We've met a handful of finite fields already: $\mathbb{Z}/p\mathbb{Z}$ for every prime $p$, and the four-element field $\mathbb{F}_2[x]/(x^2 + x + 1)$. This page answers the natural questions. What sizes can a finite field be? How do you build one? And what does its multiplication look like? The answers are surprisingly clean: the sizes are exactly the prime powers, you build them from irreducible polynomials, and the nonzero elements are always just the powers of a single element.
Start inside any field $F$ and look at $1, 1 + 1, 1 + 1 + 1, \dots$. In a finite field this list must repeat, so some sum $\underbrace{1 + \dots + 1}_{m}$ is $0$. The smallest such $m$ has to be a prime $p$: if $m = ab$ with $a, b < m$, then $(a \cdot 1)(b \cdot 1) = m \cdot 1 = 0$ would make $a \cdot 1$ and $b \cdot 1$ zero divisors in a field. So $\{0, 1, 2 \cdot 1, \dots, (p-1) \cdot 1\}$ is a copy of $\mathbb{Z}/p\mathbb{Z}$ sitting inside $F$.
The prime subfield of a field $F$ is the smallest subfield of $F$: the subfield generated by $1$. When $F$ is finite, it is $\{0, 1, 2 \cdot 1, \dots, (p-1) \cdot 1\} \cong \mathbb{F}_p$ for a prime $p$.
Now $F$ is a vector space over its prime subfield (you can add elements of $F$ and multiply them by elements of $\mathbb{F}_p$), and counting vectors gives the size.
If $F$ is a finite field then $|F| = p^n$ for some prime $p$ and $n \in \mathbb{N}$.
Proof. The prime subfield of $F$ is finite, so it is $\cong \mathbb{F}_p$ for some prime $p$. Therefore $F$ is a vector space of finite dimension (say $n$) over $\mathbb{F}_p$. Choosing a basis $v_1, \dots, v_n$, every element is uniquely $c_1 v_1 + \dots + c_n v_n$ with $c_i \in \mathbb{F}_p$, and the result follows ($|F| = p^n$). $\blacksquare$
The vector spaces on Vector Spaces use real scalars, but the axioms only need to add, multiply, and divide scalars, which you can do in any field. Swap $\mathbb{R}$ for $\mathbb{F}_p$ and bases and dimension still work. A space of dimension $n$ over $\mathbb{F}_p$ has $p^n$ vectors, one for each choice of $n$ coordinates.
So there's no field with $6$, $10$, or $12$ elements. Every prime power does show up, and only once.
For $p$ prime and $n \in \mathbb{N}$, there is exactly one finite field of order $p^n$ (denoted $\mathbb{F}_{p^n}$), up to isomorphism. (Proof in Existence and Uniqueness below.)
Which sizes from $2$ to $50$ have a field?
Exactly the prime powers. The primes give the fields $\mathbb{Z}/p\mathbb{Z}$ we already know. The others ($4, 8, 9, 16, 25, 27, 32, 49$) need a new construction, coming up next.
$\mathbb{F}_4$ is not $\mathbb{Z}/4\mathbb{Z}$. In $\mathbb{Z}/4\mathbb{Z}$, $2 \cdot 2 = 0$, so it isn't even an integral domain. For $n \ge 2$, $\mathbb{F}_{p^n}$ is never $\mathbb{Z}/p^n\mathbb{Z}$; it's a quotient of $\mathbb{F}_p[x]$.
The recipe: find an irreducible polynomial of degree $n$ over $\mathbb{F}_p$ and divide it out. Since $\mathbb{F}_p[x]$ is a PID, an irreducible $f$ generates a prime ideal, which is maximal, so the quotient is a field.
That's exactly what happened with $\mathbb{F}_2[x]/(x^2 + x + 1)$ on Prime & Maximal Ideals, which turned out to be $\mathbb{F}_4$.
Construct a field of order $27$.
