tinyhmacmd5 0.3.2-es2026 → 0.3.3

package/README.md

@@ -2,7 +2,7 @@ English | [中文](README-zh.md)
 
 # Tiny HMAC MD5
 
-A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](browser.min.js) is only **952 bytes**.
+A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](browser.min.js) is only **982 bytes**.
 
 - **Input type**: `string` (UTF‑8), `Uint8Array` or `Uint8ClampedArray`
 - **Output type**: hex `string` or bytes `Uint8Array`
@@ -10,10 +10,14 @@ A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](b
 - **TypeScript‑ready**: [`main.d.ts`](main.d.ts)
 - **0 dependencies**
 
+**Live demo**: https://bddjr.github.io/tinyhmacmd5/
+
 `tinyhmacmd5` does not simply aim for the smallest possible size.  
 Its goal is to balance code size and runtime performance, so some performance-oriented implementations are intentionally retained.  
 As a result, the final size is not the smallest theoretically achievable.
 
+If you need a smaller implementation that targets ECMAScript 2026, see the [`es2026`](https://github.com/bddjr/tinyhmacmd5/tree/es2026) branch.
+
 > [!WARNING]  
 > MD5 is cryptographically broken and unsafe for security-sensitive applications.  
 > Do not rely on it for password hashing, digital signatures, or certificate verification.
@@ -23,7 +27,7 @@ As a result, the final size is not the smallest theoretically achievable.
 ### npm
 
 ```
-npm i tinyhmacmd5@es2026
+npm i tinyhmacmd5
 ```
 
 ```js
@@ -39,7 +43,7 @@ You can also use other package managers (e.g. `pnpm` or `yarn`) in place of `npm
 See https://www.jsdelivr.com/package/npm/tinyhmacmd5
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5@es2026"></script>
+<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -47,7 +51,7 @@ It will define the `md5` function using `var`.
 ### UNPKG
 
 ```html
-<script src="https://unpkg.com/tinyhmacmd5@es2026"></script>
+<script src="https://unpkg.com/tinyhmacmd5"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -138,22 +142,22 @@ md5(data)
 
 ## Runtime Environment
 
-Environments that support [`Uint8Array.prototype.toHex()`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array/toHex) :
+Environments that support [Exponentiation (`**`)](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Operators/Exponentiation) and [`TextEncoder`](https://developer.mozilla.org/docs/Web/API/TextEncoder) :
 
 - Desktop
-  - Chrome ≥ 140 (2025-09-02)
-  - Edge ≥ 140 (2025-09-05)
-  - Firefox ≥ 133 (2024-11-26)
-  - Opera ≥ 124 (2025-11-13)
-  - Safari ≥ 18.2 (2024-12-11)
+  - Chrome ≥ 52 (2016-07-20)
+  - Edge ≥ 79 (2020-01-15)
+  - Firefox ≥ 52 (2017-03-07)
+  - Opera ≥ 39 (2016-08-02)
+  - Safari ≥ 10.1 (2017-03-27)
 - Mobile
-  - Chrome Android ≥ 140 (2025-09-02)
-  - Firefox for Android ≥ 133 (2024-11-26)
-  - Opera Android ≥ 92 (2025-10-08)
-  - Safari on iOS ≥ 18.2 (2024-12-11)
-  - Samsung Browser ×
-  - WebView Android ≥ 140 (2025-09-02)
-  - WebView on iOS ≥ 18.2 (2024-12-11)
+  - Chrome Android ≥ 52 (2016-07-27)
+  - Firefox for Android ≥ 52 (2017-03-07)
+  - Opera Android ≥ 41 (2016-10-25)
+  - Safari on iOS ≥ 10.3 (2017-03-27)
+  - Samsung Browser ≥ 6 (2017-08-23)
+  - WebView Android ≥ 51 (2016-06-08)
+  - WebView on iOS ≥ 10.3 (2017-03-27)
 
 Not recommended for use in environments that support `node:crypto`, as `node:crypto` already provides HMAC-MD5.
 
