Proof of Work

Every ten minutes or so, somewhere on Earth, a machine wins Bitcoin's lottery and adds a block to the chain. From the outside it looks like raw waste: warehouses of chips computing trillions of hashes per second, most of them thrown away.

Underneath, though, is one elegant idea. A hash function takes any data and scrambles it into a fixed string of digits. Change the input by one character and the output looks completely different — there is no way to steer it. So miners add a nonce, a throwaway counter, and ask a simple question: does the block's hash start with enough zeros?

Almost always the answer is no, so they bump the nonce and try again. Proof of work is nothing more than this: keep guessing until you stumble onto a hash that clears the bar. Hard to find, trivial to check — and that gap is the whole point.

Below is a toy block. Pick a difficulty — how many leading zeros the hash must have — then press Mine the block. The computer counts up through nonces, hashing each one, until it finds a hash that clears the bar.

<p class="hint">{{hint}}</p>
<label class="row">{{label_block_data}}
  <input id="data" type="text" value="KIPU block #1" />
</label>
<label class="row">{{label_difficulty}}
  <input id="diff" type="range" min="1" max="5" value="2" />
  <span id="diffv" class="pill">2</span>
</label>
<div class="btns">
  <button id="mine" type="button">{{btn_mine}}</button>
  <button id="reset" type="button" class="ghost">{{btn_reset}}</button>
</div>
<div class="status" id="status">{{status_initial}}</div>
<div class="hash" id="hash"></div>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; }
.hint { font-size: .9rem; color: #444; margin: 0 0 .8rem; line-height: 1.45; }
.row { display: flex; align-items: center; gap: .6rem; font-size: .9rem; font-weight: 600;
       color: #1d3557; margin: .5rem 0; flex-wrap: wrap; }
input[type=text] { font: 500 14px ui-monospace, monospace; padding: .4rem .6rem;
       border: 1px solid #cdd9e3; border-radius: 8px; flex: 1; min-width: 140px; }
input[type=range] { flex: 1; min-width: 120px; }
.pill { display: inline-flex; min-width: 1.6em; justify-content: center; background: #e8eef3;
       color: #1d3557; border: 1px solid #cdd9e3; border-radius: 6px; padding: .1rem .4rem; }
.btns { display: flex; gap: .5rem; flex-wrap: wrap; margin: .7rem 0 .4rem; }
button { font: 600 14px system-ui, sans-serif; padding: .45rem .9rem; border: 1px solid #1d3557;
         background: #1d3557; color: #fff; border-radius: 8px; cursor: pointer; }
button.ghost { background: #fff; color: #1d3557; }
button:disabled { opacity: .55; cursor: default; }
.status { font-size: 1rem; font-weight: 600; margin: .5rem 0; min-height: 1.4em; }
.status.ok { color: #0a7d33; }
.status.work { color: #b5651d; }
.hash { font: 600 14px ui-monospace, monospace; word-break: break-all; margin-top: .3rem;
        background: #f3f5f8; border: 1px solid #e1e7ee; border-radius: 8px; padding: .6rem; min-height: 1.2em; }
.hash b { color: #0a7d33; }

// Code not found

Watch the asymmetry. Checking the winning nonce is one hash: you can confirm it in an instant. Finding it took the machine many tries — and each extra zero of difficulty multiplies the expected work by 16, because a hex hash starts with a zero only one time in sixteen. Real Bitcoin tunes this knob so that, no matter how much hardware joins, a block still takes about ten minutes.

How hard is mining, really? Not the hardware — the math.

• Checking a candidate block is one hash evaluation: compute it, count the zeros, done.
• Finding a qualifying nonce has no known shortcut. A good hash function is one-way — given the desired output (many leading zeros) you cannot run it backwards to recover an input. All you can do is brute force: try nonces until one works.
• The work is tunable. Requiring D leading zeros means each guess succeeds with probability 1/$16^{D}$, so a miner expects about $16^{D}$ attempts. Bitcoin adjusts D every 2016 blocks to hold the ten-minute pace.
• It is not proven impossible. Proof of work leans on a belief — that SHA-256 has no exploitable structure — the same kind of unproven hardness assumption that underlies modern cryptography. Like factoring, no fast attack is known, but none has been ruled out either.

That is the punchline: security here is not a theorem but a bet that searching is the only option. If someone found a way to invert the hash — the way a P vs NP collapse might make hard searches easy — the lottery would stop being a lottery.

"Make the honest cost cheap and the attacker's cost ruinous" is a pattern that shows up far beyond cryptocurrency:

• Securing blockchains: rewriting history would mean re-mining every block faster than the whole network — proof of work makes that economically hopeless.
• Fighting spam and abuse: the original idea, Hashcash (Adam Back, 1997), asked email senders to burn a little computation per message — trivial for one email, crushing for a spammer sending millions.
• Rate limiting and anti-bot: client puzzles slow down floods of requests without a central gatekeeper.
• Timestamping and fairness: because the work is unpredictable, no one can pre-compute the future, which makes proof of work a rough public clock.

Understand why a qualifying nonce is hard to find and you have met the deeper theme of this site — the gap between checking an answer and discovering one, the same gap behind factoring and P vs NP.

Proof of work hides a beautiful trick: a puzzle that is brutal to solve yet effortless to check, with a difficulty dial that keeps the solving time steady no matter how much hardware shows up. The mountains of mining gear are not solving anything deep — they are simply guessing nonces, fast, until one clears the bar.

So the next time you hear that Bitcoin "wastes" energy, remember what the energy buys: a number anyone can verify in a single hash but that, as far as we know, no one can find except by searching. It is intractability, rented by the block — and like P vs NP, we believe the shortcut isn't there, but we have never been able to prove it.