Start with $\mathbb{F}_3$. Find an irreducible polynomial of degree $3$ in $\mathbb{F}_3[x]$.
Try $f(x) = x^3 - x + 1$. Roots: $x = 0 \mapsto 1$, $x = 1 \mapsto 1 - 1 + 1 = 1$, $x = 2 \mapsto 8 - 2 + 1 = 7 = 1$.
$f(x) = x^3 - x + 1$ is irreducible over $\mathbb{F}_3$ because it is a degree $3$ polynomial with no roots in $\mathbb{F}_3$.
Therefore, since $\mathbb{F}_3[x]$ is a PID, $(f(x))$ is a prime ideal, therefore maximal. So $F = \mathbb{F}_3[x]/(f)$ is a field.
Representatives for $F$: $\forall g(x) \in \mathbb{F}_3[x]$, $\exists q, r \in \mathbb{F}_3[x]$ s.t. $g(x) = f(x)q(x) + r(x)$, and $r(x) = 0$ or $\deg r < \deg f$. Then $g(x) \equiv r(x)$ in $F$. It follows that
$$F = \{a_2 x^2 + a_1 x + a_0 : a_0, a_1, a_2 \in \mathbb{F}_3\} \implies |F| = 3^3 = 27.$$
A note on the original notes: they first test $x^3 - x - 1$ (its values at $0, 1, 2$ are all $2$, so it's irreducible too) and then switch to $x^3 - x + 1$ without comment. Both build a field of order $27$, and by the uniqueness theorem it's the same field up to isomorphism. But the two choices behave differently in the next example, so it matters which one you use. This page uses $x^3 - x + 1$ throughout.
Which irreducible polynomials are there to choose from? Over a small field you can find them all by sieving: list every monic polynomial of degree $n$, then cross out the ones with a root. For degree $2$ or $3$, whatever survives is irreducible, and each survivor builds a field of order $p^n$.
Adding in $\mathbb{F}_{p^n}$ is easy: it's just adding vectors of coefficients. Multiplying is where the structure hides, and it turns out to be as simple as it could possibly be.
Suppose $F$ is a field. Any finite subgroup of $F^\times$ is cyclic.
Proof. Suppose $G$ is a finite subgroup of $F^\times$. By the Fundamental Theorem of Finitely Generated Abelian Groups, $G \cong \mathbb{Z}_{n_1} \times \dots \times \mathbb{Z}_{n_k}$ with $n_i \mid n_{i+1}$, $1 \le i < k$. Then every element of $G$ has order dividing $n_k$, so every element of $G$ is a root of the polynomial $f(x) = x^{n_k} - 1 \in F[x]$. Since $F$ is a field, $f$ has at most $n_k$ roots, so $|G| \le n_k$. But $|G| = n_1 \cdots n_k \ge n_k$, so $|G| = n_k \implies G \cong \mathbb{Z}_{n_k} \implies G$ is cyclic. $\blacksquare$
The invariant factors $n_1 \mid n_2 \mid \dots \mid n_k$ come from Finite Abelian Groups. The proof uses them to say "every element has order dividing the biggest one," and then the root count squeezes out every factor but the last.
In particular, $F^\times$ is cyclic for every finite field $F$. A generator is the field version of a primitive root mod $p$. So let's find one for our field of order $27$.
Find a generator for $F^\times$, where $F = \mathbb{F}_3[x]/(x^3 - x + 1)$.
Since $|F^\times| = 26$, every element of $F^\times$ has order $1$, $2$, $13$, or $26$ (Lagrange).
Try $x$. $x^2 \neq 1$ in $F$ (it's already a reduced representative). $x^{13} = -1$ in $F$ (long division of $x^{13}$ by $x^3 - x + 1$ in $\mathbb{F}_3[x]$ yields remainder $-1$). So $x$ doesn't have order $1$, $2$, or $13$ $\implies |x| = 26 \implies F^\times = \langle x \rangle$.
