<p>Basically, <strong>there is no such thing as a "correct" nonce, only a set of possible "correct" blocks which can use any nonce they wish to obtain an acceptable hash.  So the nonce <em>is</em> just "some arbitrary number".</strong>  But in order to understand how nonces work, you first have to understand the hashing process by which blocks are produced.</p>

<p><a href="http://en.wikipedia.org/wiki/Cryptographic_hash_function" rel="noreferrer">Cryptographic hashes</a> are a mathematical way of turning any set of data into a random number, called a hash.  The hashing process is designed so that <a href="http://en.wikipedia.org/wiki/One-way_function" rel="noreferrer">it's easy to calculate the hash of some data but nearly impossible to find data which will fit a specific hash</a>, having even a slightly different set of data will produce a totally different hash, and so that the only way to find a hash with a particular property (say, being below a certain number) is to calculate lots of them until you get lucky.</p>

<p><strong>In the Bitcoin network, only blocks with certain hashes get accepted and included in the official list.</strong>  The criteria for which blocks "count" is that their hash has to be below a certain number called the target.  The network adjusts this number up and down according to how frequently blocks are passing the test--this is how it's able to keep the rate of block production at an average of 10 minutes per block.  So if the target is</p>

<pre><code>00000692856290566183958127638592383846392938562929689273923968
</code></pre>

<p>then a block with a hash of</p>

<pre><code>00000739485762992939239823472938472569106923385616929838472389
</code></pre>

<p>won't be accepted, but blocks with hashes of</p>

<pre><code>00000683060299472046094517810601040976920106812102601296720934

00000000000000000000000000000000000000000000000000000000453737
</code></pre>

<p>or</p>

<pre><code>00000692856290566183958127638592383846392938562929689273923967
</code></pre>

<p>will all pass with flying colours.  These aren't real hashes--they're just examples.</p>

<p>A miner is taking a list of checked and valid transactions, putting them together in the right format, and then calculating their cryptographic hash.  But let's say that the hash they get doesn't meet the criteria (as most of them don't).  What are they supposed to do?  <strong>The only way to get a different hash is to use at least slightly different data.</strong>  So instead of messing up their list of valid transactions or anything like that, blocks have something called a nonce in them.  <strong>The nonce is just a meaningless number that can be changed as many times as you like so that you can check a bunch of different hashes and see whether they pass the network's difficulty check.</strong>  So when a miner is checking billions of hashes per second (as many of them are) they are just changing the nonce to something else, checking the hash of the whole block; changing the nonce to something else, checking the hash of the (now slightly different) block; changing the nonce again, etc.</p>

<p>In this sense <strong>a "correct" nonce is simply the one that allows the block to hash to an acceptable number.</strong>  Just like there are many acceptable hashes, there are many different nonces which will work for the same block.  But a miner only has to find one of them.  Whichever one they find first is just fine.</p>

<p>You may also be interested in how the <a href="https://bitcoin.stackexchange.com/questions/23912/how-is-the-target-section-of-a-block-header-calculated">target is calculated.</a></p>

CC BY-SA 3.0
2015-01-23T17:26:21.940Z
Very good answer! So, you can also say that the difficulty represents the amount of 0s which need to be at the beginning of the hash?
Kiril
CC BY-SA 3.0
2016-01-22T18:20:58.110Z
Wow, great answer. One of the things I heard a lot when I started learning was "solving a really difficult problem" but not understanding what the problem was or why it was hard. This makes it clear what makes it "difficult" and that outside of this application, it's an essentially useless problem.
redOctober13
CC BY-SA 3.0
2017-06-04T23:59:38.287Z
Thanks for this answer. Quick question: What happens if a correct block is found simultaneously by 2 different miners? Since for the block to be "correct" the hash has to be lower than the target, I'm assuming its a possibility. How does the network handle this?
AlexVPerl
CC BY-SA 3.0
2017-08-04T17:33:33.877Z
Nothing special happens. It's always the case that the last few blocks in the chain are uncertain because some miners could be building on other, equally-long chains. The further back you go in the chain, the lower the probability that a chain not including that block will ever exceed the length of the main chain. Hence the need for multiple confirmations.
David Schwartz
CC BY-SA 3.0
2011-09-28T18:36:13.173Z
In fact, because the nonce is only 32-bits, for most blocks, there is *no* valid nonce that will meet the difficulty. In that case, the miner *does* have to change the transaction set. Typically, the coinbase transaction is changed. (A meaningless field in the coinbase transaction is used as an 'extra' nonce.)
David Schwartz
CC BY-SA 3.0
2011-09-28T18:55:55.773Z
I'm not sure how far back you mean, but at least as of 0.3.23, it would change the coinbase transaction if the nonce was exhausted. And, of course, all modern miners and mining pools do this.
David Schwartz
CC BY-SA 3.0
2011-10-13T17:53:20.110Z
@eMansipater starting from the very first block at difficulty of one extra-nonce was used.  With diffiuclty of 1 the odds of any particular hash meeting target is 1/(2^32).  With only 2^32 nonce values there is a 36% chance for any given header NO nonce value will create a valid hash.   That is at difficulty of 1.  As difficulty rises the probability that no nonce in nonce range will make a valid hash only increases.
DeathAndTaxes
CC BY-SA 3.0
2011-09-28T16:37:22.613Z
2016-10-23T06:00:43.600Z
2017-04-13T12:47:33.610Z
eMansipater
<p>I know that a block is based on a random number called a nonce, but if that number is random  and unknown to the miner, how is that number actually verified as the correct nonce and not some arbitrary number?</p>

CC BY-SA 3.0
2016-01-29T06:37:57.020Z
The nonce is public knowledge once a block is discovered. The number is available to the miner and the verifier.
Nayuki
<block><verification><nonce><mining-theory>
When a block is "discovered" how is the nonce determined?
Andrew
# When a block is "discovered" how is the nonce determined?

