If you're building an audit log and want it tamper-evident, you'll hit the same fork I did: do I link records in a sequential hash chain, or build a Merkle tree? Both let a third party detect tampering, but they make different tradeoffs — and one of them will quietly fail your audit if you pick wrong.
This isn't a "which is better" post. It's a decision guide based on how the log is actually written and who has to verify it.
The two structures, in one paragraph each
Hash chain (sequential). Each record carries the hash of the previous record's contents. To verify, you walk from the oldest to the newest, recomputing each link. If any record's payload changed, its link breaks — and every link after it breaks too.
record[0].hash = H(payload[0])
record[n].hash = H(payload[n] || record[n-1].hash)
Merkle tree. Records are leaves; you hash pairs up to a single root. To verify one record, you don't replay the whole log — you present the root plus the small set of sibling hashes on the path from that leaf to the root (a "membership proof"). The root is the only thing you need to trust or anchor externally.
root = H( H(leaf0 || leaf1) || H(leaf2 || leaf3) )
How to decide
Ask three questions.
1. Are records appended strictly in order, by one writer?
Audit logs almost always are. Events happen in time; you append as they arrive. A sequential hash chain fits this shape like a glove — the "previous hash" pointer is just "the thing you wrote a moment ago," and there's no bookkeeping.
A Merkle tree can do ordered appends too, but you pay a cost: every append can change the root, and if you want a stable root to anchor (say, hourly), you're really building a series of Merkle trees — one per batch. That's a perfectly good design; it's just more machinery than a chain for the common case.
2. Does a verifier ever need to prove one record without replaying everything?
This is where Merkle wins. Suppose a regulator wants to confirm a single transaction from 2023 without downloading your entire 40 GB log. With a hash chain, they must replay from the beginning (or from the last anchored checkpoint) to reach that record. With a Merkle tree, you hand them the root plus a ~log2(n) proof and they're done.
If your verifiers are third parties who sample records rather than replay the whole trail, Merkle membership proofs are the difference between "here's a 2 KB proof" and "here's a 40 GB file."
3. Do you need to prove a record was absent?
A Merkle tree gives you a clean answer to "this record is not in the log" (a proof of non-membership, with the right tree design). A sequential hash chain cannot prove absence at all — it can only confirm what is there. If your compliance requirement includes "demonstrate we never logged X," that's a Merkle property, not a chain property.
The tradeoff table
| Hash chain | Merkle tree | |
|---|---|---|
| Append cost | O(1) per record | O(1) per leaf, but root changes |
| Verify one record | Replay from anchor (O(n)) | Membership proof (O(log n)) |
| Prove absence | No | Yes (with design) |
| External anchor | Anchor the head hash | Anchor the root |
| Mental model | Trivial | Needs care (ordering, balancing) |
| Best when | Single ordered writer, full-trail verification | Third-party sampling, large logs, absence proofs |
The hybrid I'd actually ship
For most audit-log systems, you don't pick one — you use both, at different layers.
- The hash chain is the write path: every appended record links to the previous, giving you append-only, tamper-evident history with zero extra machinery.
- Periodically (hourly, daily), take the current chain head and build a Merkle tree over the batch, or simply anchor the head hash to an external trusted timestamp (RFC 3161). The anchored root is what a third party trusts; the chain is what they replay to drill into any record.
This gives you the chain's simplicity on the hot path and the Merkle tree's efficient sampling when a verifier shows up with a specific question.
Where I was wrong
In an earlier post I waved this away with "a simple sequential chain beats a full Merkle tree." That's true for the write path of a single ordered writer. It's wrong if your verifiers sample records, need absence proofs, or can't replay a 40 GB trail. The honest answer: the chain is the default, the tree is the upgrade when verification scale demands it.
The part neither structure solves
A hash chain and a Merkle root both prove integrity — that bytes weren't changed. Neither proves when the bytes were written, and neither survives someone who controls the database rewriting both the record and its links. The fix for both is the same: anchor the head (or root) to an external trusted timestamp (RFC 3161) so "this existed by then" becomes independently provable, and keep the verification logic runnable by a party who isn't you.
Build the chain. Anchor it. Let someone else replay it. That's the whole game.