Instead of long division, you can compute $x^{13}$ one multiplication at a time, using $x^3 = x - 1$ to reduce. Press play and watch the powers of $x$ walk around $F^\times$. Then switch to $x^3 - x - 1$, the other irreducible cubic from the notes, and see what changes.
The Power Orbit on Modular Arithmetic walked through the powers of a number mod $p$ looking for a primitive root. This is the same walk in a field that isn't $\mathbb{Z}/p\mathbb{Z}$.
In $\mathbb{F}_3[x]/(x^3 - x - 1)$, $x^{13} = +1$, so $x$ has order $13$ and does not generate $F^\times$. The field is the same (up to isomorphism), but "$x$" names a different element in each construction. Whether $x$ is a generator depends on the polynomial you chose, so always check; never assume.
There's a field with $27$ elements and it's really just $3$ digits from $\{0, 1, 2\}$ with a weird multiplication rule. Somebody should make a padlock out of this. (Somebody did: finite fields are all over cryptography and error-correcting codes.)
Time to pay off the promise from the top of the page: a field of order $p^n$ exists for every prime power, and there's only one. Both halves come from the polynomial $x^{p^n} - x$. We need two tools: splitting fields and the derivative test for repeated roots (both on Splitting Fields & Algebraic Closures), and one very convenient identity.
If $\operatorname{char}(F) = p$, then $(a + b)^p = a^p + b^p$ and $(a - b)^p = a^p - b^p$ for all $a, b \in F$. Iterating, $(a \pm b)^{p^n} = a^{p^n} \pm b^{p^n}$.
Proof. By the binomial theorem, $(a + b)^p = \sum_{k=0}^p \binom{p}{k} a^k b^{p-k}$. For $0 < k < p$, $\binom{p}{k} = \frac{p!}{k!(p-k)!}$ has a factor $p$ on top that nothing on the bottom cancels, so $p \mid \binom{p}{k}$ and those terms are $0$ in $F$. For the minus sign, apply this to $a - b$ and $b$: $a^p = ((a - b) + b)^p = (a - b)^p + b^p$. $\blacksquare$
See the middle of row $p$ vanish. Every entry of Pascal's triangle is shown mod $p$, with zeros left blank.
For every prime $p$ and integer $n \ge 1$, there exists a unique field (up to isomorphism) of order $p^n$, denoted $\mathbb{F}_{p^n}$.
Proof.
The roots of $f$ form a subfield of $K$: they contain $0$ and $1$, and if $\alpha^{p^n} = \alpha$ and $\beta^{p^n} = \beta$, then by the Freshman's Dream
$$(\alpha - \beta)^{p^n} = \alpha^{p^n} - \beta^{p^n} = \alpha - \beta, \quad (\alpha\beta)^{p^n} = \alpha\beta, \quad \left(\frac{\alpha}{\beta}\right)^{p^n} = \frac{\alpha}{\beta} \ (\beta \neq 0).$$
The splitting field is generated by the roots, and the roots already form a field containing $\mathbb{F}_p$, so the set of roots is the entirety of $K$, which therefore has order $p^n$.
Existence needed the derivative test and nothing else: no irreducible polynomial of degree $n$ had to be found first. That's the opposite of how this page built $\mathbb{F}_{27}$, where we hunted for an irreducible cubic. The next theorem says the hunt always succeeds.
The cyclic multiplicative group from the previous section gives two more facts almost for free.
Any finite extension of a finite field is simple. Furthermore, for every $n \ge 1$, there exists an irreducible polynomial of degree $n$ over any finite field $\mathbb{F}_q$.
Proof. Let $K/F$ be an extension of finite fields. $K^\times$ is cyclic, say $K^\times = \langle \gamma \rangle$. Then every nonzero element of $K$ is a power of $\gamma$, so $K = F(\gamma)$: simple.
