Nonce

A Bitcoin block header is 80 bytes: version, previous-block hash, Merkle root, time, nBits and a 4-byte nonce. The nonce is serialized as an unsigned 32-bit integer. Changing it changes the serialized header and therefore changes the double-SHA-256 result, while leaving the block's transaction set unchanged.

SHA-256 behaves unpredictably with respect to small input changes. Incrementing the nonce by one produces an unrelated 256-bit header hash, so miners can treat each nonce as another independent trial. There is no useful gradient toward a winning nonce; the process is brute-force probability.

Because the header nonce is only 32 bits, one fixed header exposes exactly 4,294,967,296 possible nonce values. Contemporary ASICs can test this entire range many times per second, so serious mining cannot rely on the nonce field alone.

Mining protocols commonly use an extra nonce inside the coinbase transaction. Despite the name, extranonce is not another block-header field. It modifies the coinbase transaction, which changes its txid, then changes the Merkle root stored in the header, thereby creating a new 2^32 nonce search space.

When extranonce changes, the coinbase txid changes. Because the coinbase transaction is a leaf in the block's Merkle tree, its changed txid propagates up to a different Merkle root. The miner now has a fresh 80-byte header even if the previous-block hash, time and most transactions remain unchanged.

Miners can also refresh the header by updating nTime within consensus and policy constraints or by rolling permitted version bits. BIP320 documents general-purpose use of selected nVersion bits. These mechanisms enlarge practical search space but do not alter the proof-of-work rule: the final header hash must still be at or below target.

In pooled mining, the pool or job negotiator supplies template data and allocates unique coinbase/extranonce or other search-space parameters so workers do not duplicate each other's effort. BIP23 explicitly models nonce ranges, while Stratum-family protocols divide work among many devices more efficiently.

A nonce value is not intrinsically good or bad. It becomes relevant only as part of a complete block header. Nodes hash that exact header and compare the resulting integer with the target encoded by nBits. A low-looking nonce provides no security; only a sufficiently low header hash proves work.

Bitcoin also uses the word nonce in unrelated cryptographic contexts, especially signature schemes. A signing nonce is secret ephemeral scalar material whose misuse can leak a private key. The mining nonce is public header data and has no such secrecy requirement. Conflating them is a serious category error.

Run getblockheader on any block hash and Bitcoin Core reports its numeric nonce along with bits, time and other fields. To independently verify proof of work, serialize the 80-byte header exactly, double-SHA-256 it, interpret the hash according to Bitcoin's display/serialization conventions and confirm the numeric value satisfies the target.