What Is a Nonce? Meaning in English, Cryptography, and Bitcoin Mining
A nonce is something used for one occasion only. In everyday English it survives in the phrase "for the nonce"; in cryptography it is a one-time value that defeats replay attacks; in Bitcoin mining it is the 32-bit field a miner changes while searching for a valid block hash.
Three different fields use the word "nonce", and they all mean the same thing underneath: something that is used once, for one occasion, and then discarded. This entry covers the everyday English word, its etymology, the cryptographic sense, the Bitcoin mining sense in detail — how the search works, why miners need it, and how pools and ASICs extend it — and Nonce, the mining management platform named after it.
Noun and adjective. From Middle English, around 1200. Plural nonces.
The everyday English word
The one particular occasion, time, or purpose. Now used almost exclusively inside the fixed phrase for the nonce, meaning "for now", "for this one time", "for the present purpose".
Made or coined for a single occasion, not intended to last. The standard example is a nonce word: a word invented on the spot for one particular use, which never enters general circulation.
The adjective is much younger than the noun. James Murray, editing the New English Dictionary — the work that became the Oxford English Dictionary — needed a label in 1884 for words that appeared to have been used only once, for the occasion. He coined nonce-word, and the adjective spread from that editorial convention into ordinary usage.
Where the word comes from
Nonce is a mistake that stuck. The original Middle English phrase was for then anes — "for the one purpose" — where then was an inflected form of the definite article. Readers gradually moved the word boundary in the wrong place and re-split then anes as the nanes. The stray n slid off the article and onto the following word, and English was left with for the nonce.
This kind of misdivision, called rebracketing, has happened repeatedly in English:
| Original | Rebracketed as | Result |
|---|---|---|
| for then anes | for the nanes | nonce |
| an ewt | a newt | newt |
| a nadder | an adder | adder |
| a napron | an apron | apron |
The phrase is attested from around 1200, and Chaucer uses for the nones in the General Prologue to The Canterbury Tales — by then it had already become a handy metrical filler for poets who needed an extra syllable.
One thing the etymology is not: "number used once". That gloss is a backronym, invented later because it happens to describe the cryptographic sense neatly. It is a good mnemonic and a bad history.
Nonce in cryptography
An arbitrary value that a protocol uses exactly once, in order to make a message or session unique. A nonce is what stops an attacker from recording valid traffic and replaying it later to impersonate a legitimate party.
The mechanism is simple. If a message contains a value the recipient has never seen before and will never accept again, then a captured copy of that message cannot be reused. Without one, an attacker does not need to break the encryption at all — they can just send the same encrypted order ten more times.
Nonces show up throughout modern security work:
- HTTP digest authentication sends a new nonce with every
401challenge, so each response is valid exactly once. - AEAD ciphers such as AES-GCM and ChaCha20-Poly1305 pair a nonce with the key, so the same key never produces the same keystream twice. Reusing a nonce here is catastrophic.
- Ethereum accounts carry a transaction nonce that increments with each transaction, fixing ordering and preventing the same transaction from being mined twice.
- Signed API requests commonly include a nonce and a timestamp so an intercepted request cannot be resubmitted.
The term entered the security literature in 1978, in Needham and Schroeder's work on authentication in large networks. The same one-time-value sense is the one recorded in the NIST glossary and in Wikipedia's cryptographic nonce entry.
Nonce in Bitcoin mining
The 4-byte field at the end of the Bitcoin block header that a miner varies while searching for a hash at or below the difficulty target. The nonce that produces such a hash is the proof of work.
Every Bitcoin block starts with an 80-byte header made of six fields. Five of them are determined by the network and by the block's contents. The sixth is free:
The nonce is an unsigned 32-bit integer (uint32_t), so it ranges from 0 to 4,294,967,295. Mining
hashes only this header, not the full list of transactions; the transactions enter the hash through
the merkle root.
How the search actually works
- Mining software assembles a candidate block, builds its 80-byte header, and hands the header and the target to the ASIC.
