On March 28, 1997, Adam Back — then a postdoctoral researcher at the University of Exeter — sent an email to the Cypherpunks mailing list with the subject line [ANNOUNCE] hash cash postage implementation. The full announcement is preserved as a primary source, alongside Back’s own copy at hashcash.org.
Hashcash itself is not a currency. It carries no ledger, no transfers, no consensus, no monetary supply. The system is a self-contained anti-spam / anti-DoS stamp scheme. But the 1997 announcement explicitly positioned Hashcash within the digital-cash conversation, in a dedicated section How does this fit in with digicash.
What the announcement said about money
The announcement opens with the technical proposal — a “partial hash collision based postage scheme” with arbitrarily expensive computation and instant verification, intended for remailer postage and spam control. After the implementation walkthrough and example applications, the announcement turns to its relationship with digital cash.
From the How does this fit in with digicash section (verbatim):
Adam Back (Cypherpunks mailing list post, March 28, 1997, 4:52:26 PM UTC)Digicash postage on remailers, and mail would be useful, however there are a number of problems with digicash:
- It is more onerous to set up an account (form filling etc)
- Not many people have accounts
- It’s only anonymous for the payer anonymous (and not anonymous for the seller)
So my suggestion is that we have remailers which accept either hash collision postage, or digicash postage. The advantages of this approach are:
- Hashcash may provide a stop gap measure until digicash becomes more widely used
- Hashcash is free, all you’ve got to do is burn some cycles on your PC. It is in keeping with net culture of free discourse, where the financially challenged can duke it out with millionaires, retired government officials, etc on equal terms.
- Hashcash may provide us with a fall back method for controling spam if digicash goes sour (gets outlawed or required to escrow user identities).
This places Hashcash, from the day of its public announcement, as a complement to digital-cash infrastructure — explicitly contrasted with David Chaum’s DigiCash / Ecash (then the most-developed digital-cash system) — rather than as a fully separate technical category.
The first replies
Back signed the announcement with two lines of Perl under the line “Have you exported RSA today?” The Perl was a working RSA, which Back handed out as his “export-a-crypto-system sig”; his page for it records that a US law professor obtained a written ruling from the US Commerce Department that the program must not be exported from the US.
Under ten hours after the announcement, Anil Das had Hashcash running on a big-endian MIPS R10K at 70,921 hashes a second, with an estimate of 30 seconds for a 22-bit collision, and asked what Dan Bernstein’s report of a 56-bit MD5 collision meant for the scheme. Back answered the next day that Bernstein’s sci.crypt post was what had started him thinking about partial hash collisions as anonymous anti-spam postage, and that he had known of Rivest and Shamir’s MicroMint, which Hal Finney had outlined on the list a few days earlier. He also set out what Hashcash did without: “There are no banks, brokers or any other legally targetable entities which will get shutdown, or coerced into adding identity escrow if used for postage in anonymous communication.”
The prior work Back had not read
Back was not the first to make computation the price of access, and his own 2002 paper says so in its opening section: “At the time of publication of [1] the author was not aware of the prior work by Dwork and Naor in [2] who proposed a CPU pricing function for the application of combatting junk email.” [1] is his own Hashcash page of May 1997. [2] is “Pricing via Processing or Combatting Junk Mail,” which Cynthia Dwork and Moni Naor presented at Crypto ‘92 from work done mostly at IBM’s Almaden Research Center. Their paper opens with one of them coming back from a short vacation to 241 messages, and its main idea is “to require a user to compute a moderately hard, but not intractable, function in order to gain access to the resource.”
The 1992 paper ends on what it had not solved: “Finally, the evaluation of the pricing function serves no useful purpose, except serving as a deterrent. It would be exciting to come up with a scheme in which evaluating the pricing function serves some additional purpose.” In 1999 Markus Jakobsson and Ari Juels set out to “formalize the notion of a proof of work,” noting that researchers had “adopted a wide ranging terminology” for it, and proposed “bread pudding” protocols in which the work could also be harvested for a useful computation; Back’s 2002 paper cites them for that dual purpose. Neither paper is among the references of the Bitcoin whitepaper. Back’s 2002 paper is.
