How does Proof-of-Work make a block "hard to produce"?

You search for a nonce that makes the block's hash begin with a required number of zero bits — expensive to find, but trivial to verify with a single hash.

Proof-of-work (based on Adam Back's Hashcash) exploits that a hash like SHA-256 is unpredictable: the only way to get leading zero bits is to brute-force it — increment a nonce (a throwaway number in the block you're free to change) and re-hash until the target is met. The work is exponential in the number of zero bits, yet anyone can check it with one hash.

Does Bitcoin literally use zeros — and how many? Yes. Strictly, the rule is that the block's SHA-256 hash, read as a 256-bit number, must land below a target, which amounts to demanding a number of leading zero bits. That count isn't fixed — it is the difficulty, retargeted every 2016 blocks. The 2009 genesis-era blocks ("difficulty 1") needed about 32 leading zero bits; today difficulty is roughly a hundred trillion times higher, so a valid hash carries around 80 leading zero bits — about 20 leading-zero hex digits at the front — and the bar keeps rising as mining power grows.

The point is one-directionality: once the CPU effort is spent, the block can't be changed without redoing that work — and because blocks are chained, redoing all the blocks after it too.

Tip: difficulty = "how many leading zeros"; more zeros = exponentially more tries.

Go deeper:

• Proof of work — Wikipedia — the general "hard to make, easy to check" primitive and its use in Bitcoin.
• Hashcash — Wikipedia — Adam Back's 1997 anti-spam scheme that Bitcoin's proof-of-work is directly based on.
• SHA-2 — Wikipedia — the SHA-256 hash whose unpredictable output makes leading-zero targets brute-force-only.