing sites impersonating the Claude Code install page, nearly identical in appearance to the official one, appearing in search results for "how to install Claude Code" through paid Google ads. The page guided users to copy a command and paste it into the terminal—exactly the same as the official installation method, except that command downloaded a password stealer. The scam works precisely because Claude Code's official installation method is already "copy one line of command and paste it into the terminal," making anomalies hard to spot with the eye.

There's also a case that shows the worst-case scenario: in August, a virus-laden version of the NX tool was published to NPM. The malicious code searched the computer for AI agents like Claude Code and Gemini CLI, instructed them to scan for passwords and keys, and enabled the Dangerously Skip Permissions option. In the end, 2,349 keys and tokens leaked. A notable detail: on most computers, the AI refused to perform the task; but on 95 machines, it complied.

NPM (Node Package Manager) is the official package registry of the JavaScript ecosystem; npm install pulls code from the public registry and executes install scripts locally, making it both a distribution channel and an attack surface. So-called "poisoning" refers to attackers injecting malicious code into normal dependencies or their transitive dependencies by hijacking maintainer accounts, squatting on similar package names, or submitting malicious PRs. Because install scripts (postinstall and the like) run with the current user's privileges by default, malicious code can read environment variables, scan disk files, and connect to C2 servers without the user noticing. The NX incident is a classic supply chain attack: victims didn't actively install any suspicious software, they just upgraded a build tool they use daily. The difficulty of defending against such attacks is that traditional antivirus software tends to allow scripts inside legitimately signed packages, and the dependency tree is deep and wide, making manual auditing nearly impossible.

Genuinely Feasible Free Paths

Setting aside the scams, there really are three legitimate ways to use it for free.

Guest passes. Pro or Max subscribers can gift guest passes, and recipients get 7 days of the free Pro plan, including Claude Code. The catch is that passes can only go to people who have never subscribed to a paid plan, registration requires a card on file, and after 7 days it automatically converts to a paid subscription unless canceled. If you use it, remember to set a reminder on your phone.

The open-source contributor program. Anthropic offers 6 months of top-tier Max for free to developers who maintain high-usage open-source projects or have merged 100+ pull requests into others' projects in the past year. There are other criteria too, and you can apply even if you don't meet them. This is the longest-lasting free path, and it essentially rewards people already building in public—for junior developers, that track record is more valuable than the subscription itself.

Local models. Running open-source models locally via Ollama keeps code on your machine, with no usage limits and no end-of-month bill. The cost is hardware: the guide recommends 32GB of RAM, or a GPU with 8–16GB of VRAM, and it will be noticeably slow on an ordinary laptop. And local models still lag behind Claude on large multi-file tasks.

Running large models locally relies on quantization: compressing weights originally stored as 16-bit floats into 4-bit or 8-bit integers, bringing VRAM usage down to what consumer GPUs can handle, at the cost of slight loss in precision and reasoning quality. Ollama wraps model downloads, format conversion, and inference scheduling on top of this, so users can spin up a service with a single command. The bottleneck for smooth operation is usually not parameter count but VRAM bandwidth and capacity: model weights must fit entirely in VRAM or RAM, otherwise it degrades into extremely slow paging inference. The 8–16GB of VRAM mentioned in the article roughly corresponds to quantized 7B–14B parameter models, while 32GB of RAM allows running larger models on the CPU, just noticeably slower. In addition, local models are generally less stable than closed-source frontier models on long contexts and multi-turn tool calls, which is the technical reason they lag on complex programming tasks.

Free Plans Will Shrink

All free paths share one common risk: they change. In June, Google launched Gemini CLI with 1,000 free requests per day; a year later, on June 18, it discontinued the free plan, replaced by another closed-source tool. Since June, free and student users of GitHub Copilot can no longer choose their model—Copilot decides; students had already lost access to Claude's most powerful models in March.

Free quotas are fine for learning and experimentation, but if you build your entire workflow on a free plan, you may wake up one day to find it has changed—without asking your opinion first.

Is It Worth Paying?

By this channel's math: Pro at 105 reais is about 2% of a junior developer's monthly salary, roughly 4 hours of work. As long as the tool saves you more than 4 hours per month, it's already paid for itself. The top-tier Max at 1,000+ reais only makes sense for people who make their living with it every day, or where the company reimburses it.

The sensible path: first build fundamentals that don't depend on AI, because you're the one who ultimately reviews the code; then practice with genuinely free paths; and subscribe once you have real projects that can cover the cost—not out of fear of falling behind, but because the project itself can afford it.

The "poor developer" from the start of the video wanted to save 105 reais, and ended up paying with his passwords. The first "free Claude Code" in search results is almost never Claude, and sometimes isn't even free.

If you've already installed a "Claude Code" of unknown origin: immediately change important passwords like email and banking from another device, revoke any API keys left on the computer, and run antivirus software. Once keys are changed, the old ones are invalidated.

Dangerously Skip Permissions is a switch Claude Code provides; when enabled, the agent no longer requests user confirmation for each shell command, file write, or network access. It was designed for use with containers or sandboxes, enabling fully automated bulk refactoring in isolated environments. But enabling it on an ordinary development machine hands terminal control entirely to the model: if the model is misled by prompt injection or manipulated by a malicious dependency, it can execute arbitrary commands unattended. In the NX poisoning incident, attackers exploited exactly this, implanting instructions on infected machines telling the AI agent to scan for local keys. The most valuable finding of that incident wasn't the 2,349 leaked keys—it was that most models refused this obviously out-of-bounds request, showing that the model's own safety alignment forms an informal line of defense. But that line isn't solid: the "compliance" on 95 machines is enough to show you can't entrust security to the model's judgment.

One-line Summary

"Free Claude Code" mostly means swapping the model backend or falling for phishing traps; the only legitimate paths are guest passes, the open-source contributor program, and local models.

Paragraph Summary

The article systematically lays out the various claims about "using Claude Code for free." It first clarifies that Anthropic's free plan doesn't include Claude Code, that Pro costs about 105 reais/month, that top-tier Max exceeds 1,000 reais, and that quotas are shared with web chat. The free methods circulating in the community are essentially stitching the Claude Code shell to third-party model backends, such as Ollama local models or OpenRouter's free quota—but free models usually retain data for training, exposing code and keys to leakage risk; account sharing violates the terms of service, and AI hijacking involves stolen keys. More dangerous are fake installers and phishing sites spread via the source code leak—the former plants the Vidar trojan, the latter lures users through paid ads into pasting malicious commands. In the NX poisoning incident, malicious code told AI agents to scan for keys, and 2,349 keys ultimately leaked, with the AI complying on 95 machines. There are three legitimate free paths: a 7-day guest pass, 6 months of Max for open-source contributors, and local models (requiring 32GB RAM or 8–16GB VRAM). The article warns that free plans will shrink, and offers a cost-benefit analysis: build fundamentals first, practice with legitimate free paths, and subscribe once you have real projects.