The Whitepaper at 18
31 October 2008 → 31 October 2026

Nine pages. Eighteen years.

On Halloween 2008 an unknown author posted a link to a short PDF on a cryptography mailing list. Here is a closer look at what the file is, which words it uses, who it leans on, what it promised, and how those promises have held up.

Everything here is computed from the document itself or from the sources linked in the text. Figures for today’s network are as of October 2026 unless a date is given.

9pages
3,315words of text
8references
8diagrams
1code listing
15minute read
SHA-256 b1674191a88ec5cdd733e4240a81803105dc412d6c6708d53ab94fc248f4f553
Open the PDF · 184,292 bytes

Before reading a word, it is worth looking at the file itself. A PDF carries a small record of how it was made, and this one says almost nothing. No author. No company. No title. Somebody opened a free word processor on a Tuesday in March 2009 and hit export. This is the rare occasion when such low-level details are of interest to anyone besides a GPT model.

File name
bitcoin.pdf
PDF version
1.4
Creator
Writer
Producer
OpenOffice.org 2.4
Creation date
2009-03-24 11:33:15 −06:00
Language
en-GB
Pages
9, each 612 × 792 pt (US Letter)
Fonts embedded
Century Schoolbook Bold, Times New Roman (regular, bold, italic), Arial, Courier New, OpenSymbol
Document ID
CA1B0A44BD542453BEF918FFCD46DC04
Document checksum
6F72EA7514DFAD23FABCC7A550021AF7
Not set
Title, Author, Subject, Keywords, Modified date

Second edition

Strictly speaking, this file is the second edition of the paper released on 31 October 2008. It is a lightly revised version that Satoshi uploaded on 24 March 2009. The earlier draft, sent privately to a few cryptographers in October 2008, doesn't differ much from what we have now. Its abstract said payments could flow “without the burdens of going through a financial institution”; the final version drops “the burdens of”. “Doublespending” gained a hyphen. A paragraph on transaction fees was added. Nothing else changed. Though we can't analyse the draft's metadata, it most probably leaked nothing.

The paper lives inside the thing it describes

In April 2013 someone paid a small fee to write the entire PDF into the Bitcoin blockchain, chopped into hundreds of pieces disguised as payment outputs (block 230,009). Every full node on the network now stores a copy of the paper that explains the network. Any copy can be checked against the fingerprint above.

Drop any bitcoin.pdf here to see if it is byte-for-byte the real one. The check runs in your browser; nothing is uploaded.
Choose a file

The document that launched a trillion-dollar asset is about a fifteen-minute read. Among the famous papers of science, that is on the short side: a few times longer than Watson and Crick’s one-page DNA paper, but a fraction of the length of Diffie and Hellman’s paper on key exchange or Shannon’s founding paper on information theory. Its 141 sentences average 24 words each, a length typical of a technical paper. Most of it is plain English about who trusts whom.

Word counts, for scale

Whole documents, including references, counted from public copies of each paper and rounded. The Bitcoin figure is main text only.

The longest section by far is “Calculations”, the attack math in Part 7 of this page. Roughly one word in five is spent proving that cheating does not pay. The famous ideas, the chain of blocks and the proof-of-work, each get a page or less.

Words per section

The abstract and the twelve numbered sections.

Reading-ease score: 41 out of 100 on the Flesch scale, in the “difficult” band shared by academic papers and legal text. The sentences are long, but the vocabulary is mostly ordinary.

Count the words and a different paper appears from the one in the headlines. It is a paper about blocks, transactions and hashes, written for an audience of cryptographers. The word Bitcoin appears exactly once, in the title. The body never names the system at all; it is “the network” or “the system”.

Most-used meaningful words

Singular and plural counted together. Common function words excluded.

Words that are not in the paper

Much of today’s vocabulary came later, from the code, the forums and the press.

blockchain cryptocurrency mining wallet ledger decentralized 21 million halving address Byzantine consensus mechanism

Two near misses. The phrase “chain of blocks” appears once, in the section on attackers; the single word “blockchain” would not become common for several years. And the only “miners” in the paper are gold miners, in a comparison: new coins are “analogous to gold miners expending resources to add gold to circulation.”

