Anatomy of a Bitcoin Share: From Stratum Job to Valid Hash

1 The Stratum job (mining.notify)

After mining.subscribe (which hands the miner an extranonce1 and an extranonce2 size) and mining.authorize, the pool pushes work as a mining.notify with these fields:

The job deliberately does not contain a finished coinbase or a merkle root. The pool leaves a hole (the extranonce) for the miner to fill, which is what gives each miner its own unique search space without the pool sending gigabytes of distinct work.

2 Build the coinbase, take its TXID

The miner assembles the coinbase transaction by concatenation:

coinbase = coinb1 || extranonce1 || extranonce2 || coinb2

extranonce1 is fixed per connection (from mining.subscribe); extranonce2 is the miner's to choose and roll. Its transaction id is a plain double-SHA256 of that byte string:

txid(coinbase) = SHA256( SHA256( coinbase ) )

Bitcoin hashes are stored and folded internally in little-endian byte order, then reversed only for human display. The coinbase TXID that enters the merkle tree is the internal (un-reversed) form.

3 Fold the merkle branch into the merkle root

The coinbase is always the leftmost leaf of the block's merkle tree, so its running hash is always the left input at every level. The miner walks the merkle_branch it was given, hashing pairwise:

root = txid(coinbase)
for each sibling in merkle_branch:
    root = SHA256( SHA256( root || sibling ) )

A concrete, checkable example with three transactions A (the coinbase), B, C. Bitcoin duplicates the last node when a level has an odd count (a leaf here, but at higher levels it can be an internal hash), so C is paired with itself:

For the coinbase A, the merkle_branch the pool would send is [B, hash(C|C)] — exactly the two siblings on A's path to the root. In the real genesis block there is only one transaction, so the merkle root simply is the coinbase TXID: 4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b.

4 Assemble the 80-byte header — real genesis bytes

The header is six fields, 80 bytes total, each multi-byte field written little-endian. Here it is for the genesis block:

Concatenated, the full 80-byte header is:

0100000000000000000000000000000000000000000000000000000000000000
000000003ba3edfd7a7b12b27ac72c3e67768f617fc81bc3888a51323a9fb8aa4b1e5e4a
29ab5f49ffff001d1dac2b7c

Notice the merkle root and prevhash are byte-reversed from how block explorers show them — that reversal is the single most common source of "my hash is wrong" bugs when people first implement this. Stratum adds one more quirk: it delivers prevhash in mining.notify with each 32-bit word reversed, which you must undo before assembling the header — invisible in this example only because genesis's prevhash is all zeros.

5 Hash it twice, compare to the target

Double-SHA256 the 80 bytes, then reverse the result for display:

SHA256( SHA256( header ) ) , reversed
= 000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f

✓ That is exactly the published genesis block hash.

The block was valid because that number is ≤ the network target encoded by nbits (step 6). A pool judges a share the same way, against its own easier share target. Every nonce that fails just gets incremented and re-hashed — billions of times a second.

When the 32-bit nonce is exhausted without a hit, the miner changes the extranonce2 (which changes the coinbase, the merkle root and therefore the whole header) or rolls ntime within the allowed window, giving a fresh 4-billion-nonce search space.

6 nBits → target → difficulty

The compact nbits field packs the target into four bytes. The first byte is an exponent, the last three are a mantissa:

target = mantissa × 256^(exponent − 3)
     where exponent = nbits >> 24,  mantissa = nbits & 0x007fffff

For genesis, 0x1d00ffff gives exponent 0x1d = 29 and mantissa 0x00ffff, so:

target = 0x00000000FFFF0000000000000000000000000000000000000000000000000000

Difficulty is just how much harder the current target is than that easiest-ever "difficulty-1" target:

difficulty = difficulty_1_target / current_target

Genesis mined at exactly difficulty 1. Try any nbits value below (all arithmetic runs in your browser, nothing is sent anywhere):

Expected hashes per share ≈ share-difficulty × 2³². A pool handing out difficulty-1000 work expects about 1000 × 4.29 billion ≈ 4.3 trillion hashes for each share, and pays you in proportion to the shares you return.