What Proof of Work and Proof of Stake Mean

Proof of work (PoW) and proof of stake (PoS) are rules for deciding which participant may add the next block to a blockchain, and for making it expensive to cheat. PoW ties that right to computation, PoS to cryptocurrency that a validator has locked up and can lose. The two designs also treat the finality of a transaction differently, because the thing an attacker would have to sacrifice is different.

Key takeaways

Both mechanisms solve the same problem: letting anonymous participants agree on one ledger when anyone can create unlimited identities, so votes cannot be counted per identity.
In PoW, the chance of producing a block is proportional to hashing power; for a target written as k leading zero bits, the expected number of attempts is 2 raised to k.
In PoS on Ethereum, one validator per 12-second slot is pseudo-randomly chosen to propose, others attest, and blocks become final once two-thirds of staked ether supports two successive checkpoints.
An attacker under PoW needs a majority of hashing power; under Ethereum PoS, blocking finality takes about one-third of stake and reversing a finalized block means destroying at least one-third of it.
PoW finality is probabilistic and grows with each block added on top; Ethereum PoS finality is explicit, typically about 15 minutes, with two epochs (12.8 minutes) as the computed minimum.

The problem both designs solve

A blockchain is a shared ledger with no central operator, so the network needs a rule for which new block everyone accepts when several candidates exist. Counting one vote per participant does not work, because creating identities is free. The Bitcoin whitepaper describes this directly: proof of work is "essentially one-CPU-one-vote" and the honest chain grows fastest as long as honest nodes control a majority of computing power (Bitcoin whitepaper, as hosted by the Satoshi Nakamoto Institute; the original is a PDF at bitcoin.org).

The general term is Sybil resistance, protection against one party posing as many. Ethereum's documentation says proof of work and proof of stake provide it by requiring either significant energy expenditure or collateral. The same page notes that a consensus mechanism is broader than either: it also includes the fork-choice rule that picks the canonical chain, which is the longest (most-work) chain in Bitcoin and a stake-weighted vote rule in Ethereum.

How proof of work picks a winner

Miners assemble a candidate block and repeatedly hash its header, changing a counter called a nonce, until the result falls at or below a numeric target. Bitcoin's developer reference defines the target as a 256-bit number that a header hash must be equal to or below. There is no shortcut: any change to the block produces a completely different hash, so finding a valid one takes trial and error, while anyone can verify it with a single hash (ethereum.org on proof of work).

The target sets difficulty. A lower target means fewer valid hashes. The whitepaper expresses this as a required number of leading zero bits and states that the average work is exponential in that number. Bitcoin recalculates difficulty every 2,016 blocks against an ideal interval of 1,209,600 seconds (two weeks), per the developer guide, which works out to one block per 600 seconds.

Expected attempts for an example target

Illustrative example: suppose a toy chain requires the hash to start with 20 zero bits. Each attempt succeeds with probability 1 in 2^20, so a miner needs about 1,048,576 attempts on average. A machine doing 1 million hashes per second would find a block in about 1 second. Now raise the requirement to 40 zero bits: 2^40 is 1,099,511,627,776 attempts, so the same machine needs about 12.7 days on average. Adding 20 bits multiplied the work by 1,048,576, which is the exponential growth the whitepaper describes.

expected attempts = 2^k          (k = required leading zero bits)
success per attempt = 1 / 2^k
expected time = 2^k / hashes per second

Bitcoin's real target is not a whole number of zero bits, but the logic is identical: a smaller target multiplies the expected attempts. Because many miners race, the one that finds a valid hash first wins the right to publish the block, and the odds of winning are proportional to its share of total hashing power. The whitepaper also sets out the incentive: new coins and transaction fees reward the node that creates the block.

How proof of stake picks a producer

On Ethereum, a participant becomes a validator by depositing 32 ETH into the deposit contract and running validator software (ethereum.org PoS FAQ). Time is divided into 12-second slots, and 32 slots make an epoch, so an epoch lasts 384 seconds, or 6.4 minutes. In each slot one validator is pseudo-randomly chosen, using a mechanism called RANDAO, to propose a block (ethereum.org on proof of stake).

The choice is weighted by stake rather than by computation. The consensus specification says the proposer is sampled from the active validators "by effective balance" (Ethereum consensus specifications, phase 0), so a validator with more stake at work is more likely to be picked. The later Electra specification, activated on mainnet on May 7, 2025, keeps that weighting but changes the sizes: 32 ETH is now the minimum balance for a validator to become active, and a compounding validator can count up to 2,048 ETH of effective balance.

Attestations and committees

Each slot also has a randomly chosen committee of validators. An attestation is a validator's vote for a block, cast after re-executing the block's transactions and checking its signature. Committees split the validator set so that every active validator attests once per epoch rather than once per slot, which keeps message load manageable (ethereum.org).

Finality through the Casper FFG gadget

The first block of each epoch is a checkpoint. When votes representing at least two-thirds of total staked ether link one checkpoint to the next, the newer checkpoint becomes justified and the older one finalized. Casper FFG is the finality mechanism that does this upgrading; it works alongside the LMD-GHOST fork-choice rule, which follows the fork with the most attestation weight (ethereum.org on Gasper).