(Asked by: username_0 on 2011-09-28)

I know that a block is based on a random number called a nonce, but if that number is random and unknown to the miner, how is that number actually verified as the correct nonce and not some arbitrary number?

**Tags:** block, verification, nonce, mining-theory

> **Comments:**
> **username_1**: The nonce is public knowledge once a block is discovered. The number is available to the miner and the verifier.  

---

## 1 answers

### Answer by username_2 on 2011-09-28. Score: 45

Basically, **there is no such thing as a "correct" nonce, only a set of possible "correct" blocks which can use any nonce they wish to obtain an acceptable hash. So the nonce *is* just "some arbitrary number".** But in order to understand how nonces work, you first have to understand the hashing process by which blocks are produced.

[Cryptographic hashes](http://en.wikipedia.org/wiki/Cryptographic_hash_function) are a mathematical way of turning any set of data into a random number, called a hash. The hashing process is designed so that [it's easy to calculate the hash of some data but nearly impossible to find data which will fit a specific hash](http://en.wikipedia.org/wiki/One-way_function), having even a slightly different set of data will produce a totally different hash, and so that the only way to find a hash with a particular property (say, being below a certain number) is to calculate lots of them until you get lucky.

**In the Bitcoin network, only blocks with certain hashes get accepted and included in the official list.** The criteria for which blocks "count" is that their hash has to be below a certain number called the target. The network adjusts this number up and down according to how frequently blocks are passing the test--this is how it's able to keep the rate of block production at an average of 10 minutes per block. So if the target is

```
00000692856290566183958127638592383846392938562929689273923968

```

then a block with a hash of

```
00000739485762992939239823472938472569106923385616929838472389

```

won't be accepted, but blocks with hashes of

```
00000683060299472046094517810601040976920106812102601296720934

00000000000000000000000000000000000000000000000000000000453737

```

or

```
00000692856290566183958127638592383846392938562929689273923967

```

will all pass with flying colours. These aren't real hashes--they're just examples.

A miner is taking a list of checked and valid transactions, putting them together in the right format, and then calculating their cryptographic hash. But let's say that the hash they get doesn't meet the criteria (as most of them don't). What are they supposed to do? **The only way to get a different hash is to use at least slightly different data.** So instead of messing up their list of valid transactions or anything like that, blocks have something called a nonce in them. **The nonce is just a meaningless number that can be changed as many times as you like so that you can check a bunch of different hashes and see whether they pass the network's difficulty check.** So when a miner is checking billions of hashes per second (as many of them are) they are just changing the nonce to something else, checking the hash of the whole block; changing the nonce to something else, checking the hash of the (now slightly different) block; changing the nonce again, etc.

In this sense **a "correct" nonce is simply the one that allows the block to hash to an acceptable number.** Just like there are many acceptable hashes, there are many different nonces which will work for the same block. But a miner only has to find one of them. Whichever one they find first is just fine.

You may also be interested in how the [target is calculated.](https://bitcoin.stackexchange.com/questions/23912/how-is-the-target-section-of-a-block-header-calculated)

> **Comments:**
> **username_6**: In fact, because the nonce is only 32-bits, for most blocks, there is *no* valid nonce that will meet the difficulty. In that case, the miner *does* have to change the transaction set. Typically, the coinbase transaction is changed. (A meaningless field in the coinbase transaction is used as an 'extra' nonce.)  
> **username_6**: I'm not sure how far back you mean, but at least as of 0.3.23, it would change the coinbase transaction if the nonce was exhausted. And, of course, all modern miners and mining pools do this.  
> **username_7**: @username_2 starting from the very first block at difficulty of one extra-nonce was used.  With diffiuclty of 1 the odds of any particular hash meeting target is 1/(2^32).  With only 2^32 nonce values there is a 36% chance for any given header NO nonce value will create a valid hash.   That is at difficulty of 1.  As difficulty rises the probability that no nonce in nonce range will make a valid hash only increases.  
> **username_3**: Very good answer! So, you can also say that the difficulty represents the amount of 0s which need to be at the beginning of the hash?  
> **username_4**: Wow, great answer. One of the things I heard a lot when I started learning was "solving a really difficult problem" but not understanding what the problem was or why it was hard. This makes it clear what makes it "difficult" and that outside of this application, it's an essentially useless problem.  
> **username_5**: Thanks for this answer. Quick question: What happens if a correct block is found simultaneously by 2 different miners? Since for the block to be "correct" the hash has to be lower than the target, I'm assuming its a possibility. How does the network handle this?  
> **username_6**: Nothing special happens. It's always the case that the last few blocks in the chain are uncertain because some miners could be building on other, equally-long chains. The further back you go in the chain, the lower the probability that a chain not including that block will ever exceed the length of the main chain. Hence the need for multiple confirmations.  

---