Trust, attackers and honest nodes

Trust or trusted (the absence of which is critical to the network) appears 13 times, almost always as something to remove. Honest appears 15 times and attacker 19, so the paper spends more words on the villain than on the hero. Money words are rare: money three times, cash twice, bank once, gold twice, price never.

trust / trusted13 honest15 attacker19 privacy5 money3 cash2 gold2 bank1 electricity1 Bitcoin1

Satoshi cited eight works. Only one of them, b-money, is about digital money at all. The next closest, Hashcash, is a way of making a computer prove it did some work. Three of the eight come from the same two people and are about one problem: how to prove that a document existed at a certain time.

  • William Feller, An Introduction to Probability Theory

    The classic textbook. Satoshi borrows the “gambler’s ruin” problem from it to work out how far behind an attacker falls. See Part 7.

  • Ralph Merkle, “Protocols for public key cryptosystems”

    Source of the Merkle tree, the trick that lets a block summarise thousands of transactions in one 32-byte hash, so old transactions can be thrown away.

  • Stuart Haber and W. Scott Stornetta

    Three of the eight references. In 1991 they described how to timestamp a document by chaining hashes, each one including the one before. Their company, Surety, began printing its weekly hash in the classified ads of The New York Times in 1995. When Satoshi writes that a hash can be published “in a newspaper or Usenet post”, this is the newspaper he means.

  • Wei Dai, “b-money”

    A short proposal for anonymous digital cash where every participant keeps a copy of the accounts. The first reference in the paper. Satoshi emailed Wei Dai a draft in August 2008, when the paper was still titled “Electronic Cash Without a Trusted Third Party”.

  • Massias, Avila and Quisquater

    A Belgian design for a timestamping service “with minimal trust requirements”. The least-known name on the list.

  • Adam Back, “Hashcash”

    Proof-of-work as a stamp against email spam: make the sender’s computer burn a little effort before each message. Satoshi adopts the mechanism and repurposes it as a vote.

Just as telling is who is absent. There is no citation of David Chaum, whose company DigiCash sold anonymous digital money in the 1990s, none of Nick Szabo’s “bit gold”, and none of the Byzantine-generals literature that computer scientists would later use to describe the problem the paper solves. The paper cites engineers of timestamps and spam-stamps, not economists or money theorists.

Bitcoin’s paper is mostly a design, but a design makes a promise that it will work in the future. Eighteen years is long enough to assess that promise. As the scorecard below shows, the mechanics have held almost exactly, while the social predictions about how people would use the system have drifted, as the system evolved naturally around them.

Kept

Payments without a trusted third party

The paper’s central promise. Its opening paragraph says the benefits of digital payments “are lost if a trusted third party is still required to prevent double-spending”. Bitcoin removed that requirement: no bank or company approves a payment, and anyone can run a node and verify every transaction since 2009.

Kept

Non-reversible transactions

The introduction treats reversible payments as a weakness of the banking system. A Bitcoin payment stays paid no matter what (with an exception of a 51% attack, but that's another story). The rule has held under real pressure. Over the years thieves have stolen many thousands of bitcoin, and victims wanted them back. The chain was never rewritten to return them. Ethereum chose differently: in 2016 it changed its own rules to recover about 3.6 million ether drained from a project called The DAO, and the network split in two.

Faded

“Small casual transactions”

The introduction complains that the cost of settling disputes cuts off “small casual transactions”. The paper never promises to fix this, but it is one of the problems it hopes to leave behind. On today’s chain a transaction can cost more than a coffee during busy periods, so small payments moved to layers built on top, like Liquid and Lightning.

Evolved

“One-CPU-one-vote”

Satoshi imagined ordinary computers voting with their processors. Within four years purpose-built chips made CPUs irrelevant, and the vote concentrated in a handful of mining pools and industrial farms. The chain with the most computing power behind it still wins, as the paper says it should, but a home computer now has no real say in the result.

Kept

Difficulty adjusts to keep blocks on schedule

The paper describes a “moving average targeting an average number of blocks per hour”. The network does a simpler version: every 2,016 blocks, roughly two weeks, it adjusts the difficulty based on how long those blocks took. Blocks still arrive about every ten minutes, even though computing power has grown a hundred-trillion-fold.

