Proof of work (PoW) is a way to show that a computer spent real computation on a task. Producing the proof is expensive, but anyone can check it almost instantly. In Bitcoin, miners repeatedly hash a block header until the result falls below a network target. The first miner to find a valid hash adds the next block. Rewriting history would mean redoing all of that work faster than the rest of the network, which is what makes recorded transactions hard to reverse.
Where the idea came from
Proof of work began as a defence against spam and service abuse, well before cryptocurrency.
- 1992: Cynthia Dwork and Moni Naor presented "Pricing via Processing or Combatting Junk Mail" at CRYPTO '92. They proposed that a sender solve a moderately hard problem before gaining access to a resource. That makes bulk junk mail costly and keeps ordinary mail cheap.
- 1997: Adam Back proposed Hashcash, a CPU cost function aimed at abuse of email and anonymous remailers. His 2002 paper, "Hashcash – A Denial of Service Counter-Measure", describes a token "which can be used as a proof-of-work". It also notes that the server must keep a database of spent tokens to reject double spending.
- 1999: Markus Jakobsson and Ari Juels coined and formalised the term "proof of work" in "Proofs of Work and Bread Pudding Protocols". In their definition, a prover shows it "has performed a certain amount of computational work in a specified interval of time."
- 15 August 2004: Hal Finney announced RPOW (Reusable Proofs of Work). His server accepted Hashcash tokens and issued RSA-signed tokens in return. The tokens could be passed on and exchanged for new ones.
- 2008: The Bitcoin whitepaper by Satoshi Nakamoto used a Hashcash-style proof of work to order transactions without a trusted central party.
How proof of work works in Bitcoin
The block header and the nonce
A Bitcoin block header is 80 bytes and has six fields:
- version
- the previous block header's hash
- a Merkle root summarising the block's transactions
- a timestamp
- nBits, the encoded target
- a 4-byte nonce
The header is hashed with double SHA-256. A block is valid only if that hash is less than or equal to the target.
A hash can't be predicted, so the only way to find a valid one is trial and error. The whitepaper describes it as "incrementing a nonce in the block until a value is found that gives the block's hash the required zero bits." Checking a candidate takes a single hash. That gap is the whole design: finding a valid hash is expensive, and checking one is cheap.
Difficulty adjustment
Every 2,016 blocks, nodes measure how long those blocks took and compare it with the ideal of 1,209,600 seconds, which is two weeks. If blocks came too quickly, difficulty rises, by at most 300% in one adjustment. If they came too slowly, it falls, by at most 75%. Two weeks spread over 2,016 blocks works out to an average target of ten minutes per block, however much computing power joins or leaves the network.
Why history is hard to rewrite
Each header contains the previous header's hash, so the blocks form a chain. Changing one transaction in an old block changes that block's Merkle root and therefore its header hash. That breaks the link to every block after it. The whitepaper states: "To modify a past block, an attacker would have to redo the proof-of-work of the block and all blocks after it and then catch up with and surpass the work of the honest nodes."
Nodes follow the chain with the most accumulated work. The whitepaper calls this "the longest chain." The Bitcoin developer guide says peers "follow the most difficult chain." The whitepaper's calculations show that an attacker's chance of catching up "drops exponentially" as the number of blocks they are behind grows. The developer guide adds that an attacker with a majority of hashing power could reliably rewrite recent history. An attacker with less than 50% still has some chance of success. This is why recipients wait for several confirmations before treating a payment as final.
One CPU, one vote
The whitepaper describes proof of work as "essentially one-CPU-one-vote." Influence over which chain wins depends on computing power, not on how many network addresses someone controls. That makes it expensive to fake many identities to outvote honest participants.
A real block, step by step
Bitcoin block 429,818 was mined on 14 September 2016 at 19:15:41 UTC. Its hash is:
000000000000000004dd3426129639082239efd583b5273b1bd75e8d78ff2e8d
- The hash starts with 17 zero hex digits. This is what a hash below a very low target looks like.
- The winning nonce was 3,977,458,361.
- The block contains 2,012 transactions and points back to block 429,817 through that block's hash (
...6ab1bd21). - It was mined when the block subsidy was 12.5 BTC.
You can check every value yourself with any public block explorer by looking up the height or the hash.
How much would Bitcoin's difficulty change?
Enter the average minutes per block over a 2,016-block period to see the difficulty change at the next adjustment.
| Average minutes per block over the last 2,016 blocks | Difficulty change at the next adjustment |
|---|---|
| 10 min | 0 % |
| 8 min | 25 % |
| 12 min | -16.67 % |
| 2 min | 300 % |
- The average block time is your own input, not a measured network figure.
- A positive result means mining gets harder; a negative result means it gets easier. Results stop at a 300% rise and a 75% fall, the limits for one adjustment.
This shows only the ratio and limits described in the article. It does not predict real block times, hashrate or mining income, and it leaves out the exact rounding nodes apply when they encode the new target.
Mining, rewards and pools
Mining serves two purposes. It orders transactions into blocks, which prevents double spending. It also issues new coins. Under the whitepaper's incentive design, "the first transaction in a block is a special transaction that starts a new coin owned by the creator of the block." In technical documentation this is called the generation transaction. It collects the block reward, which is the block subsidy plus the transaction fees in that block.
The subsidy halves every 210,000 blocks. The fourth halving took place at block 840,000 on 20 April 2024 (UTC) and cut the subsidy from 6.25 BTC to 3.125 BTC.
Solo miners keep the whole reward but may wait a very long time between blocks. Pools reduce that variance. A pool gives its members a target "a few orders of magnitude higher (less difficult)" than the network's. Each header that meets the easier target is a "share", proof that the miner did part of the work. When a share also meets the network target, the pool submits the block. The pool then pays members "based on how many shares they generated." Payouts depend on work contributed, not on speed.
The costs: energy and the shift away from PoW
Proof of work is secure because it consumes real resources, so its electricity use is part of the design.
- Bitcoin: The Cambridge Digital Mining Industry Report (28 April 2025) estimated annual consumption at about 138 TWh, roughly 0.5% of global electricity use. It found that 52.4% of the mining energy came from sustainable sources. The figure is based on reported data covering 48% of global mining activity.
- Ethereum: Ethereum once used a proof-of-work protocol called Ethash. It completed The Merge on 15 September 2022 and switched to proof of stake. ethereum.org estimates the switch cut its energy consumption by about 99.95%. Ethereum no longer uses proof of work.
Proof of work at a glance
| Question | Answer |
|---|---|
| What is proven? | That computation was spent finding a hash below a target |
| Who checks it? | Every full node, with one hash per header |
| What sets the pace? | Difficulty retargeting every 2,016 blocks, toward ~10 minutes per block |
| What secures history? | Changing a block means redoing its work and all later work |
| Main weakness | High energy use, and exposure to an attacker with majority hashing power |
Limitations: energy and hashrate figures are estimates that change over time. This article explains how the technology works and is not investment advice.
