tinyhmacmd5 0.2.2-es2026 → 0.2.3

package/README.md

@@ -2,7 +2,7 @@ English | [中文](README-zh.md)
 
 # Tiny HMAC MD5
 
-A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](browser.min.js) is only **951 bytes**.
+A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](browser.min.js) is only **982 bytes**.
 
 - **Input type**: `string` (UTF‑8), `Uint8Array` or `Uint8ClampedArray`
 - **Output type**: hex `string` or bytes `Uint8Array`
@@ -10,11 +10,13 @@ A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](b
 - **TypeScript‑ready**: [`main.d.ts`](main.d.ts)
 - **0 dependencies**
 
+**Live demo**: https://bddjr.github.io/tinyhmacmd5/
+
 `tinyhmacmd5` does not simply aim for the smallest possible size.  
 Its goal is to balance code size and runtime performance, so some performance-oriented implementations are intentionally retained.  
 As a result, the final size is not the smallest theoretically achievable.
 
-**Live demo**: https://bddjr.github.io/tinyhmacmd5/
+If you need a smaller implementation that targets ECMAScript 2026, see the [`es2026`](https://github.com/bddjr/tinyhmacmd5/tree/es2026) branch.
 
 > [!WARNING]  
 > MD5 is cryptographically broken and unsafe for security-sensitive applications.  
@@ -24,7 +26,6 @@ As a result, the final size is not the smallest theoretically achievable.
 
