tinyhmacmd5 0.2.3-es2026 → 0.3.0-es2026

package/README.md

@@ -2,7 +2,7 @@ English | [中文](README-zh.md)
 
 # Tiny HMAC MD5
 
-A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](browser.min.js) is only **950 bytes**.
+A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](browser.min.js) is only **963 bytes**.
 
 - **Input type**: `string` (UTF‑8), `Uint8Array` or `Uint8ClampedArray`
 - **Output type**: hex `string` or bytes `Uint8Array`
@@ -14,8 +14,6 @@ A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](b
 Its goal is to balance code size and runtime performance, so some performance-oriented implementations are intentionally retained.  
 As a result, the final size is not the smallest theoretically achievable.
 
-**Live demo**: https://bddjr.github.io/tinyhmacmd5/
-
 > [!WARNING]  
 > MD5 is cryptographically broken and unsafe for security-sensitive applications.  
 > Do not rely on it for password hashing, digital signatures, or certificate verification.
@@ -24,7 +22,6 @@ As a result, the final size is not the smallest theoretically achievable.
 
 ### npm
 
-
 ```
 npm i tinyhmacmd5@es2026
 ```
@@ -162,6 +159,33 @@ Not recommended for use in environments that support `node:crypto`, as `node:cry
 
 ---
 
+## Benchmark
+
+```
+pnpm benchmark
+```
+
+```
+Generating 100MiB string data (this might take a moment)...
+Data length: 104857600 chars (100MiB)
+--------------------------------------------------
+tinyhmacmd5     : 718.27 ms
+js-md5          : 141.43 ms
+blueimp-md5     : 3934.98 ms
+crypto-js       : 1732.55 ms
+native crypto   : 136.60 ms
+--------------------------------------------------
+✅ All pure JS implementations match native crypto result.
+
+--- Pure 513MiB Test (No prior small tests) ---
+tinyhmacmd5 HMAC-MD5 timer: 3.465s
+node:crypto HMAC-MD5 timer: 572.686ms
+tinyhmacmd5 MD5 timer: 3.451s
+node:crypto MD5 timer: 571.58ms
+```
+
+---
+
 ## Why I Made This Project
 
 I initially used HMAC-MD5 just to call a certain website's API. That site signs the request body with `crypto-js`'s HMAC-MD5 to make reverse engineering harder.
@@ -178,7 +202,7 @@ During the adaptation, I discovered that `blueimp-md5` did not correctly handle
 
 I also found that using `Array` to process inputs over 512 MiB could throw a `RangeError`, so I replaced it with `Int32Array`.
 
-I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (950 bytes) while also improving reliability.
+I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (963 bytes) while also improving reliability.
 
 Maybe not many people care about saving just a few KB, but `tinyhmacmd5` exists precisely to "explore the unknown".
 

package/browser.min.js

@@ -1 +1 @@
-/*! npmjs.com/tinyhmacmd5 */{let r=[],e=0,n=Math,t=n.floor,o=r=>16*t((r+72)/64),f=(e,n,f=0,a=o(n),l=1732584193,c=271733878,d,h,i=[l,~c,~l,c],u=[...i])=>{for(e[a-1]=0|n/2**29,e[t(n/4)]|=128<<(e[a-2]=n<<3);f<e.length;f+=16){for(a=0;a<64;i[h&=3]=0|((c=0|i[h]+r[a]+(l=i[3&++h],c=i[3&++h],d=i[3&++h],n?n>4?n>8?c^(l|~d):l^c^d:l&d|c&~d:l&c|~l&d)+(0|e[f+(a*(29521>>n)+(1296>>n)&15)]))<<(d="',16%).4$+07&*/5".charCodeAt(3&a++|n))|c>>>64-d)+l)n=a>>4<<2;for(;h;)u[--h]=i[h]=0|u[h]+i[h]}return i},a=(r,e,n=("string"==typeof r?r=(new TextEncoder).encode(r):r).length,t=new Int32Array(o(4*e+n)),f=0)=>{for(;f<n;)t[e++]=r[f++]|r[f++]<<8|r[f++]<<16|r[f++]<<24;return[t,n]};for(var md5=(r,e,n)=>{var t=16,o=null!=e,[l,c]=a(r,o*t),d=new Uint8Array(t);if(o){let[r,n]=a(e,0),o=[];for(n>64&&(r=f(r,n)),n=t;n;)o[--n]=1785358954^(l[n]=909522486^r[n]);l=o.concat(f(l,64+c)),c=80}for(l=f(l,c);t;)d[--t]=l[t>>2]>>8*t;return n?d:d.toHex()};e<64;)r[e]=0|2**32*n.abs(n.sin(++e))}
+/*! npmjs.com/tinyhmacmd5 */{let r=Math,e=r.floor,n=Int32Array,t=new n(64).map((e,n)=>2**32*r.abs(r.sin(n+1))),o=r=>16*e((r+72)/64),f=(r,o,f=0,a,l=1732584193,w=271733878,d,h,i=r.length,s=n.of(l,~w,~l,w),u=new n(s))=>{for(r[i-1]=o/2**29,r[e(o/4)]|=128<<(r[i-2]=o<<3);f<i;f+=16){for(o=0;o<16;o+=4)for(a=0;a<16;)s[h&=3]=((w=s[h]+t[4*o|a]+(l=s[3&++h],w=s[3&++h],d=s[3&++h],o?o>4?o>8?w^(l|~d):l^w^d:l&d|w&~d:l&w|~l&d)+r[f+(a*(29521>>o)+(1296>>o)&15)])<<(d="',16%).4$+07&*/5".charCodeAt(3&a++|o))|w>>>64-d)+l;for(;h;)u[--h]=s[h]+=u[h]}return s},a=(r,e,t=("string"==typeof r?r=(new TextEncoder).encode(r):r).length,f=new n(o(4*e+t)),a=0)=>{for(;a<t;)f[e++]=r[a++]|r[a++]<<8|r[a++]<<16|r[a++]<<24;return[f,t]};var md5=(r,e,t)=>{var o=16,l=null!=e,[w,d]=a(r,l*o),h=new Uint8Array(o);if(l){let[r,t]=a(e,0),l=new n(32);for(t>64&&(r=f(r,t)),t=o;t;)l[--t]=1785358954^(w[t]=909522486^r[t]);l.set(f(w,64+d),16),w=l,d=80}for(w=f(w,d);o;)h[--o]=w[o>>2]>>8*o;return t?h:h.toHex()}}

