How does proof of work work?

Who writes the next block?

A blockchain needs a way to decide who adds the next block. On open blockchains, many computers compete for that job, usually to win new coins or fees.¹ They don't trust each other, and may only know each other by their addresses.¹ The rules that let them agree anyway are called a consensus model.¹

The puzzle

In proof of work, a node earns the right to publish a block by being first to solve a hard puzzle.¹ The solution is the "proof" that it did the work. The puzzle is hard to solve, but checking an answer is easy.¹

A common puzzle asks for the hash of a block header to be below a target number.¹ The miner changes a number in the header called the nonce, hashes again, and repeats.^1,2 A nonce is a number used only once.¹ There is no known shortcut: the miner just keeps guessing.¹ Checking a winning answer takes a single hash.^1,2

The lower the target, the more guesses it takes on average. Bitcoin assumes each guess's chance of winning is in proportion to the target, so halving the target means, on average, twice as many guesses.³

NIST tried a toy version of the puzzle. Finding a SHA-256 digest that started with six zeros took 10,730,896 guesses, or 54 seconds on old hardware.¹ Asking for seven zeros took 934,224,175 guesses, or about 1 hour and 18 minutes.¹

Keeping the pace steady

Computers get faster over time, and more of them join, so the puzzle's difficulty has to change.¹ Bitcoin resets it every 2,016 blocks, aiming for about one block every ten minutes.¹ It compares how long those 2,016 blocks took with two weeks, which is 1,209,600 seconds.³ If they came too fast, the difficulty rises in proportion. If they came too slowly, it falls in proportion.³ One reset can raise it by at most 300% or cut it by at most 75%.³

Rewards and pools

Miners do this work to earn transaction fees and newly created coins.⁴ Many miners join pools. They split the guessing between them and share the reward.¹

Why history is hard to change

Once a miner has done the work, the block can't be changed without redoing it.² Later blocks are built on top, so changing an old block means redoing that block and every block after it.² Nodes treat the longest chain, the one with the most work in it, as the true one.^2,1

Someone with most of the network's computing power could outpace everyone else and rewrite recent history. This is called a 51 percent attack.³ The Bitcoin guide adds that an attacker with less than half the power still has a good chance of such an attack.³

Proof of work also stops one person from faking thousands of voters. Influence depends on computing power, which costs money, not on network identities, which are free to create.^1,2

The cost

Proof of work uses a lot of resources, and some miners set up where electricity is cheap.¹ Ethereum used proof of work until 2022, then switched to proof of stake.⁵