Nonce

The nonce is the last field of the block header, and it is 4 bytes long. Miners change it to get a different hash from the same block. It has no meaning of its own. It is a spare field that makes the search possible, and its name is short for "number used once".

What does the nonce do?

Every change to the header gives a completely different hash. The nonce is the cheapest field to change, because it sits at the end of the header and changing it touches no transaction. A miner can therefore try a new nonce, hash the header, and check the result without rebuilding anything.

The search has no skill in it. Each hash is unpredictable, so each try is as likely to win as the one before. Trying nonce 0 gives the same chance as trying nonce 4,294,967,295. Miners count on luck, and on the speed of their hardware.

Every block on the chain carries the nonce that worked. The genesis block's nonce is 2,083,236,893, stored as 1dac2b7c. Block 974,000's nonce is 154,009,711, stored as 6f002e09.

How does a miner search for a valid nonce?

The steps for one attempt are short:

1. Set the nonce in the header.
2. Hash the 80-byte header with HASH256.
3. Read the hash as a number, and compare it with the target.
4. If the hash is below the target, the block is valid. If not, add one to the nonce and try again.

This Python sketch runs that loop. It uses an easy target, a hash that starts with four zero hex digits, so it finishes in a few thousand tries. The real network target is far harder.

import hashlib

def hash256(data: bytes) -> bytes:
    return hashlib.sha256(hashlib.sha256(data).digest()).digest()

# The genesis header with its nonce set to zero. The first 76 bytes stay the same while mining.
version = "01000000"
previous = "00" * 32
merkle = "3ba3edfd7a7b12b27ac72c3e67768f617fc81bc3888a51323a9fb8aa4b1e5e4a"
time_bits = "29ab5f49" + "ffff001d"
header = bytes.fromhex(version + previous + merkle + time_bits + "00000000")

target = 2 ** 240   # a hash below this starts with four zero hex digits
for nonce in range(2 ** 32):
    candidate = header[:76] + nonce.to_bytes(4, "little")
    h = hash256(candidate)
    if int.from_bytes(h, "little") < target:   # Bitcoin reads the hash bytes as a little-endian number
        print(nonce, h[::-1].hex())
        break

Run it and it prints 8603 00007cc6ec08c5d53c32ceaf6e8309c32eb07fc903a94ec77ac2bf6e48f7adb3. The nonce is 8,603, and the hash starts with the four zeros the target asks for. Lower the target and the search takes longer, because fewer hashes pass.

Most block headers never produce a valid hash, even after the whole nonce range is tried. That is why miners also change other fields, as the next section explains.

What happens when every nonce fails?

The nonce holds 4 bytes, so it covers 0 to 4,294,967,295, or 0xffffffff. Bitcoin Core stores it as nNonce in the block header class. Modern mining hardware can run through that range in a small fraction of a second. When the range is used up without a valid hash, the miner must change something else in the header.

Two other fields are free to change:

• The time. A miner can move the timestamp forward a little, which gives the header new bytes. Because mining is so fast, this buys very little time.
• The coinbase. The miner changes the scriptSig of the coinbase transaction, a field where the miner may put any data. A new scriptSig gives a new coinbase txid. That changes the merkle root, and the merkle root is in the header. This extra space is often called the extra nonce.

The version field can serve as an extra nonce too, as noted on its page. Miners usually change the nonce first, because it is the quickest of the three.

Why is the nonce only 4 bytes?

Satoshi chose a 4-byte nonce, and many people now see it as a design limit. It is the reason miners need extra fields to keep searching. A single modern miner can try hundreds of trillions of hashes each second, so the range is small compared with the work asked of it. Read the hashrate page to see how fast a network can search.

What comes next?

Next is block hash, the result that the nonce is trying to shape.