- The ASIC hashes the header with double SHA-256 —
SHA256(SHA256(header)). - It compares the result against the difficulty target encoded in the
Bitsfield. - If the hash is above the target, it changes the nonce and hashes again.
- If it is at or below the target, the ASIC returns the header to the software and the block is valid. The miner broadcasts it, and every other node can verify the work in a single hash.
- If the nonce range runs out first, the software builds a new header — usually with a new merkle root — and the search starts again.
That asymmetry is the whole point of proof of work. Finding the nonce takes the network quintillions of attempts; checking it takes one. Because no one can predict which attempt will succeed, the competition for blocks becomes a competition in real hardware, electricity, and time.
SHA-256 belongs to the SHA-2 family specified in NIST's Secure Hash Standard, FIPS 180-4, and maps any input to a fixed 256-bit output. For mining, what matters is not encryption but three properties of the hash:
- The same input always gives the same output, so anyone can check a result.
- A tiny change to the input changes the output completely, so changing the nonce by one gives an unrelated hash.
- The output cannot be reversed to find the input, so no one can work backwards from the target.
A search variable, not a random number
The nonce is often translated as "random number", and that is misleading in two ways.
First, nothing about the nonce itself is random. ASICs step through values in whatever order the firmware chooses, and can split ranges across chips; the counting from 0, 1, 2 in most explanations is a simplification of that scheduling. What behaves randomly is the hash output. The only real requirement is never to hash the same header twice, because that only reproduces the same hash.
Second, there is no hidden "correct nonce" waiting to be found. The network stores no answer. A nonce is valid only together with the other five fields it was hashed with: put the same nonce in a header with a different previous-block hash, merkle root, or timestamp and the hash is completely different. A nonce that worked for an old header is meaningless for a new one. The nonce is not a reward number or a password either. It is simply the input that is cheapest to vary.
So what miners search for is a whole header whose hash meets the target, and the nonce is the field that changes most often.
What counts as a valid hash
Proof of work compares numbers. Bitcoin Core decodes the target from the header's Bits field
(nBits) and compares the header hash with it as a 256-bit integer: above the target fails, at or
below passes. Diagrams often show winning hashes beginning with a long run of zeros, because a small
256-bit number written in hexadecimal has leading zeros, but the rule is the numeric comparison,
not a count of zeros.
A useful picture is a lottery. Each hash behaves like a fresh draw from 0 to 2²⁵⁶−1, and the target marks off a tiny region at the bottom of that range. Almost every draw misses, and there is no way to know in advance which nonce will land inside.
Nonce, hashrate, and difficulty
The three terms that come up together in mining describe different parts of one search:
| Concept | What it is | Effect on the search |
|---|---|---|
| Nonce | The variable field in the block header | Supplies a new attempt each time it changes |
| Hashrate | Hashes computed per second | Sets how many attempts a miner makes per second |
| Target | The value a header hash must not exceed | Decides whether a single hash is valid |
| Difficulty | How hard the current target is to meet | Higher difficulty means more attempts on average |
Hashrate units — H/s, TH/s, PH/s, EH/s — measure hash speed, not bitcoin. A 100 TH/s miner makes about 100 trillion attempts per second; a 200 TH/s miner about 200 trillion.
Bitcoin aims for one block about every 10 minutes on average and adjusts difficulty periodically to hold that pace. When more ASICs join and network hashrate rises, difficulty rises and the target falls. That does not make the nonce more complicated; it makes qualifying hashes rarer, so more attempts are needed on average. The same ASIC still computes roughly the same number of hashes per second. Only the chance that any one attempt succeeds changes, and a miner whose own hashrate is unchanged ends up with a smaller share of the network.
Each hash is an independent event. A billion failures in a row do not bring the next attempt closer to success, and the hash for nonce 100 tells you nothing about the hash for nonce 101. Results fluctuate a lot over short periods; over longer windows, a miner's results track its share of network hashrate. That is why miners weigh bitcoin price, difficulty, hashprice, electricity cost, machine efficiency, and uptime rather than machine count alone.