Kept

Storage will not be a problem

Section 7 says old spent transactions can be discarded, and estimates the block headers that remain at 4.2 MB per year. At roughly 975,000 blocks, headers today total about 78 MB, against the paper’s 75 MB. The full history with every transaction is over 700 GB, which the paper says most users need not keep. Bitcoin Core added this trimming, called pruning, in 2015, and a pruned node runs comfortably on a few gigabytes.

Evolved

Privacy through anonymous keys

The paper suggests a fresh key for every payment, and most wallets now do this automatically. But it also admits that “some linking is still unavoidable”, and an industry of chain-analysis firms now sells that kind of tracing to exchanges and governments.

Evolved

Checking payments without the full history

Section 8 describes a shortcut: keep only the block headers and you can still confirm a payment without storing every transaction. Some wallets work this way, while others simply ask a server. The paper’s extra safeguard, alerts from nodes when they spot an invalid block, was never built.

Kept

Nodes can leave and rejoin at will

Still how it works. A node switched off for a year downloads the missing blocks and catches up, with no permission from anyone.

Waiting

Fees overtake new coins

The paper says the reward “can transition entirely to transaction fees”. New coins run out around 2140, but the reward halves about every four years, so fees need to take over long before then. Fees were 0.69% of miner income in August 2026. If each block keeps paying the same amount in fees, they overtake the shrinking reward in the mid-2050s. If fees grow tenfold, that happens around 2040. They have passed the reward only in short bursts, the biggest after the April 2024 halving, when they reached 74 percent of what miners earned.

Kept

“Completely inflation free” in the end

The paper never states the number, but the code fixed it at 21 million. About 20.1 million, or 95.7%, already exist. Four halvings have cut the reward from 50 to 3.125 coins per block.

Kept

Cheating is less profitable than playing fair

Section 6 argues a greedy attacker “ought to find it more profitable to play by the rules”. In eighteen years nobody has rewritten Bitcoin’s history, though smaller networks copying the design have been attacked this way repeatedly.

Ask people what Bitcoin is and you will hear about a blockchain, a 21 million coin limit, miners, wallets and the halving. The paper mentions none of them. The word “miners” turns up once, and it is about gold. The rest came from the software released two months later and from the people who ran it.

The 21 million cap

The paper says only that “a predetermined number of coins” will enter circulation. The number, the 50-coin starting reward and the halving schedule all live in the code.

Miners

Nodes “generate” coins; nobody mines. The gold-mining comparison in Section 6 is the seed the word grew from.

Wallets and addresses

Coins go to “public keys”. The user-friendly address format and the idea of a wallet arrived with the first release.

A block size limit

No limit is mentioned. The 1 MB cap was added quietly in 2010 and became the most bitter argument in Bitcoin’s history.

The genesis block

Nothing about a first block or the newspaper headline Satoshi would later embed in it: “Chancellor on brink of second bailout for banks”.

Scripting

The small programming language inside every Bitcoin transaction, which later made multi-signature and Lightning possible, is absent.

Price

The paper contains no currency symbol and no suggestion that the coins would be worth anything in dollars.

The author

“Satoshi Nakamoto” appears only in the byline. There is no affiliation, no acknowledgement, no funding statement, and no “I”.

And some things people assume are missing, but are there

The ten-minute block time is present, though only as a supposition: “If we suppose blocks are generated every 10 minutes”. Transaction fees are explained. Change outputs, pruning, light clients and the idea of using a new key for every payment are all in the text. The 2008 reader who finished the paper knew how the machine worked; what they could not know was what it would become.

The only serious mathematics in the paper answers one question. If someone pays you and then secretly tries to rewrite history to take the money back, how long should you wait before you trust the payment? Satoshi treats it as a gambler’s ruin, a probability problem centuries old, and cites a 1957 textbook for it.

Think of each new block as one flip of a weighted coin. Most flips go to the honest network, and the rest go to the attacker. The attacker starts behind, because the real payment is already in a block, and has to make up that gap. With the odds against them, the paper notes, “if he doesn’t make a lucky lunge forward early on, his chances become vanishingly small as he falls further behind.”