For the second part, let $q = p^m$ and take $K = \mathbb{F}_{q^n} = \mathbb{F}_{p^{mn}}$. $K^\times$ is cyclic of order $q^n - 1$, which is divisible by $q - 1$, so it has a subgroup of order $q - 1$; those elements together with $0$ are $q$ roots of $x^q - x$, and they form a subfield (as in the existence proof). So it's a field of order $q$, i.e. a copy of $\mathbb{F}_q$ inside $K$, and counting elements gives $[K:\mathbb{F}_q] = n$. By the first part, $K = \mathbb{F}_q(\gamma)$, so the minimal polynomial of $\gamma$ over $\mathbb{F}_q$ is irreducible of degree $[\mathbb{F}_q(\gamma):\mathbb{F}_q] = n$. $\blacksquare$
The map $\alpha \mapsto \alpha^p$ is a ring homomorphism of $\mathbb{F}_{p^n}$ by the Freshman's Dream, and it's injective, so it's an automorphism: the Frobenius. On Galois Theory it turns out to generate every automorphism of $\mathbb{F}_{p^n}$.
Build a couple more.
Construct a field with $8$ elements, and show that every element other than $0$ and $1$ generates its multiplicative group.
$x^3 + x + 1$ has no roots in $\mathbb{F}_2$ ($f(0) = 1$, $f(1) = 3 = 1$), so it's an irreducible cubic, and $\mathbb{F}_2[x]/(x^3 + x + 1) = \{a_2 x^2 + a_1 x + a_0\}$ is a field with $2^3 = 8$ elements.
Its multiplicative group has order $7$, which is prime. By Lagrange, every element has order $1$ or $7$, and only $1$ has order $1$. So every other nonzero element has order $7$ and generates.
Let $F = \mathbb{F}_3[x]/(x^2 + 1)$. Show that $F$ is a field with $9$ elements, that $x$ is not a generator of $F^\times$, and that $1 + x$ is.
$x^2 + 1$ has no roots in $\mathbb{F}_3$ ($1, 2, 5 = 2$), so it's irreducible and $F$ is a field with $3^2 = 9$ elements. $|F^\times| = 8$.
In $F$, $x^2 = -1$, so $x^4 = 1$: $x$ has order $4$, not $8$.
$(1 + x)^2 = 1 + 2x + x^2 = 1 + 2x - 1 = 2x$, and $(1 + x)^4 = (2x)^2 = 4x^2 = -4 = 2 \neq 1$. The order of $1 + x$ divides $8$ but not $4$, so it's $8$: $1 + x$ generates $F^\times$.
Is there a field with $100$ elements? With $121$?
$100 = 2^2 \cdot 5^2$ is not a prime power, so no. $121 = 11^2$ is, so yes: $\mathbb{F}_{121} = \mathbb{F}_{11}[x]/(f)$ for any irreducible quadratic $f$ over $\mathbb{F}_{11}$, such as $x^2 + 1$ ($-1$ is not a square mod $11$).
Every finite field is the set of roots of one very simple polynomial.
Let $F$ be a finite field with $q$ elements. Prove that $a^q = a$ for every $a \in F$, and that in $F[x]$, $\displaystyle x^q - x = \prod_{a \in F}(x - a)$.
Proof. $F^\times$ is a group of order $q - 1$, so by Lagrange, $a^{q-1} = 1$ for every $a \neq 0$. Multiplying by $a$ gives $a^q = a$, and this also holds for $a = 0$. So every one of the $q$ elements of $F$ is a root of $g(x) = x^q - x$.
By Bezout's theorem, applied one root at a time (each $x - a$ divides what's left, because the remaining roots are still roots of the quotient, as in the Wilson's theorem proof on Polynomial Rings), $h(x) = \prod_{a \in F}(x - a)$ divides $g(x)$. Both are monic of degree $q$, so $g = h$. $\blacksquare$