When the nonce runs out
A 32-bit field holds 4,294,967,296 values — roughly 4.3 billion. That sounds enormous, and it is completely inadequate. A single modern ASIC runs through the entire nonce range in a fraction of a second, and the network as a whole needs on the order of 10²³ attempts per block. In the CPU and GPU era the range lasted much longer; ASICs turned it into a short inner loop.
So miners extend the search by changing something else in the header, which resets the nonce space:
Arbitrary bytes inside the coinbase transaction. Changing them changes that transaction, which changes the merkle root, which changes the header — yielding a fresh 4.3 billion nonces. This is the standard outer counter.
The timestamp field can legitimately advance within the window the consensus rules allow, and each new value gives another full nonce range.
Unused bits of the version field can be varied as extra search space. This is the mechanism standardised for ASICBoost and negotiated over Stratum: BIP 310 defines the Stratum extension that lets miners roll version bits within a range the pool allows.
Changing which transactions go into the block, or their order, also changes the merkle root and gives a new header.
The header nonce is therefore the inner counter and the extraNonce the outer one. Between them a miner has effectively unlimited search space, and hashrate — hashes per second — is simply the rate at which a fleet gets through nonces. The extraNonce entry covers the coinbase side of this in detail.
The pressure on header-level search space keeps growing with ASIC hashrate. BIP 323, a draft
proposed in April 2026, suggests reserving 24 bits of the header's nVersion field as general nonce
space, so mining controllers have to build new work less often. It is a draft, not a consensus rule.
Nonces in pool mining
Most miners do not search for blocks alone. A pool organises the work: it sends each miner the data needed to build a header, and a share target that is easier to meet than the network target. Every hash then falls into one of three cases:
| Hash result | Meaning | What happens next |
|---|---|---|
| Does not meet the pool target | Ordinary failed hash | The ASIC keeps hashing; nothing is sent |
| Meets the pool target, not the network one | Valid share | Submitted to the pool as proof of work done |
| Meets the Bitcoin network target | Valid block candidate | The pool submits the block to the network |
The vast majority of hashes never leave the machine; sending them all would flood the network. The pool estimates each miner's real hashrate from the valid shares it receives over time. Submitting many shares a day and finding a block are therefore different things: shares measure and divide the work, and only a hash below the network target is proof of work for a new block.
Running the search across a whole pool is a layered system. The pool or node prepares candidate
block work; mining software builds the coinbase transaction, the merkle root, and the header; the
ASIC varies the nonce and hashes. When a header's space is used up, the upper layers change the
extraNonce, the time, or other adjustable data and send new work. Each miner must get a large,
non-overlapping slice of the search space — two machines hashing the same data only waste
electricity — which is what extraNonce values, distinct coinbase data, and separate work templates
provide. BIP 23, which defines pool work templates, even includes a noncerange field for the
nonce range a miner may search.
Who does the searching
Bitcoin mining moved from CPUs to GPUs, then FPGAs, and finally to ASICs — application-specific integrated circuits built to run SHA-256 and nothing else. An ASIC does not predict which nonce will work. It changes the input, hashes, checks, and repeats, faster than general-purpose hardware. Its two advantages are hashrate and energy efficiency, measured in joules per terahash (J/TH), which each ASIC generation keeps improving.
At this level an operator never sees or enters a nonce; the search happens inside the chips and firmware. What an operator can lose is search time. A machine rated at 200 TH/s that overheats and runs at 160 TH/s makes fewer attempts every second. A machine that is offline for an hour makes none. A machine that is powered on but has lost its pool connection, has a firmware fault, a failed hashboard, or no network is not mining effectively either. Each lost minute is attempts that can never be made up.