@@ -168,21 +172,26 @@ pnpm benchmark
 ```
 Data length: 104857600 chars (100MiB)
 --------------------------------------------------
-tinyhmacmd5     : 724.91 ms
-js-md5          : 138.45 ms
-blueimp-md5     : 4014.42 ms
-crypto-js       : 1637.30 ms
-native crypto   : 135.11 ms
+tinyhmacmd5     : 640.00 ms
+js-md5          : 131.10 ms
+blueimp-md5     : 3825.62 ms
+crypto-js       : 1572.49 ms
+node:crypto     : 130.07 ms
 --------------------------------------------------
-✅ All pure JS implementations match native crypto result.
+✅ All pure JS implementations match node:crypto result.
 
 --- Pure 513MiB Test (No prior small tests) ---
-tinyhmacmd5 HMAC-MD5 timer: 3.463s
-node:crypto HMAC-MD5 timer: 572.541ms
-tinyhmacmd5 MD5 timer: 3.450s
-node:crypto MD5 timer: 569.816ms
+tinyhmacmd5 HMAC-MD5 timer: 3.184s
+node:crypto HMAC-MD5 timer: 552.938ms
+tinyhmacmd5 MD5 timer: 3.175s
+node:crypto MD5 timer: 553.263ms
 ```
 
+CPU: i5-10600KF  
+DRAM: 64GiB DDR4 3333MT/s  
+OS: Windows 11 Pro for Workstations 25H2 26200.8737  
+Node.js: v26.8.1
+
 ---
 
 ## Why I Made This Project
@@ -201,7 +210,7 @@ During the adaptation, I discovered that `blueimp-md5` did not correctly handle
 
 I also found that using `Array` to process inputs over 512 MiB could throw a `RangeError`, so I replaced it with `Int32Array`.
 
-I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (952 bytes) while also improving reliability.
+I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (982 bytes) while also improving reliability.
 
 Maybe not many people care about saving just a few KB, but `tinyhmacmd5` exists precisely to "explore the unknown".
 

package/browser.min.js

@@ -1 +1 @@
-/*! npmjs.com/tinyhmacmd5 */{let r=Math,e=r.floor,n=Int32Array,t=new n(64).map((e,n)=>2**32*r.abs(r.sin(n+1))),o=(r,o,f=0,a,l=1732584193,w=271733878,d,h,i=r.length,s=n.of(l,~w,~l,w),u=new n(s))=>{for(r[i-1]=o/2**29,r[e(o/4)]|=128<<(r[i-2]=o<<3);f<i;f+=16){for(o=0;o<16;o+=4)for(a=0;a<16;)s[h&=3]=((w=s[h]+t[4*o|a]+(l=s[3&++h],w=s[3&++h],d=s[3&++h],o?o>4?o>8?w^(l|~d):l^w^d:l&d|w&~d:l&w|~l&d)+r[f+(a*(29521>>o)+(1296>>o)&15)])<<(d="',16%).4$+07&*/5".charCodeAt(3&a++|o))|w>>>64-d)+l;for(;h;)u[--h]=s[h]+=u[h]}return s},f=(r,t,o=("string"==typeof r?r=(new TextEncoder).encode(r):r).length,f=new n(16*e((4*t+o+72)/64)),a=0)=>{for(;a<o;)f[t++]=r[a++]|r[a++]<<8|r[a++]<<16|r[a++]<<24;return[f,o]};var md5=(r,e,t)=>{var a=16,l=null!=e,[w,d]=f(r,l*a),h=new Uint8Array(a);if(l){let[r,t]=f(e,0),l=new n(32);for(t>64&&(r=o(r,t)),t=a;t;)l[--t]=1785358954^(w[t]=909522486^r[t]);l.set(o(w,64+d),a),w=l,d=80}for(w=o(w,d);a;)h[--a]=w[a>>2]>>8*a;return t?h:h.toHex()}}
+/*! npmjs.com/tinyhmacmd5 */{let r=Math,e=Int32Array,n=new e(64).map((e,n)=>2**32*r.abs(r.sin(n+1))),t=(t,o,f=0,a,l=1732584193,i=271733878,w,c,d=t.length,g=e.of(l,~i,~l,i),h=new e(g))=>{for(t[d-1]=o/2**29,t[r.floor(o/4)]|=128<<(t[d-2]=o<<3);f<d;f+=16){for(o=0;o<16;o+=4)for(a=0;a<16;)g[c&=3]=((i=g[c]+n[4*o+a]+(l=g[3&++c],i=g[3&++c],w=g[3&++c],o?i^(o>4?o>8?l|~w:l^w:w&(l^i)):l&i|~l&w)+t[f+(a*(29521>>o)+(1296>>o)&15)])<<(w="',16%).4$+07&*/5".charCodeAt(3&a++|o)-32)|i>>>32-w)+l;for(;c;)h[--c]=g[c]+=h[c]}return g},o=(n,t,o=("string"==typeof n?n=(new TextEncoder).encode(n):n).length,f=new e(t+16*r.ceil((o+9)/64)),a=0)=>{for(;a<o;)f[t++]=n[a++]|n[a++]<<8|n[a++]<<16|n[a++]<<24;return[f,o]};var md5=(r,n,f)=>{var a=16,l=null!=n,[i,w]=o(r,l*a),c=f?new Uint8Array(a):"";if(l){let[r,f]=o(n,0),l=new e(32);for(f>64&&(r=t(r,f)),f=a;f;)l[--f]=1785358954^(i[f]=909522486^r[f]);l.set(t(i,64+w),a),i=l,w=80}for(i=t(i,w);a;f?c[a]=w:c=(w>>4&&"")+w.toString(16)+c)w=i[--a>>2]>>8*a&255;return c}}

