Nonce Finder

Every nonce gets found eventually.

A nonce is a number used once. In the exchange below your browser is handed one by the server and then goes looking for a second one — two different kinds of nonce, doing two different jobs, in a single round trip. It takes a moment. Every value reported is the real one.

Live verification

What a nonce is

The word is borrowed from linguistics, where a nonce word is one coined for a single occasion with no expectation that it survives past it. A cryptographic nonce is that idea applied to a number: a value put into a protocol to be used once and then never again.

Its usual job is freshness. If a message carries a value that has never appeared before and never will again, then a copy of that message captured off the wire is worth nothing. Replaying it is detectable, because the value has already been spent. That is what a nonce buys — not secrecy, but the guarantee that this exchange is this exchange and not a recording of an earlier one.

HTTP digest authentication is the textbook case. The server answers a request with a 401 and a nonce; the client folds that nonce into a hash of its credentials; the result is valid only against that one challenge. Capture the response and send it again and the server has already retired the nonce it was built from. The password never crossed the wire, and the recording is useless.

Nonces of this kind are typically random or pseudo-random, often carry a timestamp so both ends agree when they lapse, and some definitions require outright unpredictability. The point is always the same: uniqueness, so that nothing can be reused.

Proof of work uses the word differently

In every case above, the nonce is chosen to be unique and then simply used. Nobody looks for it. In a proof-of-work system it is the opposite: the server fixes everything else, and you vary the number until the hash of the whole thing lands inside a narrow target. It is still used once, but being used once is no longer the point of it. Being hard to find is.

By a strict reading it barely qualifies. The definitions want randomness, or unpredictability; the number your browser just found was reached by starting at zero and counting upward. It is a search variable that inherited the name because it sits in the same slot in the message. This site is called Nonce Finder because this is the one sense of the word where a nonce is something you can find at all.

Both senses are in the exchange above. The token the server issued is a nonce in the classical sense — one-time, signed, expiring, retired the moment it is spent. The nonce your browser hunted is the proof-of-work sense. The first prevents replay. The second imposes cost.

Why there is no shortcut

SHA-256 is built so that its output tells you nothing about its input. Change one bit and roughly half the output bits flip, unpredictably — the avalanche property. So there is no way to work backwards from "a hash starting with 00" to a number that produces one, and no way to steer toward it: nonce 41 and nonce 42 give completely unrelated results, and being close to a solution means nothing, because there is no gradient to climb.

Guessing and checking is not the best available strategy. It is the only one. That is the entire basis of the cost, and it is why the work can't be optimised away by a cleverer client.

What the difficulty costs

A hash is written in hexadecimal, and each hex digit is four bits — sixteen possible values. The chance that any given digit is a zero is 1 in 16, so a hash with N leading zeros turns up roughly once every 16^N attempts.

Every extra zero multiplies the work by sixteen, which makes whole numbers a very coarse dial — the step from 3 to 4 is the difference between a blink and several seconds on a slow phone. That is why the difficulty here is allowed to be fractional.

A fractional difficulty keeps the leading zeros and then constrains the digit immediately after them. At difficulty 2.5 the target is two zeros followed by a digit below 8 — half of the sixteen values that digit could take — so it costs about 512 attempts: twice difficulty 2, half of difficulty 3. Fractions let the server aim between the powers of sixteen, and calibrate against what the client reports about itself, rather than rounding every device up to the next whole zero.

Why the count is different every time

Those are expectations, not quotas. Each attempt is an independent draw with the same small chance of succeeding, so the number of tries follows a geometric distribution — memoryless, with a long tail. At an expected 512 attempts, about a third of runs finish inside 200, and roughly one in seven grinds past 1,000.

Half of all runs finish before about 355, which is well under the average: the typical solve is shorter than the mean, and the mean is dragged upward by the occasional run that goes long. Solve it a few times and watch the number lurch. Nothing is adapting between runs — that spread is simply what a memoryless process looks like from the inside.

Why the server issues the token

Because otherwise nothing stops a client preparing in advance. If the browser chose its own input it could spend an idle afternoon finding a million valid nonces and then spend them instantly, and the cost at the moment it mattered would be zero. The token is generated server-side, signed so it cannot be forged, and expires, so the work has to happen inside the window and cannot be banked ahead of time.

Hashcash — the 1997 anti-spam scheme all of this descends from, which asked senders to find a hash with a run of leading zeros before an email would be accepted — solved the same problem by baking a timestamp into the hashed string.

And why it is single-use

Work that can be reused is not a cost, it is a purchase. Once a solution is submitted, the token and nonce go into a bloom filter — a compact structure that answers "definitely not seen before" or "probably seen before", trading a small false-positive rate for memory that stays flat however much traffic passes through it. Present the same pair again and it is rejected. The token expires on its own besides.

The asymmetry, which is the whole point

Producing a proof takes hundreds or thousands of hashes. Checking one takes exactly one: concatenate the token and the nonce, hash it, compare. The server never searches, at any difficulty, which is why raising the cost for a visitor costs the server nothing.

A person pays a fraction of a second, once, and mostly does not notice. Something issuing ten thousand requests pays for ten thousand of them. That gap — expensive to produce, trivial to verify — is the mechanism. Everything else is bookkeeping.

What it does not do

It does not prove anyone is human. Nothing here is a Turing test: the browser is asked to compute, not to identify a bicycle, and a bot that pays the cost passes exactly like anybody else. The claim is narrower and worth stating plainly — this is a tax, not a wall. It prices out indiscriminate bulk scraping, where the economics depend on requests being nearly free. It does close to nothing against someone who has specifically decided they want your data and is willing to spend on it.

It is also uneven. The same target costs an old phone more real time than a desktop does, and a flat difficulty is a flat tax, which falls hardest on whoever can least afford it. That is the reason for calibrating per device instead of picking one number for everyone — not politeness, but the fact that a fixed target either waves through the fast machines or punishes the slow ones.

nonce (n.) — a number used once. The word means something else in British English. This page is, sincerely, about the number. (Yes. We know.)