A note on British usage
In British and Irish slang the same spelling carries a completely unrelated and highly derogatory sense, recorded from the mid-1970s, referring to a sex offender. It shares no etymology with the word described above. It is worth knowing about if you use the technical term in front of a British audience; nothing else on this page relates to it.
Nonce, the Bitcoin mining platform
Nonce is a management platform for Bitcoin mining operations — built by miners, for miners. The name is the unit of work itself: every hash your fleet computes is one more nonce tried, and how many nonces per second your sites get through is exactly what you are being paid for.
The product is organised around three jobs:
Know what's working and what's not, across every site and every machine, so problems get fixed fast.
Cut the time spent on manual fleet work and keep machines online — discovery scans, batch power, firmware, reboot, locator light, and pool changes across thousands of miners at once.
Let the data drive the strategy — mining modes, auto reboot, and shortcuts that push the fleet toward maximum bitcoin per watt.
Operationally it is organised as workspaces containing farms, with an Agent installed on-site to discover and talk to miners. It runs on web, mobile, and Slack; it is SOC 1 Type 2 audited; and it exposes a public API and an MCP server so AI assistants can query and act on the fleet directly.
The platform works one layer above the protocol. It is not a mining algorithm that finds nonces for ASICs, and it is not a pool; it keeps more of the machines doing that search online and at full hashrate. The Nonce mining software entry explains the difference between the protocol nonce and the platform in more detail.
- Product — nonce.app
- Documentation — docs.nonce.app
Related entries
- extraNonce — the outer counter in the coinbase transaction, and how it differs from the header nonce
- Nonce mining software — Nonce the platform, and what "nonce mining software" refers to
- Bitcoin mining data — hashrate, BTC production, efficiency, and cost per coin for mining companies
Frequently asked questions
What is a nonce?
A nonce is something used for one occasion only. In everyday English it survives in the phrase "for the nonce"; in cryptography it is a one-time value that defeats replay attacks; in Bitcoin mining it is the 32-bit field a miner changes while searching for a valid block hash.
What does nonce mean?
A nonce is something used for a single occasion. As a noun it means the one particular occasion or purpose, and it survives almost entirely inside the fixed phrase "for the nonce" — meaning for now, for this one time. As an adjective it labels something coined or made for one use only, as in "nonce word". Modern technical English then borrowed the word: in cryptography a nonce is a value used exactly once in a message or session, and in Bitcoin mining it is the counter a miner varies to search for a valid block hash.
Where does the word nonce come from?
It comes from a Middle English slip of the pen. The phrase was "for then anes" — "for the one purpose" — where "then" was a form of the definite article. Over time readers moved the word boundary and re-split "then anes" as "the nanes", so the stray "n" migrated onto the following word and produced "nonce". English has done this before: "an ewt" became "a newt", and "a nadder" became "an adder". The phrase is attested from around 1200 and Chaucer uses "for the nones" in the General Prologue to The Canterbury Tales.
Does nonce stand for "number used once"?
No. "Number used once" is a backronym — a memorable gloss invented after the fact because it happens to describe the cryptographic sense well. The real origin is the Middle English phrase "for then anes". The gloss is still a useful mnemonic for engineers, but it is not the etymology.
Is nonce still a real English word?
Yes, though the standalone noun is archaic. Outside the fixed phrase "for the nonce" you will rarely meet it in general prose. The adjective is younger than the noun: James Murray coined "nonce-word" as an editorial label in the New English Dictionary (later the Oxford English Dictionary) in 1884, for words that appear to have been used only for the occasion.
What is a nonce in cryptography?
A cryptographic nonce is an arbitrary value that a protocol uses only once. Its job is to make every message or session unique so an attacker cannot capture valid traffic and replay it later. HTTP digest authentication issues a fresh nonce with each challenge for exactly this reason, and stream ciphers and AEAD modes pair a nonce with the key so the same key never encrypts two messages under the same keystream. The term entered the security literature in 1978 with Needham and Schroeder.
What is the nonce in Bitcoin mining?