What an attack costs

The two systems defend the ledger with different currencies. PoW makes the attacker spend computation and electricity to outpace honest miners; ethereum.org says an attacker needs over 51% of the network's mining power to consistently produce malicious valid blocks. Bitcoin's developer guide adds that a majority of hashing power would enable a 51 percent attack on transaction history, and that less than 50% may still have a good chance of succeeding. Ethereum's attack-and-defense page sets out the PoS thresholds as shares of total stake:

Share of stake	What the attacker can do on Ethereum
33% or more	Block finality by withholding attestations, so no two-thirds majority forms and the chain stalls
About 34%	Attempt double finality, creating a permanent split, which requires control over message timing and would destroy the attacker's whole stake through correlation penalties
Above 50%	Dominate fork choice, enabling short reorgs and censorship, though the community could back an honest minority fork
66% or more	Finalize its preferred chain without honest validators, which enables rewriting past blocks

The key difference is what happens to the attacker's resources. Reverting finalized blocks requires destroying more than one-third of total staked ether, which ethereum.org calls the economic finality guarantee. When stake is slashed (forcibly removed for provably contradictory behavior such as proposing two blocks in one slot), the penalty depends on how many others are slashed in the same period: a lone slashing costs under 0.1% of stake, while a mass event can cost the whole stake (ethereum.org). In PoW, by contrast, the work already spent is gone, but the mining equipment itself is not destroyed by a failed attack. That last point is the editors' inference from the design, not a figure from the sources.

Illustrative thresholds

Illustrative example with a round number: if 30,000,000 ETH were staked, one-third is 10,000,000 ETH (enough to stall finality) and two-thirds is 20,000,000 ETH (enough to finalize unilaterally). The real total staked changes constantly, so the amounts here only show how the fractions scale.

Finality: probabilistic or economic

Finality is the point after which a transaction cannot realistically be undone. Under PoW it is probabilistic: ethereum.org explains that the more blocks built on top of a block, the more confident one can be that it will not be reverted. Nothing ever makes a Bitcoin block mathematically permanent; the chance of reversal just shrinks as work accumulates.

Under Ethereum PoS, ethereum.org says finalization is "an explicit, rather than probabilistic, property of a block." Finality spans two epochs: 2 x 32 slots x 12 seconds is 768 seconds, or 12.8 minutes, as a computed floor. ethereum.org's roadmap page puts the typical wait at about 15 minutes, because votes from validators holding two-thirds of staked ETH must be gathered and processed, and each validator votes only once per epoch. If finality stalls for more than four epochs, an inactivity leak gradually drains stake from validators not voting with the majority until two-thirds agreement is possible again, according to ethereum.org.

One consequence is that PoS needs a trusted starting point for new nodes. Ethereum's attack-and-defense page says a new node starts from a trusted recent state hash, known as a weak subjectivity checkpoint, which it describes as a trust gateway the node accepts before it can verify information itself. A PoW node, by design, can in principle check the work in every block header back to the genesis block instead.

Variants and a side-by-side view

Many networks adjust the PoS idea. In delegated designs, such as chains built with the Cosmos SDK, token holders can delegate tokens to validators, and the active set is the top validators by bonded-token power, up to a cap each chain sets in its MaxValidators parameter (Cosmos SDK staking module documentation). Proof of authority replaces money at risk with reputation: a fixed set of approved signers takes turns producing blocks, which is fast and cheap but more centralized, and mostly used on private chains and testnets (ethereum.org on proof of authority).

Feature	Proof of work (Bitcoin)	Proof of stake (Ethereum)
Scarce resource	Computation and electricity	Staked ether (32 ETH minimum per validator)
Producer selection	First miner to find a hash below the target	Pseudo-random per 12-second slot, sampled by balance
Majority threshold	Over 50% of hashing power	Over 50% of stake dominates fork choice; one-third blocks finality; two-thirds finalizes alone
Penalty for cheating	Wasted work	Slashing and inactivity leak
Finality	Probabilistic	Explicit, after two epochs

Three other topics are separate questions. Miner and validator earnings follow different revenue formulas. Ethereum's documented energy use fell by more than 99.988% after its 2022 switch, according to a ethereum.org energy page citing the Crypto Carbon Ratings Institute. And tax and regulatory treatment depend on jurisdiction, not on the consensus design.

Frequently asked questions

Does proof of stake mean the richest holders always win?

Selection is pseudo-random and weighted by balance, so larger stakes are chosen more often but never every time. The protocol also penalizes misbehavior regardless of size, and any single validator's influence on finality is limited by the two-thirds rule. Concentration among large validators is still a legitimate design concern.

Why can a PoW miner not simply rewrite an old block?

Changing a transaction changes the block's hash completely, so the miner would have to redo the work for that block and every block after it, while the honest network keeps extending the longest chain. According to the whitepaper, this works as long as honest nodes control the majority of computing power.

What is the difference between a slot and an epoch?

A slot is a 12-second window in which one validator may propose a block. An epoch is 32 slots, or 6.4 minutes, and its first block is the checkpoint that Casper FFG justifies and finalizes.

Does a slashed validator always lose everything?

No, but it always loses its place. A lone slashing costs under 0.1% of stake by ethereum.org's description: the immediate burn is 1/4096 of effective balance, or 0.0078125 ETH for a 32 ETH validator. The validator is then removed from the network over 36 days, and at day 18 a correlation penalty is applied that grows with the stake slashed in the surrounding window, up to the full balance in a mass event (ethereum.org on rewards and penalties).

Is proof of authority a form of proof of stake?

Ethereum's documentation calls it a reputation-based variant of proof of stake. Signers are chosen by trust, often through identity checks, rather than by locking funds, and the small signer set makes the network more centralized.

Questions to ask about any chain

What is the scarce resource an attacker would need (hashing power, stake, or an approved identity), and who currently holds it?
What share of that resource does it take to stall the chain, and what share to rewrite history?
Is finality probabilistic or explicit, and how long does a transaction need to wait before it counts as final for your purpose?
If an attack fails, what does the attacker lose: only spent resources, or the stake itself?
What trust assumptions does a new node accept before it can verify the chain?