package/main.js

@@ -2,15 +2,15 @@
 
 // Adapted from https://github.com/blueimp/JavaScript-MD5
 
-/** @type {number[]} MD5 constants cached in memory */
-let K = []
-
-let i = 0
-
 let $Math = Math
 
 let floor = $Math.floor
 
+let $Int32Array = Int32Array
+
+/** MD5 constants cached in memory */
+let K = new $Int32Array(64).map((v, i) => 2 ** 32 * $Math.abs($Math.sin(i + 1)))
+
 /** @param {number} byteLen */
 // `byteLen` may be >= 2**32, so cannot use `>>>` as a replacement for `floor`
 let wordsLen = (byteLen) => floor((byteLen + 72) / 64) * 16
@@ -18,64 +18,64 @@ let wordsLen = (byteLen) => floor((byteLen + 72) / 64) * 16
 /**
  * Calculate the MD5 of an array of little-endian words, and a byte length.
  *
- * @param {Int32Array | number[]} x Array of little-endian words
+ * @param {Int32Array<ArrayBuffer>} x little-endian words
  * @param {number} l Byte length
  * 
+ * @param {number} [j]
  * @param {number} [t2]
  * @param {number} [oi]
  * 
- * @returns {number[]} MD5 Array
+ * @returns {Int32Array<ArrayBuffer>} MD5 Array
  */
 let wordsMD5 = (
   x,
   l,
   // var:
   i = 0,
-  j = wordsLen(l),
+  j,
   t0 = 1732584193,
   t1 = 271733878,
   t2,
   oi,
-  output = [t0, ~t1, ~t0, t1],
-  oldOutput = [...output],
+  xLen = x.length,
+  output = $Int32Array.of(t0, ~t1, ~t0, t1),
+  oldOutput = new $Int32Array(output),
 ) => {
   // append padding
   // `l` may be >= 2**32, so cannot use `>>>` as a replacement for `floor`
-  x[j - 1] = 0 | l / 2 ** 29;
-  x[floor(l / 4)] |= 0x80 << (x[j - 2] = l << 3);
-
-  for (; i < x.length; i += 16) {
-    for (j = 0; j < 64;
-      output[oi &= 3] = 0 | (
-        (
-          t1 = 0 | (
-            output[oi] +
-            K[j] +
-            (
-              t0 = output[++oi & 3],
-              t1 = output[++oi & 3],
-              t2 = output[++oi & 3],
-              l
-                ? l > 4
-                  ? l > 8
-                    ? t1 ^ (t0 | ~t2)  // Round 4: I
-                    : t0 ^ t1 ^ t2     // Round 3: H
-                  : t0 & t2 | t1 & ~t2 // Round 2: G
-                : t0 & t1 | ~t0 & t2   // Round 1: F
-            ) +
-            (
-              0 | x[i + (j * (0x7351 >> l) + (0x0510 >> l) & 15)]
+  x[xLen - 1] = l / 2 ** 29;
+  x[floor(l / 4)] |= 0x80 << (x[xLen - 2] = l << 3);
+
+  for (; i < xLen; i += 16) {
+    for (l = 0; l < 16; l += 4) {
+      for (j = 0; j < 16;) {
+        output[oi &= 3] = (
+          (
+            t1 = (
+              output[oi] +
+              K[l * 4 | j] +
+              (
+                t0 = output[++oi & 3],
+                t1 = output[++oi & 3],
+                t2 = output[++oi & 3],
+                l
+                  ? l > 4
+                    ? l > 8
+                      ? t1 ^ (t0 | ~t2)  // Round 4: I
+                      : t0 ^ t1 ^ t2     // Round 3: H
+                    : t0 & t2 | t1 & ~t2 // Round 2: G
+                  : t0 & t1 | ~t0 & t2   // Round 1: F
+              ) +
+              x[i + (j * (0x7351 >> l) + (0x0510 >> l) & 15)]