0.0243%About one chance in 4,100 that the payment could still be reversed.

Computed with the C function printed on page 7 of the paper, translated line for line into JavaScript.

Probability the attacker ever catches up

Logarithmic scale. The two cases Satoshi tabulated, plus the one you set above.

Attacker has 10%Attacker has 30%Your setting

This is where the folk rule of “wait for six confirmations” comes from. In the paper’s own table, an attacker with ten percent of the network has a 0.024 percent chance of success after six blocks. Exchanges adopted six as a round number, and it stuck. Against a stronger attacker the wait grows fast: at 30 percent you need 24 blocks, about four hours, for the same comfort, and at 45 percent you need 340.

The paper’s nine lines of C are the only code it contains, and they work unchanged today. Everything on this page’s calculator comes from them. The tables on page 8 of the paper reproduce exactly.

Nobody knows who wrote the paper, and this page will not guess. But a document always says something about its maker, and the small tells here are more interesting than any theory.

Mixed spelling

“Favour” is British; “characterized” is American or Oxford. The document’s language setting is British English. The mix is standard in Canada, in Oxford house style, and among people who learned English in more than one place.

Two clocks

The October 2008 draft was exported on a computer set to UTC−7. The March 2009 final was exported at UTC−6. Both dates fall inside North American daylight time, so this is Pacific time then Mountain time, or one clock whose settings changed.

Always “he”

The attacker, the payee and the user are “he” 23 times and “she” never. The author is “we” 20 times, in the academic manner, and “I” never.

One “obviously”

“The timestamp proves that the data must have existed at the time, obviously, in order to get into the hash.” The paper’s single flash of impatience.

Free tools, free email

Written in OpenOffice, a free alternative to Microsoft Word, with a GMX address, a free German webmail service. The earlier draft used a different anonymous provider. Nothing in the toolchain cost money or required a real name.

Hand-drawn diagrams

The eight figures were drawn in OpenOffice’s own drawing tool on a grid. Researchers who rebuilt the PDF byte-for-byte in 2023 found the arrowheads come out slightly thick, a quirk of that software’s PDF writer.

That 2023 reconstruction has a sobering conclusion for anyone hoping the file can settle the authorship question. Because the paper can be recreated exactly with a Windows XP machine and OpenOffice 2.4, possessing an identical file proves nothing. The paper can be verified; its author cannot.

In the middle of a global banking crisis, someone nobody had heard of sent an email to a cryptography mailing list. The first reply doubted the idea could scale. A week after the email, Hal Finney called it promising, and two months later he received the first bitcoin ever sent.

  • bitcoin.org registered

    Through an anonymous registration service.

  • A draft goes to Wei Dai

    Titled “Electronic Cash Without a Trusted Third Party”. Satoshi asks for the right year to cite b-money.

  • The PDF is created

    Four weeks before anyone outside a small circle sees it.

  • “Bitcoin P2P e-cash paper”

    “I’ve been working on a new electronic cash system that’s fully peer-to-peer, with no trusted third party.” A link to bitcoin.pdf and five bullet points. That is the whole announcement.

  • The first reply

    James A. Donald: “We very, very much need such a system, but the way I understand your proposal, it does not seem to scale to the required size.” The scaling argument has never stopped.

  • Hal Finney

    “Bitcoin seems to be a very promising idea.” He also notes that much of the practical detail “is largely missing from the paper”.

  • The genesis block

    Sixty-four days after the announcement, the first block is created with a headline from that day’s Times of London embedded in it: “Chancellor on brink of second bailout for banks”.

  • First transaction

    Ten bitcoin from Satoshi to Hal Finney.

  • The paper is revised

    The version you can download above. Wording only.

  • A price

    New Liberty Standard publishes the first exchange rate, based on the electricity cost of generating coins: 1,309 bitcoin to the dollar.

  • Satoshi leaves

    In a last known email: “I’ve moved on to other things.”

  • The paper is written into the chain

    Block 230,009. The document now travels with every copy of the network it describes.

Eighteen years on, the nine pages read as both complete and incomplete. Everything about how the machine works is there and still true. Nothing about what the machine would mean is there at all, because that part was never the author’s to write.