We propose a probabilistic variant of Brill-Noether's algorithm for computing a basis of the Riemann-Roch space L(D) associated to a divisor D on a projective nodal plane curve C over a sufficiently large perfect field k. Our main result shows that this algorithm requires at most O(max(deg(C) 2ω , deg(D+) ω )) arithmetic operations in k, where ω is a feasible exponent for matrix multiplication and D+ is the smallest effective divisor such that D+ ≥ D. This improves the best known upper bounds on the complexity of computing Riemann-Roch spaces. Our algorithm may fail, but we show that provided that a few mild assumptions are satisfied, the failure probability is bounded by O(max(deg(C) 4 , deg(D+) 2 )/|E|), where E is a finite subset of k in which we pick elements uniformly at random. We provide a freely available C++/NTL implementation of the proposed algorithm and we present experimental data. In particular, our implementation enjoys a speedup larger than 6 on many examples (and larger than 200 on some instances over large finite fields) compared to the reference implementation in the Magma computer algebra system. As a by-product, our algorithm also yields a method for computing the group law on the Jacobian of a smooth plane curve of genus g within O(g ω ) operations in k, which equals the best known complexity for this problem.see [23, § 42][9, Sec. 8.1]. In its original version [11, §4], Goppa's algorithm works only for finite fields, and some parts of the algorithm use exhaustive search. During the 90s, several versions of Goppa's algorithm have been proposed, incorporating tools of modern computer algebra. In particular, Huang and Ierardi provide in [15] a deterministic algorithm for computing Riemann-Roch spaces of plane curves C all singularities of which are ordinary within O(deg(C) 6 deg(D + ) 6 ) arithmetic operations in the base field, where D + is the smallest effective divisor such that D + ≥ D. In fact, writing D − = D + − D, we can assume without loss of gen-is a relevant measure of the size of the divisor D. Haché [12] proposes the first implementation of Brill-Noether's approach in a computer algebra system, using local desingularizations to handle singularities encountered during the algorithm. For lines of research closely related to this topic, we refer to [18,13] and references therein.A few years later, a breakthrough is achieved by Hess [14]: He provides an arithmetic approach to the Riemann-Roch problem, using fast algorithms for algebraic function fields. Hess' algorithm is now considered as a reference method for computing Riemann-Roch spaces, and it is proved to be polynomial in the input size [14, Remark 6.2].An important special case of the computation of Riemann-Roch spaces is the computation of the group law on Jacobians of curves. Volcheck [27] describes an algorithm with complexity O(max(deg(C), g) 7 ) in this context. The best known complexity for computing the group law on Jacobians of general curves is currently achieved by Khuri-Makdisi in [17], where he gives an algo...