Merkle Root
Also: Merkle tree, tx merkle root
cryptography · intermediate
A single 32-byte hash committing to every transaction in a block. Lets nodes prove a tx is in a block without downloading it.
A Merkle tree is a tree of hashes. Bitcoin builds one per block: every transaction's txid sits at a leaf, each level pairs siblings and hashes them together with SHA-256-twice, and the single hash at the root is committed to in the block header.
Two properties this gives you:
- The block header (~80 bytes) is a tamper-evident summary of the entire block. Change any transaction and the merkle root changes; change the merkle root and the [proof-of-work](/glossary/proof-of-work) hash no longer matches the target. Miners can't selectively rewrite history without redoing the work.
- Light clients can verify inclusion in O(log n) hashes. Given a transaction's txid and a "merkle proof" — the sibling hashes along its path from leaf to root — a verifier can recompute the root and check it against the block header. This is the foundation of SPV ("Simplified Payment Verification") wallets that don't store the full chain.
Some quirks worth knowing: Bitcoin's merkle implementation has a [duplicate-hash quirk](https://bitcointalk.org/?topic=102395.0) that lets an attacker craft two distinct blocks with the same merkle root if the transaction count is odd. SegWit adds a *second* merkle root — the witness merkle root — committed to inside the coinbase transaction, so the block header's primary merkle root only needs to cover non-witness data.