Some hash functions do this, e.g. bcrypt and scrypt. Theoretically, their output is no more secure than faster algorithms like SHA; but it's less practical to brute-force lots of guesses.

Hashcash (as found in Bitcoin) is another example, albeit more egregious.