# When a block is "discovered" how is the nonce determined?

I know that a block is based on a random number called a nonce, but if that number is random and unknown to the miner, how is that number actually verified as the correct nonce and not some arbitrary number?

• The nonce is public knowledge once a block is discovered. The number is available to the miner and the verifier. Jan 29, 2016 at 6:37

Basically, there is no such thing as a "correct" nonce, only a set of possible "correct" blocks which can use any nonce they wish to obtain an acceptable hash. So the nonce is just "some arbitrary number". But in order to understand how nonces work, you first have to understand the hashing process by which blocks are produced.

Cryptographic hashes are a mathematical way of turning any set of data into a random number, called a hash. The hashing process is designed so that it's easy to calculate the hash of some data but nearly impossible to find data which will fit a specific hash, having even a slightly different set of data will produce a totally different hash, and so that the only way to find a hash with a particular property (say, being below a certain number) is to calculate lots of them until you get lucky.

In the Bitcoin network, only blocks with certain hashes get accepted and included in the official list. The criteria for which blocks "count" is that their hash has to be below a certain number called the target. The network adjusts this number up and down according to how frequently blocks are passing the test--this is how it's able to keep the rate of block production at an average of 10 minutes per block. So if the target is

``````00000692856290566183958127638592383846392938562929689273923968
``````

then a block with a hash of

``````00000739485762992939239823472938472569106923385616929838472389
``````

won't be accepted, but blocks with hashes of

``````00000683060299472046094517810601040976920106812102601296720934

00000000000000000000000000000000000000000000000000000000453737
``````

or

``````00000692856290566183958127638592383846392938562929689273923967
``````

will all pass with flying colours. These aren't real hashes--they're just examples.

A miner is taking a list of checked and valid transactions, putting them together in the right format, and then calculating their cryptographic hash. But let's say that the hash they get doesn't meet the criteria (as most of them don't). What are they supposed to do? The only way to get a different hash is to use at least slightly different data. So instead of messing up their list of valid transactions or anything like that, blocks have something called a nonce in them. The nonce is just a meaningless number that can be changed as many times as you like so that you can check a bunch of different hashes and see whether they pass the network's difficulty check. So when a miner is checking billions of hashes per second (as many of them are) they are just changing the nonce to something else, checking the hash of the whole block; changing the nonce to something else, checking the hash of the (now slightly different) block; changing the nonce again, etc.

In this sense a "correct" nonce is simply the one that allows the block to hash to an acceptable number. Just like there are many acceptable hashes, there are many different nonces which will work for the same block. But a miner only has to find one of them. Whichever one they find first is just fine.

You may also be interested in how the target is calculated.

• In fact, because the nonce is only 32-bits, for most blocks, there is no valid nonce that will meet the difficulty. In that case, the miner does have to change the transaction set. Typically, the coinbase transaction is changed. (A meaningless field in the coinbase transaction is used as an 'extra' nonce.) Sep 28, 2011 at 18:36
• I'm not sure how far back you mean, but at least as of 0.3.23, it would change the coinbase transaction if the nonce was exhausted. And, of course, all modern miners and mining pools do this. Sep 28, 2011 at 18:55
• @eMansipater starting from the very first block at difficulty of one extra-nonce was used. With diffiuclty of 1 the odds of any particular hash meeting target is 1/(2^32). With only 2^32 nonce values there is a 36% chance for any given header NO nonce value will create a valid hash. That is at difficulty of 1. As difficulty rises the probability that no nonce in nonce range will make a valid hash only increases. Oct 13, 2011 at 17:53
• Very good answer! So, you can also say that the difficulty represents the amount of 0s which need to be at the beginning of the hash? Jan 23, 2015 at 17:26
• Wow, great answer. One of the things I heard a lot when I started learning was "solving a really difficult problem" but not understanding what the problem was or why it was hard. This makes it clear what makes it "difficult" and that outside of this application, it's an essentially useless problem. Jan 22, 2016 at 18:20