Nonce

The word is short for "number used once", and in bitcoin it names the one header field that exists purely to be changed. Four bytes looked generous in 2009 and is trivial now: a single modern machine burns the entire range in a fraction of a second. Miners therefore vary other parts of the header too, and the nonce is only the innermost loop of the search.

How it works

A nonce occupies the last four bytes of the 80 byte header, and mining is the act of running through its values.

The miner assembles a candidate header, hashes it twice with SHA-256, and compares the result against the target. If the result is too large, the counter increments and the header is hashed again. Nothing else has to change, which keeps the loop cheap: SHA-256 works on 64 byte chunks, so the first 64 bytes of the header can be processed once and reused for every attempt.

The problem is range. Four bytes hold 4,294,967,296 distinct values, and an ASIC rated at 200 terahashes per second gets through all of them in roughly 21 microseconds. The search therefore has three outer loops. The miner rolls the extra nonce, a few spare bytes in the coinbase transaction's input script, which changes that transaction, which changes the merkle root, which yields a completely fresh header to search. It can push the timestamp forward within the rules. And since BIP320 it can roll sixteen bits of the version field, using the mask 0x1fffe000, which multiplies the space by another 65,536 without touching the transaction list at all.

Satoshi's own search left a record. The genesis header carries the value 2083236893, found on a CPU in 2009 with no extra nonce rolling and no version bits in sight.

Where you see it

Every block page on every explorer prints the winning nonce, and that number tells you almost nothing.

Because machines walk the space in unpredictable order, and because most real variation now comes from the extra nonce and from version rolling, the number in a mined block is close to random. Reading significance into a low or high one is a common beginner mistake. The field matters more to firmware authors: Stratum assigns each connected machine its own slice of the extra nonce so two workers in the same pool never duplicate effort, and Stratum V2 rebuilds job negotiation around the same coordination problem.

You will also meet the word far away from mining. Encryption schemes use nonces to keep two messages from producing the same ciphertext, Ethereum uses an account nonce as a transaction counter, and web logins use one to block replay attacks. None of those are the block header field, and the shared word causes more avoidable confusion than any other borrowed term in bitcoin.