The minting metaphor: 1997 implementation, 2002 paper
The announcement also uses minting language in the implementation walkthrough — the program command for generating a cost token is hashcash mint, and the announcement describes “double spending protection” in the implementation. The hashcash mint / mint framing in 1997 is later formalized at the function-name level in Back’s 2002 Hashcash paper. From §2 Cost-Functions of that paper:
We use the term mint for the cost-function because of the analogy between creating cost tokens and minting physical money.
The cost-function is named MINT() and the verification function VALUE(). The terminology choice was not incidental — it was framing Hashcash’s CPU-burn step as a form of token creation analogous to physical-money minting from the start.
§7 Applications: Hashcash as b-money’s mint
The 2002 paper §7 Applications lists, alongside DoS-throttling and anti-spam applications:
Adam Back (Hashcash paper, 2002)hashcash as a minting mechanism for Wei Dai’s b-money electronic cash proposal, an electronic cash scheme without a banking interface.
Reference [19] in the paper is Wei Dai’s b-money (1998). This passage makes explicit, in a refereed publication, the configuration Bitcoin would later realize: a Hashcash proof-of-work primitive serving as the minting mechanism for a decentralized digital-cash system. Back proposed it as an application; he did not implement it.
The intermediate primary source — Back’s December 6, 1998 cypherpunks-list critique of b-money — is documented in its own entry; that critique identifies seven monetary-design issues in b-money and explicitly proposes “to create value you burn CPU time, just like with hashcash” as the candidate minting approach.
Eleven-year arc: Hashcash and money, 1997–2008
The following table traces the arc:
| Date | Primary source | What Back said about Hashcash and money |
|---|---|---|
| 1997-03-28 | Hashcash announcement (Cypherpunks list) | Positioned Hashcash as a “stop gap measure until digicash becomes more widely used”; section How does this fit in with digicash; hashcash mint command and “double spending protection” in the implementation |
| 1998-12-06 | Cypherpunks-list b-money critique | Identified seven monetary-design issues in b-money; proposed “to create value you burn CPU time, just like with hashcash” |
| 2002-08-01 | Hashcash paper §2 + §7 | ”We use the term mint for the cost-function because of the analogy between creating cost tokens and minting physical money”; §7 enumerates “hashcash as a minting mechanism for Wei Dai’s b-money electronic cash proposal” |
| 2008-08-20 | Satoshi to Adam Back | Satoshi contacted Back about Hashcash citation format for the Bitcoin whitepaper |
| 2008-08-21 | Satoshi’s reply on b-money | Satoshi confirms, in his own words, that “my ideas start from exactly that point” — direct first-person confirmation of the Hashcash-as-b-money’s-mint synthesis that §7 Applications had only proposed |
In Back’s own retrospective framing, given in response to the New York Times investigation naming him as a Satoshi candidate:
Adam Back (tweet, April 08, 2026)I was early in laser focus on the positive societal implications of cryptography, online privacy and electronic cash, hence my ~1992 onwards active interest in applied research on ecash.
See Adam Back’s biography for Back’s pre-Bitcoin record, and the Adam Back identity hypothesis for the forensic reading of this announcement — §1.2 weighs the Hashcash-author signal against the v0.1 codebase, and §1.4 traces the eleven-year arc of Hashcash’s monetary-category positioning from this 1997 post to Bitcoin’s January 2009 release. Of the precursors tracked there (Hashcash, b-money, MicroMint, Bit Gold, DigiCash and RPOW), Hashcash is the only one the record shows Satoshi knew while he wrote the code; the comparison with the others is in what Satoshi knew before the code was done.
Bitcoin’s later component synthesis — the longest-chain consensus rule, UTXO model, mining-reward issuance, 21-million cap, and difficulty-adjustment algorithm — is examined in Bitcoin design lineage. For a plain-language walkthrough of how this same proof-of-work idea becomes Bitcoin’s mining race, see what miners are actually racing to do; for the mechanical specification of the resulting SHA-256d puzzle, see the consensus design page.