 ### npm
 
-
 ```
 npm i tinyhmacmd5
 ```
@@ -42,7 +43,7 @@ You can also use other package managers (e.g. `pnpm` or `yarn`) in place of `npm
 See https://www.jsdelivr.com/package/npm/tinyhmacmd5
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5@es2026"></script>
+<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -50,7 +51,7 @@ It will define the `md5` function using `var`.
 ### UNPKG
 
 ```html
-<script src="https://unpkg.com/tinyhmacmd5@es2026"></script>
+<script src="https://unpkg.com/tinyhmacmd5"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -141,22 +142,22 @@ md5(data)
 
 ## Runtime Environment
 
-Environments that support [`Uint8Array.prototype.toHex()`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array/toHex) :
+Environments that support [Exponentiation (`**`)](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Operators/Exponentiation) and [`TextEncoder`](https://developer.mozilla.org/docs/Web/API/TextEncoder) :
 
 - Desktop
-  - Chrome ≥ 140 (2025-09-02)
-  - Edge ≥ 140 (2025-09-05)
-  - Firefox ≥ 133 (2024-11-26)
-  - Opera ≥ 124 (2025-11-13)
-  - Safari ≥ 18.2 (2024-12-11)
+  - Chrome ≥ 52 (2016-07-20)
+  - Edge ≥ 79 (2020-01-15)
+  - Firefox ≥ 52 (2017-03-07)
+  - Opera ≥ 39 (2016-08-02)
+  - Safari ≥ 10.1 (2017-03-27)
 - Mobile
-  - Chrome Android ≥ 140 (2025-09-02)
-  - Firefox for Android ≥ 133 (2024-11-26)
-  - Opera Android ≥ 92 (2025-10-08)
-  - Safari on iOS ≥ 18.2 (2024-12-11)
-  - Samsung Browser ×
-  - WebView Android ≥ 140 (2025-09-02)
-  - WebView on iOS ≥ 18.2 (2024-12-11)
+  - Chrome Android ≥ 52 (2016-07-27)
+  - Firefox for Android ≥ 52 (2017-03-07)
+  - Opera Android ≥ 41 (2016-10-25)
+  - Safari on iOS ≥ 10.3 (2017-03-27)
+  - Samsung Browser ≥ 6 (2017-08-23)
+  - WebView Android ≥ 51 (2016-06-08)
+  - WebView on iOS ≥ 10.3 (2017-03-27)
 
 Not recommended for use in environments that support `node:crypto`, as `node:crypto` already provides HMAC-MD5.
 
@@ -178,7 +179,7 @@ During the adaptation, I discovered that `blueimp-md5` did not correctly handle
 
 I also found that using `Array` to process inputs over 512 MiB could throw a `RangeError`, so I replaced it with `Int32Array`.
 
-I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (951 bytes) while also improving reliability.
+I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (982 bytes) while also improving reliability.
 
 Maybe not many people care about saving just a few KB, but `tinyhmacmd5` exists precisely to "explore the unknown".
 

package/browser.min.js

@@ -1 +1 @@
-/*! npmjs.com/tinyhmacmd5 */{let r=[],e=0,n=Math,t=n.floor,o=r=>16*t((r+72)/64),f=(e,n,f=0,a=o(n),l=1732584193,c=271733878,d,h,i=[l,~c,~l,c],u=[...i])=>{for(e[a-1]=0|n/2**29,e[t(n/4)]|=128<<(e[a-2]=n<<3);f<e.length;){for(a=0;a<64;)i[h&=3]=0|((c=0|i[h]+r[a]+(l=i[3&++h],c=i[3&++h],d=i[3&++h],(n=a>>4<<2)?n>4?n>8?c^(l|~d):l^c^d:l&d|c&~d:l&c|~l&d)+(0|e[f+(a*(29521>>n)+(1296>>n)&15)]))<<(d="',16%).4$+07&*/5".charCodeAt(3&a++|n))|c>>>64-d)+l;for(;h;f+=4)u[--h]=i[h]=0|u[h]+i[h]}return i},a=(r,e,n=("string"==typeof r?r=(new TextEncoder).encode(r):r).length,t=new Int32Array(o(4*e+n)),f=0)=>{for(;f<n;)t[e++]=r[f++]|r[f++]<<8|r[f++]<<16|r[f++]<<24;return[t,n]};for(var md5=(r,e,n)=>{var t=16,o=null!=e,[l,c]=a(r,o*t),d=[],h=new Uint8Array(t);if(o){let[r,n]=a(e,0);for(n>64&&(r=f(r,n));t;)d[--t]=1785358954^(l[t]=909522486^r[t]);t=16,l=d.concat(f(l,64+c)),c=80}for(l=f(l,c);t;)h[--t]=l[t>>2]>>8*t;return n?h:h.toHex()};e<64;)r[e]=0|2**32*n.abs(n.sin(++e))}
