What is proof of work?
Definition · Proof of work (PoW)
A system where the right to add a block goes to whoever first finds a hash of the block header below a target. Finding it takes enormous numbers of guesses; checking it takes one hash.
Satoshi Nakamoto described it in the Bitcoin whitepaper in 2008, building on Adam Back’s Hashcash, an older idea for making email spam expensive. The valid hash is the proof. You can’t get one without doing the work, and anyone can see that you did.
The rest of this page walks through each piece, and the box above lets you try it: that’s a real Bitcoin header format, hashed live in your browser. For the bigger picture of mining, see our complete Bitcoin mining guide.
What problem does proof of work solve?
Bitcoin has no company, bank or server in charge. Thousands of computers keep their own copy of the ledger, and they have to agree on which block comes next and in what order payments happened. Otherwise someone could spend the same coin twice.
A simple vote doesn’t work online, because anyone can start a thousand fake computers and vote a thousand times. That’s called a Sybil attack. Proof of work sidesteps it: your say is measured in hashes, and hashes cost electricity and hardware.
Who gets a say in the next block?
One vote per node
One attacker starts 60 fake nodes for free and outvotes the 12 honest ones.
One vote per hash
honest miners 88%attacker 12%
The same 60 nodes share the attacker’s real hardware, so together they still weigh 12%. Copies are free, hashes aren’t.
What’s inside a Bitcoin block header?
Miners don’t hash the whole block. They hash its 80-byte header, which commits to everything else. These are the six fields you edited in the box at the top:
| Field | Bytes | What it holds | Who changes it |
|---|---|---|---|
| Version | 4 | Which rule set the block follows | Rarely changes |
| Previous block hash | 32 | The hash of the block before, which links the chain | New with every block |
| Merkle root | 32 | One fingerprint of all the block’s transactions | Miner, when transactions or the extra nonce change |
| Time | 4 | When the miner says the block was made (Unix time) | Miner, within limits |
| Bits | 4 | The target, packed into 4 bytes | The network, every 2,016 blocks |
| Nonce | 4 | A free number to try again with | Miner, on every guess |
Because the header includes the previous block’s hash, changing an old block changes its hash, which breaks the next header, and the one after that. We checked the real genesis block from 2009 with the same code the hero uses, on our server, when this page was built:
000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f
How does SHA-256 work in Bitcoin?
SHA-256 turns any input into a 256-bit number, written as 64 hex characters. Bitcoin runs it twice on the header (people call it SHA-256d). The properties that matter for mining are simple:
Same in, same out
Deterministic
The same header always gives the same hash, on any computer. That’s why checking works.
256 bits
Fixed size
A short line or a whole book, the hash is always 64 hex characters.
One-way
No shortcut back
You can’t work out an input that gives a hash you want. You can only try inputs.
≈ 50%
Avalanche
Change one character and about half the bits flip. Watch the grid in the hero.
That last property is the heart of proof of work. A hash close to the target tells you nothing about the next guess, so there’s no clever path to a valid block. Every miner is running the same lottery, and more hashes a second just buys more tickets.
What is the target, and why the leading zeros?
The target is a 256-bit number. A block is valid when its hash, read as a number, is at or below it. Since small numbers start with zeros, a lower target shows up as more leading zeros. Each extra hex zero means 16 times more guesses on average.
Average hashes needed to find one valid block
- The toy block in the hero · 4 leading hex zeros65,536
- Bitcoin’s easiest target (2009) · 8 leading hex zeros, bits 1d00ffff4,294,967,296
- A Bitcoin block today · about 20 leading hex zeros (live estimate)6.0 × 1023
The network moves the target every 2,016 blocks, about two weeks, so blocks keep arriving about every ten minutes however much hashrate joins or leaves. Right now the network runs at about 1003 EH/s (live, updated hourly). How that adjustment works is in our Bitcoin mining difficulty guide, and the hashrate explainer covers the units.
What is a nonce, and what is the extra nonce?
The nonce (“number used once”) is the 4-byte field miners change on every guess. It’s the only field that’s there purely to be changed. The trouble is that 4 bytes give only about 4.3 billion values, and modern machines chew through that almost instantly.
