A section-by-section, plain-English guide to the 9-page paper that started Bitcoin: transactions, timestamps, proof of work, incentives and privacy.
The problem it solves
Online payments normally need a trusted middleman to stop people spending the same money twice. The whitepaper asks: can we stop double spending without a middleman?
The main ideas
| Whitepaper idea | What it means today |
|---|---|
| Transactions as a chain of signatures | Each payment is signed by the owner of the coins being spent. See Digital signatures. |
| Timestamp server | Transactions are grouped into blocks and each block includes the hash of the one before. |
| Proof of work | Making a block takes real computing work, so rewriting history is expensive. See Proof of work. |
| Network | Nodes broadcast transactions and blocks, and follow the chain with the most work. |
| Incentive | The first transaction in each block pays the miner new coins and fees. See The block reward. |
| Reclaiming disk space | Old transactions can be summarised with a Merkle trees and the merkle root. |
| Simplified payment verification | Light clients can check payments using block headers only. See SPV and light clients. |
| Privacy | Keep keys anonymous and use a new key per payment. See Address reuse and privacy. |
The key insight
The honest chain wins as long as honest computers control most of the computing power. An attacker would need to redo the work of a block and every block after it, then overtake the honest network. The paper's maths shows the chance of catching up drops quickly with every block added.
Reading tips
- Start with sections 1, 2 and 4. They explain the problem, transactions and proof of work, the heart of the design.
- Skip the maths in section 11 at first. It calculates how quickly an attacker's chances fall; the conclusion is what matters: very fast.
- Section 7 is less relevant today. Pruning old data works differently in modern nodes. See Full nodes vs pruned nodes.
What the paper got right, and what changed
| In the paper | Today |
|---|---|
| A chain of digital signatures | Still true, now with Schnorr signatures too. See Schnorr signatures. |
| One CPU, one vote | Mining moved to specialised ASIC miners and Mining pools. |
| Simplified payment verification | Used by light wallets. See SPV and light clients. |
| No mention of fee markets | Fees became essential as blocks filled. See How Bitcoin transaction fees work. |
Key takeaways
- The whitepaper solves double spending without a trusted third party.
- Proof of work plus a chain of block hashes makes history hard to rewrite.
- Miners are paid with new coins and fees for securing the network.
Common questions
When was the whitepaper published?
On 31 October 2008, sent to a cryptography mailing list.
Is everything in the whitepaper still how Bitcoin works?
The core design is the same. Details have been extended over time, for example with SegWit and Taproot.
How long is the Bitcoin whitepaper?
Nine pages, including references and a short probability section.
Do I need maths to understand it?
No. Apart from one section on attack probability, it is written in clear prose.