It is a 4-byte (32-bit) unsigned integer field at the end of the 80-byte Bitcoin block header. Mining is a search: the miner assembles a candidate header, hashes it with double SHA-256, and checks whether the result is at or below the difficulty target. If not, it changes the nonce and hashes again. The nonce is the cheapest thing in the header to change, so it is the innermost loop of the search. A nonce that produces a hash at or below the target is the proof of work that makes the block valid.
Why do Bitcoin miners need a nonce?
Proof of work asks miners to find a block-header hash at or below a target, and SHA-256 output cannot be predicted or reversed, so there is no formula that produces a valid header directly. The only method is to keep changing the header and hashing it again. The nonce is the field built for that purpose: changing it changes the 80-byte header, and every change gives a completely different hash. Without a field that can be varied cheaply, a miner would have no fast way to generate new attempts.
Is the Bitcoin nonce a random number?
Not in the usual sense, even though it is often translated that way. ASICs do not guess the nonce at random; they step through the 32-bit range in an order set by firmware and can split ranges across chips. What behaves randomly is the SHA-256 output, which changes completely when the input changes. There is also no pre-stored "correct nonce": the same nonce gives a completely different hash in a different header, so a nonce is valid only for the exact header it was hashed with. The real requirement is to avoid hashing the same header twice.
How do ASIC miners find a nonce?
By brute force. Mining software builds a candidate block and its 80-byte header and passes the header and the target to the ASIC. The ASIC changes the nonce, runs SHA-256 twice over the header, compares the 256-bit result with the target, and repeats. If a hash is at or below the target, it returns that header to the software. If the nonce range runs out first, the software sends a new header, usually with a new merkle root, and the search starts again. An ASIC does not guess more cleverly than a CPU; it simply makes far more attempts per second.
How many nonce values are there, and what happens when they run out?
A 32-bit field holds 4,294,967,296 values — about 4.3 billion. A modern ASIC exhausts that entire range in well under a second, so the nonce alone is nowhere near enough search space. When it overflows, the miner changes something else in the header to get a fresh 4.3 billion nonces: it increments the extraNonce inside the coinbase transaction, which changes the merkle root; it rolls the timestamp forward within the allowed window; or it rolls unused bits of the version field. Each of those resets the nonce search.
What is the difference between the nonce and the extraNonce?
The nonce is a real field in the block header — 4 bytes, hashed directly. The extraNonce is not a header field at all: it is arbitrary data the miner puts in the coinbase transaction. Changing it changes that transaction, which changes the merkle root, which changes the header. So the extraNonce is the outer counter and the header nonce is the inner counter. Together they give the miner effectively unlimited search space.
How are the nonce, hashrate, and difficulty related?
They are three parts of the same search. The nonce supplies new inputs to try; hashrate is how many of those attempts a miner makes per second (100 TH/s is about 100 trillion hashes per second, not an amount of bitcoin); and the target set by difficulty decides which hashes count as success. When network hashrate rises, Bitcoin raises difficulty to keep blocks near one every 10 minutes on average, so valid hashes become rarer. Each hash is an independent attempt: a billion failures do not bring the next hash closer to success, so the only way to raise the odds is to make more attempts.
Do miners in a pool still search for nonces?
Yes. A pool changes how work is assigned and paid, not how proof of work is computed. The pool sends each miner the data needed to build a header plus a share target that is easier than the network target. Hashes that meet the pool target are submitted as shares, which the pool uses to estimate each miner’s contributed hashrate; all other hashes are discarded locally. Occasionally a share also meets the network target, and then the pool has found a valid block.
Why is the Bitcoin mining platform Nonce called Nonce?
Because the nonce is where mining work actually happens. Every hash a fleet computes is one more nonce tried, and the number of nonces a site gets through per second is its hashrate. Nonce the platform is named for that unit of work: it monitors, manages, and automates the machines doing the searching, so more of the fleet is producing valid work more of the time.