The miner’s loop
- 01
Try every nonce
0, 1, 2 and on up to 4,294,967,295. That’s all the values 4 bytes can hold.
- 02
Run out, fast
A single 100 TH/s machine gets through all of them in about 43 millionths of a second.
- 03
Change the extra nonce
The miner edits a spare field in its own reward transaction (the coinbase).
- 04
New merkle root
That transaction changed, so the merkle root changes and every nonce gives fresh hashes again.
So miners also change an extra nonce, a few spare bytes in the coinbase, the block’s first transaction that pays the miner. A new coinbase means a new merkle root, and that means billions of fresh nonces to try. In a mining pool, the pool hands each miner its own extra nonce range so nobody repeats someone else’s work.
Why is a block expensive to find but cheap to check?
To find a block
≈ 6.0 × 1023 hashes
The whole network, all its machines, about ten minutes of guessing.
Live estimate, updated hourly.
To check it
1 hash
Any node, even a cheap laptop, hashes the 80-byte header once and compares it with the target in well under a millisecond.
The miner has to try hashes until one lands under the target. Everyone else only has to hash the header once and compare. That lopsided cost is what lets thousands of ordinary computers verify the chain without trusting the miners who built it.
Try the search part yourself below. This demo uses a simpler block format than the hero, but it’s the same double SHA-256 lottery, and each found block links to the last one.
Interactive · mine a block in your browser
Real SHA-256d proof of work, simplified header
Block hash (double SHA-256)
Edit the transactions: the hash changes completely with a single letter.
Attempts: 0
Your hashrate: n/a
Time: 0.0 s
What is the longest-chain rule, and what is a 51% attack?
Sometimes two miners find a block at almost the same moment, and the network briefly has two versions. Nodes follow the chain with the most total work behind it. People call it the longest chain, but it’s really the heaviest one: a few blocks at a high difficulty can outweigh more blocks at a low one.
To reverse a payment, an attacker would have to build a heavier chain than everyone else, starting from before that payment. Each new block on top (a confirmation) puts the attacker further behind. The whitepaper worked out the odds; move the slider to see them:
Interactive · can an attacker catch up?
Formula from the Bitcoin whitepaper, section 11
- 0
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
Blocks the attacker is behind (confirmations). Bars use a log scale, from one in a million up to certain.
With 10% of the hashrate, the chance of rewriting a payment after 6 confirmations is 0.024%, and after 1 confirmation it’s 20.5%.
With 50% or more, the attacker wins eventually. That’s the 51% attack. It’s serious, but it has limits:
With most of the hashrate, an attacker can
- Replace recent blocks with their own chain
- Double-spend coins they sent themselves
- Leave some transactions out of their blocks
Even then, they can’t
- Spend coins from other people’s wallets
- Create coins beyond the block reward
- Change Bitcoin’s rules for everyone else
That’s why exchanges wait for several confirmations on large deposits. Six is the common rule of thumb.
Why does proof of work use so much energy?
Because the energy is the security. A valid block is proof that real electricity was spent. To rewrite history, an attacker has to spend at least as much again, and keep spending while the honest network moves on.
Where the energy goes, and what it buys
Block reward and fees
New BTC plus fees for each block, paid to whoever finds it.
Machines and electricity
Miners spend up to what the reward is worth to them.
Network hashrate
All that spending shows up as hashes per second.
Cost to rewrite history
An attacker has to outspend all of it, block after block.
How much electricity that is, and where it comes from, is a fair debate. The Cambridge index tracks estimates, and our Bitcoin mining energy guide goes through the numbers. Every halving cuts the new-coin part of the reward, so over time fees have to carry more of that security budget.
Proof of work vs proof of stake: what’s the difference?