+/*! npmjs.com/tinyhmacmd5 */{let r=[],n=0,t=Math,e=t.floor,o=r=>16*e((r+72)/64),f=(n,t,f=0,a=o(t),l=1732584193,c=271733878,i,d,g=[l,~c,~l,c],h=[...g])=>{for(n[a-1]=0|t/2**29,n[e(t/4)]|=128<<(n[a-2]=t<<3);f<n.length;f+=16){for(a=0;a<64;g[d&=3]=0|((c=0|g[d]+r[a]+(l=g[3&++d],c=g[3&++d],i=g[3&++d],t?t>4?t>8?c^(l|~i):l^c^i:l&i|c&~i:l&c|~l&i)+(0|n[f+(a*(29521>>t)+(1296>>t)&15)]))<<(i="',16%).4$+07&*/5".charCodeAt(3&a++|t))|c>>>64-i)+l)t=a>>4<<2;for(;d;)h[--d]=g[d]=0|h[d]+g[d]}return g},a=(r,n,t=("string"==typeof r?r=(new TextEncoder).encode(r):r).length,e=new Int32Array(o(4*n+t)),f=0)=>{for(;f<t;)e[n++]=r[f++]|r[f++]<<8|r[f++]<<16|r[f++]<<24;return[e,t]};for(var md5=(r,n,t)=>{var e=16,o=null!=n,[l,c]=a(r,o*e),i=t?new Uint8Array(e):"";if(o){let[r,t]=a(n,0),o=[];for(t>64&&(r=f(r,t)),t=e;t;)o[--t]=1785358954^(l[t]=909522486^r[t]);l=o.concat(f(l,64+c)),c=80}for(l=f(l,c);e;t?i[e]=c:i=(c>>4&&"")+c.toString(16)+i)c=l[--e>>2]>>8*e&255;return i};n<64;)r[n]=0|2**32*t.abs(t.sin(++n))}

package/main.js

@@ -44,8 +44,8 @@ let wordsMD5 = (
   x[j - 1] = 0 | l / 2 ** 29;
   x[floor(l / 4)] |= 0x80 << (x[j - 2] = l << 3);
 
-  for (; i < x.length;) {
-    for (j = 0; j < 64;) {
+  for (; i < x.length; i += 16) {
+    for (j = 0; j < 64;
       output[oi &= 3] = 0 | (
         (
           t1 = 0 | (
@@ -55,7 +55,7 @@ let wordsMD5 = (
               t0 = output[++oi & 3],
               t1 = output[++oi & 3],
               t2 = output[++oi & 3],
-              (l = j >> 4 << 2)
+              l
                 ? l > 4
                   ? l > 8
                     ? t1 ^ (t0 | ~t2)  // Round 4: I
@@ -71,8 +71,10 @@ let wordsMD5 = (
           t2 = "',16%).4$+07&*/5".charCodeAt(j++ & 3 | l)
         ) | t1 >>> 64 - t2
       ) + t0
+    ) {
+      l = j >> 4 << 2
     }
-    for (; oi; i += 4) {
+    for (; oi;) {
       oldOutput[--oi] = output[oi] = 0 | oldOutput[oi] + output[oi]
     }
   }
@@ -126,36 +128,38 @@ let inputToWords = (
 var md5 = (data, key, raw) => {
   var i = 16
     , hasKey = key != null
-    , [bdata, dataByteLen] = inputToWords(data, /**@type {*}*/(hasKey) * i)
+    , [bdata, temp] = inputToWords(data, /**@type {*}*/(hasKey) * i)
 
   /** @type {*} */
-  var temp = []
-
-  var out = new Uint8Array(i)
+  var out = raw ? new Uint8Array(i) : ''
 
   if (hasKey) {
     // HMAC
-    let [bkey, keyByteLen] = inputToWords(key, 0)
-    if (keyByteLen > 64) {
-      bkey = wordsMD5(bkey, keyByteLen)
+    let [bkey, j] = inputToWords(key, 0)
+      , opad = []
+    if (j > 64) {
+      bkey = wordsMD5(bkey, j)
     }
-    for (; i;) {
+    for (j = i; j;) {
       // (0x36363636 ^ 0x5c5c5c5c) == 0x6a6a6a6a
-      temp[--i] = 0x6a6a6a6a ^ (bdata[i] = 0x36363636 ^ bkey[i])
+      opad[--j] = 0x6a6a6a6a ^ (bdata[j] = 0x36363636 ^ bkey[j])
     }
-    i = 16
-    bdata = temp.concat(wordsMD5(bdata, 64 + dataByteLen))
-    dataByteLen = 80
+    bdata = opad.concat(wordsMD5(bdata, 64 + temp))
+    temp = 80
   }
 
-  bdata = wordsMD5(bdata, dataByteLen)
+  bdata = wordsMD5(bdata, temp)
 
   // words to bytes or hex
-  for (; i;) {
-    out[--i] = bdata[i >> 2] >> i * 8
+  for (; i;
+    raw
+      ? out[i] = temp
+      : out = (temp >> 4 && '') + temp.toString(16) + out
+  ) {
+    temp = bdata[--i >> 2] >> i * 8 & 0xff
   }
 
-  return raw ? out : out.toHex()
+  return out
 }
 
 for (; i < 64;) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tinyhmacmd5",
-  "version": "0.2.2-es2026",
-  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 951 bytes.",
+  "version": "0.2.3",
+  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 982 bytes.",
   "author": "bddjr",
   "license": "MIT",
   "type": "module",
@@ -60,7 +60,7 @@
     "typescript": "^7.0.2"
   },
   "scripts": {
-    "build": "tsc && node scripts/build.mjs && es-check es2026 --module --checkFeatures main.js browser.min.js",
+    "build": "tsc && node scripts/build.mjs && es-check es2016 --module --checkFeatures main.js browser.min.js",
     "build:unchanged": "node scripts/build-unchanged.mjs",
     "test": "pnpm build && pnpm test:only",
     "test:only": "node scripts/test.mjs",