A Merkle tree lets a light client verify that one transaction belongs to a huge dataset while trusting only a single 32-byte root hash. Each leaf is H(data); every internal node is H(left ‖ right), computed with the real SHA-256 function (via crypto.subtle.digest) all the way up to the root:
leaf_i = SHA256("leaf:" + data_i)
node = SHA256(left_child ‖ right_child)
root = the single top node
A Merkle proof for leaf i is just the log₂N sibling hashes along the path to the root — verifying it means recombining them and checking the result equals the trusted root:
- Verify Proof — recomputes the selected leaf's hash from its current data, walks it up through the stored sibling hashes level by level, and compares the final value to the trusted root. Every level lights up green when it matches.
- Tamper Selected Leaf — mutates that leaf's underlying data without touching the tree's stored hashes, simulating an attacker who edits a transaction but reuses the old proof. Because SHA-256 has the avalanche property, even a single changed byte produces a completely different hash, so the mismatch appears at the leaf and propagates through every node on the path to the root — none of them can be forged without breaking the chain.
- Rebuild Tree (honest) — the legitimate way to change data: recompute the whole tree bottom-up and publish a new trusted root, which is exactly what happens on-chain when a new block is mined.
This is the exact mechanism SPV (simplified payment verification) wallets and blockchain light clients use to confirm a transaction is in a block by downloading only O(log N) hashes instead of the whole block.