What is RandomX? The CPU proof of work, explained

RandomX is a proof-of-work algorithm built for general-purpose CPUs. Each hash runs a set of randomly generated programs in a virtual machine whose instruction set — integer maths, floating-point maths and branches — is translated into the processor's own machine code on the fly. The outputs are folded into a 256-bit result with the Blake2b hash. It was designed as the proof of work for Monero, and Monero switched to it on 30 November 2019.

The point of the design is in its first sentence: the work is the kind of work a CPU already does well. A chip built only for RandomX would need most of what a CPU has — a floating-point unit, an instruction decoder, branch handling, large caches — so its advantage over the processor in an ordinary computer stays small.

How one hash is made

The key and the cache. Every hash depends on a key, and on Monero the key is the hash of a block in the chain. From the key, RandomX builds a 256 MiB cache with Argon2d: 262,144 blocks of 1 KiB, three passes, one lane. On Monero the key changes every 2048 blocks, about 2.8 days, with a delay of 64 blocks, about two hours, so a miner has time to prepare the next one.

The dataset. From the cache, RandomX expands a read-only dataset of 2080 MiB — a 2 GiB base of 2,147,483,648 bytes plus 33,554,368 bytes of extra — one 64-byte item at a time. All mining threads share it.

The scratchpad. Each thread has its own 2 MiB scratchpad, filled from the input with an AES-based generator. It is split in three levels that mirror a CPU's caches: the first 16 KiB, the first 256 KiB and the whole 2 MiB.

The programs. The virtual machine runs 8 programs per hash, each of 256 instructions in RandomX v1, and each program loops 2048 times. Every loop reads the scratchpad and one 64-byte item of the dataset, at an address that is only known when the previous loop has finished — which is what makes the dataset impossible to skip.

The result. The scratchpad is hashed with AES, and Blake2b turns what is left into the 256-bit hash that is compared with the network's target.

Fast mode and light mode

RandomX can run in two modes that give the same results. Fast mode builds the whole 2080 MiB dataset once for each key and reads it for every hash; it is the mode for mining. Light mode keeps only the 256 MiB cache and works out each dataset item when it is needed, which is much slower; it is meant for checking a proof, not for producing one. The memory guide has what that means for a machine.

What a CPU needs for it

The RandomX README lists what efficient mining asks of a processor: a 64-bit architecture, an IEEE 754 floating-point unit, hardware AES (AES-NI on x86, the cryptography extensions on ARMv8), 16 KiB of L1, 256 KiB of L2 and 2 MiB of L3 cache per mining thread, support for large memory pages, and at least 2.5 GiB of free RAM per NUMA node. By its own count, most Intel and AMD processors made since 2011 qualify.

Memory speed matters as well as size. The README puts DDR3 at about 1500 to 2000 hashes a second per memory channel and DDR4 at about 4000 to 6000, depending on frequency and timings, so a fast processor on one channel waits on its memory.

The audits

Between May and August 2019, before Monero switched, RandomX was audited by four independent teams: Trail of Bits, X41 D-SEC, Kudelski Security and Quarkslab, coordinated by OSTIF. None found a critical vulnerability; several changes to the algorithm and the code were made because of them. Arweave, an early adopter of RandomX, paid for the first audit, and donations from the Monero community paid for the other three.

What came next

In March 2026 a second version of the algorithm was released, with longer programs and AES inside the main loop; Monero has not switched to it yet. The RandomX v2 guide has the changes and where the switch stands, and the variants guide has the versions other coins run.