Proof of stake (PoS) picks the next block producer from people who lock up coins as a deposit, instead of from people burning electricity. Ethereum switched from proof of work to proof of stake in 2022. Here’s a fair side by side:
| Proof of work | Proof of stake | |
|---|---|---|
| Who adds the next block | The first miner to find a hash below the target | A validator picked in proportion to their stake |
| What secures it | Electricity and hardware spent outside the chain | Coins locked inside the chain, which can be taken for cheating |
| Energy use | High, by design | Low |
| To take part | Machines and cheap power | Coins to stake |
| Settlement | Grows safer with each confirmation | Explicit finality checkpoints |
| Main criticism | Energy use and mining concentration | Stake concentration and a more complex design |
| Track record | Bitcoin, since 2009 | Ethereum, since 2022 |
Bitcoin’s developers have kept proof of work because its cost sits outside the system, so nobody can buy control with coins they already hold. Proof of stake’s supporters point to the energy saving and faster finality.
Can you earn bitcoin from mining without running proof of work yourself?
Yes. With CloudMineCrypto you mine bitcoin for free from your phone or browser, with no hardware, noise or power bill. Claim the free 8-hour plan, and add more free plans by watching ads, playing games, completing offers and checking in daily. Your BTC balance grows while your plans run, and you withdraw to your own wallet, Lightning included.
Each plan has a hashrate, and your estimate is that hashrate’s share of the whole network, times 6 blocks an hour, times the block reward. That’s the formula the app uses to estimate your rewards (rules and limits apply). Want more speed? An optional paid plan adds hashrate, with the price shown before you confirm.
Good to know: rewards are estimates that move with the network and aren’t guaranteed, and a plan doesn’t give ownership of any machine or pool. Limits or verification may apply to withdrawals. The details are in the reward rules and the free Bitcoin mining guide. Terms apply.
Frequently asked questions
What is proof of work in simple terms?
It’s a way to make adding a block cost real effort. Miners hash the block header over and over, changing a number called the nonce, until the result falls below a target. Finding that hash takes huge numbers of guesses, but anyone can check it with a single hash.
What is a nonce in Bitcoin?
A 4-byte number in the block header that miners change on each guess. It has about 4.3 billion possible values. When they’re used up, miners change an extra nonce inside the coinbase transaction, which gives a new merkle root and a fresh set of hashes.
Why does Bitcoin use SHA-256 twice?
Bitcoin hashes the 80-byte header with SHA-256 and then hashes that result again. Satoshi never explained the choice. The usual reading is that it guards against length-extension attacks and gives an extra safety margin.
What does a 51% attack let someone do?
Someone with most of the hashrate can build a longer chain in private and replace recent blocks, which lets them double-spend their own coins or block some transactions. They can’t spend other people’s coins, create coins beyond the rules or change the rules for everyone.
Is proof of stake better than proof of work?
It uses far less energy, and security comes from coins locked as stake. Proof of work ties security to an outside cost, electricity and hardware, and has run Bitcoin since 2009. Each makes different trade-offs, so which is better depends on what you value.
Can I earn bitcoin from mining without my own hardware?
Yes. In the CloudMineCrypto app you claim free mining plans (the free plan, ads, games, offers and a daily check-in) and your BTC balance grows while they run, then you withdraw to your own wallet. Rewards are estimates based on your plan’s hashrate and live network data, they aren’t guaranteed, and a plan doesn’t give ownership of any hardware.
Sources and further reading
- Bitcoin: A Peer-to-Peer Electronic Cash System (the whitepaper) · Satoshi Nakamoto, bitcoin.org
- Block chain guide: block headers, proof of work, coinbase · Bitcoin developer documentation
- Mining guide: solo mining, pools, getblocktemplate · Bitcoin developer documentation
- Difficulty · Bitcoin Wiki
- Confirmation · Bitcoin Wiki
- Cambridge Bitcoin Electricity Consumption Index · Cambridge Centre for Alternative Finance
- Mining dashboard: hashrate, difficulty, recent blocks · mempool.space
Live figures on this page (network hashrate, block reward, BTC price) come from the CloudMineCrypto API, refreshed hourly, and are labelled where they appear. This guide is educational and not financial advice. CloudMineCrypto is not an investment product; rewards in the app are estimates and aren’t guaranteed.
You’ve read how it works. Now watch it happen.
Claim a free 8-hour mining plan in the CloudMineCrypto app and see your estimated BTC tick up from live network data. No hardware, no card.