A nonce, short for "number used once", is a value that is meant to be used a single time in a particular context. In blockchains the word has two main meanings. In proof-of-work mining, the nonce is a field in the block header that miners change over and over in search of a valid block. On Ethereum and similar account-based networks, an account nonce is a counter of how many transactions an address has sent, which keeps transactions in order and stops them being replayed.
The two meanings share an idea, a number that makes something unique, but they do very different jobs. The mining nonce is about finding a hash below a target; the account nonce is about bookkeeping. Outside blockchains, nonces are a standard tool of cryptography, used in encryption schemes and login protocols to make each message or session distinct.
A nonce in plain terms
For the mining nonce, picture a combination lock with billions of possible settings and no clue which one opens it. The only strategy is to try one setting, check, then try the next. The nonce is the dial: miners turn it one notch at a time until the lock happens to click.
For the account nonce, think of a chequebook with numbered cheques. Cheque 7 can only be cashed once, and the bank will not process cheque 9 until cheque 8 has cleared. If someone photocopies cheque 7 and presents it again, the bank refuses it because number 7 has already been used. An Ethereum account nonce works like those cheque numbers.
The mining nonce
On the Bitcoin blockchain, the nonce is a 4-byte (32-bit) field in the 80-byte block header. A miner hashes the header twice with SHA-256 and checks whether the result, read as a number, is at or below the target set by mining difficulty. If not, the miner changes the nonce and tries again. The expected number of attempts is:
- is the expected number of hashes needed to find a valid block.
- is the network difficulty, a number that rises as more computing power joins.
- , about 4.29 billion, is the number of attempts expected at the minimum difficulty of 1.
Worked example: at difficulty , a miner expects to compute about trillion hashes before success. Real Bitcoin difficulty is many orders of magnitude higher, which is why mining is dominated by specialised ASIC machines whose combined hashrate is counted in exahashes (billions of billions of hashes) per second.
A 32-bit nonce offers only about 4.29 billion values, which a modern machine exhausts in a fraction of a second. Miners therefore also change other parts of the block: an "extra nonce" placed in the coinbase transaction (which alters the Merkle tree root), the timestamp, and certain bits of the version field set aside for this purpose by BIP 320. Each change gives a fresh set of nonce values to try.
Proof-of-work Ethereum used a 64-bit nonce with its Ethash algorithm. Since the Merge of September 2022, EIP-3675 requires the block nonce field to be fixed at zero, because proof of stake does not involve a search for hashes.
The account nonce on Ethereum
On the Ethereum blockchain, every externally owned account has a nonce equal to the number of transactions it has sent. A new account starts at 0; its first transaction must carry nonce 0, its second nonce 1, and so on. The rule has several effects:
- Replay protection. A signed transaction with nonce 5 can be executed only once, because after it is mined the account's nonce moves to 6. This blocks the simplest form of replay attack; the chain ID, added in 2016, stops the same transaction being replayed on another network.
- Strict ordering. Transactions from one account are processed in nonce order. If nonce 5 is still pending, nonces 6 and 7 wait behind it in the mempool, however much they pay.
- Replacement. A user can cancel or speed up a stuck transaction by sending a new one with the same nonce and a higher gas price; whichever is included first wins, and the other becomes invalid.
Contract accounts also have a nonce, which counts the contracts they have created; together with the creator's address, it determines the address of each new smart contract. Wallets track nonces automatically, but nonce gaps or conflicts are a common reason transactions appear stuck. Bitcoin has no account nonce: its UTXO model prevents re-use because each coin can be spent only once, which also guards against double spending.
Nonces in wider cryptography
In encryption, many schemes require a fresh nonce for every message encrypted under the same key; re-using one can leak the content of messages or even the key. Digital signature schemes such as ECDSA, used for Bitcoin and Ethereum transactions, rely on a secret per-signature nonce, and history shows that wallets which re-used or poorly generated it exposed their users' private keys. Login and payment protocols use nonces as one-time challenges so that a captured message cannot be sent again.
A nonce differs from a salt. A salt is random data added to a password before hashing so that identical passwords produce different hashes; it is stored and may be public. A nonce's key property is that it is never re-used in the same context, and it need not be random, a simple counter is often enough.