             )
-          )
-        ) << (
-          t2 = "',16%).4$+07&*/5".charCodeAt(j++ & 3 | l)
-        ) | t1 >>> 64 - t2
-      ) + t0
-    ) {
-      l = j >> 4 << 2
+          ) << (
+            t2 = "',16%).4$+07&*/5".charCodeAt(j++ & 3 | l)
+          ) | t1 >>> 64 - t2
+        ) + t0
+      }
     }
     for (; oi;) {
-      oldOutput[--oi] = output[oi] = 0 | oldOutput[oi] + output[oi]
+      oldOutput[--oi] = output[oi] += oldOutput[oi]
     }
   }
   return output
@@ -87,7 +87,7 @@ let wordsMD5 = (
  * @param {*} input
  * @param {number} j pad int32 length
  * 
- * @returns {[Int32Array<ArrayBuffer> | number[], number]}
+ * @returns {[Int32Array<ArrayBuffer>, number]}
  */
 let inputToWords = (
   input,
@@ -100,7 +100,7 @@ let inputToWords = (
   ).length,
   // Using `Array` to process inputs over 512 MiB could throw a `RangeError`,
   // so I replaced it with `Int32Array`.
-  output = new Int32Array(wordsLen(j * 4 + byteLen)),
+  output = new $Int32Array(wordsLen(j * 4 + byteLen)),
   i = 0,
 ) => {
   for (; i < byteLen;) {
@@ -134,7 +134,7 @@ var md5 = (data, key, raw) => {
   if (hasKey) {
     // HMAC
     let [bkey, j] = inputToWords(key, 0)
-      , opad = []
+      , opad = new $Int32Array(32)
     if (j > 64) {
       bkey = wordsMD5(bkey, j)
     }
@@ -142,7 +142,8 @@ var md5 = (data, key, raw) => {
       // (0x36363636 ^ 0x5c5c5c5c) == 0x6a6a6a6a
       opad[--j] = 0x6a6a6a6a ^ (bdata[j] = 0x36363636 ^ bkey[j])
     }
-    bdata = opad.concat(wordsMD5(bdata, 64 + temp))
+    opad.set(wordsMD5(bdata, 64 + temp), 16)
+    bdata = opad
     temp = 80
   }
 
@@ -156,8 +157,4 @@ var md5 = (data, key, raw) => {
   return raw ? out : out.toHex()
 }
 
-for (; i < 64;) {
-  K[i] = 0 | 2 ** 32 * $Math.abs($Math.sin(++i))
-}
-
 export default md5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tinyhmacmd5",
-  "version": "0.2.3-es2026",
-  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 950 bytes.",
+  "version": "0.3.0-es2026",
+  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 963 bytes.",
   "author": "bddjr",
   "license": "MIT",
   "type": "module",
@@ -54,7 +54,10 @@
     "url": "git+https://github.com/bddjr/tinyhmacmd5.git"
   },
   "devDependencies": {
+    "blueimp-md5": "^2.19.0",
+    "crypto-js": "^4.2.0",
     "es-check": "^9.6.4",
+    "js-md5": "^0.9.2",
     "terser": "^5.49.0",
     "tinyhmacmd5": "link:",
     "typescript": "^7.0.2"
@@ -63,7 +66,8 @@
     "build": "tsc && node scripts/build.mjs && es-check es2026 --module --checkFeatures main.js browser.min.js",
     "build:unchanged": "node scripts/build-unchanged.mjs",
     "test": "pnpm build && pnpm test:only",
-    "test:only": "node scripts/test.mjs",
-    "test:unchanged": "pnpm build:unchanged && pnpm test:only"
+    "test:only": "node scripts/test.mjs && node scripts/test-513MiB.mjs",
+    "test:unchanged": "pnpm build:unchanged && pnpm test:only",
+    "benchmark": "node scripts/benchmark.mjs && node scripts/test-513MiB.mjs"
   }
 }