package/main.js

@@ -4,8 +4,6 @@
 
 let $Math = Math
 
-let floor = $Math.floor
-
 let $Int32Array = Int32Array
 
 /** MD5 constants cached in memory */
@@ -40,7 +38,7 @@ let wordsMD5 = (
   // append padding
   // `l` may be >= 2**32, so cannot use `>>>` as a replacement for `floor`
   x[xLen - 1] = l / 2 ** 29;
-  x[floor(l / 4)] |= 0x80 << (x[xLen - 2] = l << 3);
+  x[$Math.floor(l / 4)] |= 0x80 << (x[xLen - 2] = l << 3);
 
   for (; i < xLen; i += 16) {
     for (l = 0; l < 16; l += 4) {
@@ -49,24 +47,26 @@ let wordsMD5 = (
           (
             t1 = (
               output[oi] +
-              K[l * 4 | j] +
+              K[l * 4 + j] +
               (
                 t0 = output[++oi & 3],
                 t1 = output[++oi & 3],
                 t2 = output[++oi & 3],
                 l
-                  ? l > 4
-                    ? l > 8
-                      ? t1 ^ (t0 | ~t2)  // Round 4: I
-                      : t0 ^ t1 ^ t2     // Round 3: H
-                    : t0 & t2 | t1 & ~t2 // Round 2: G
-                  : t0 & t1 | ~t0 & t2   // Round 1: F
+                  ? t1 ^ (
+                    l > 4
+                      ? l > 8
+                        ? t0 | ~t2     // Round 4: I
+                        : t0 ^ t2      // Round 3: H
+                      : t2 & (t0 ^ t1) // Round 2: G
+                  )
+                  : t0 & t1 | ~t0 & t2 // Round 1: F
               ) +
               x[i + (j * (0x7351 >> l) + (0x0510 >> l) & 15)]
             )
           ) << (
-            t2 = "',16%).4$+07&*/5".charCodeAt(j++ & 3 | l)
-          ) | t1 >>> 64 - t2
+            t2 = "',16%).4$+07&*/5".charCodeAt(j++ & 3 | l) - 32
+          ) | t1 >>> 32 - t2
         ) + t0
       }
     }
@@ -81,7 +81,7 @@ let wordsMD5 = (
  * Convert bytes to an array of little-endian words
  *
  * @param {*} input
- * @param {number} j pad int32 length
+ * @param {number} j pad int32 length (0 or 16)
  * 
  * @returns {[Int32Array<ArrayBuffer>, number]}
  */
@@ -96,7 +96,7 @@ let inputToWords = (
   ).length,
   // Using `Array` to process inputs over 512 MiB could throw a `RangeError`,
   // so I replaced it with `Int32Array`.
-  output = new $Int32Array(floor((j * 4 + byteLen + 72) / 64) * 16),
+  output = new $Int32Array(j + $Math.ceil((byteLen + 9) / 64) * 16),
   i = 0,
 ) => {
   for (; i < byteLen;) {
@@ -125,7 +125,9 @@ var md5 = (data, key, raw) => {
   var i = 16
     , hasKey = key != null
     , [bdata, temp] = inputToWords(data, /**@type {*}*/(hasKey) * i)
-    , out = new Uint8Array(i)
+
+  /** @type {*} */
+  var out = raw ? new Uint8Array(i) : ''
 
   if (hasKey) {
     // HMAC
@@ -146,11 +148,15 @@ var md5 = (data, key, raw) => {
   bdata = wordsMD5(bdata, temp)
 
   // words to bytes or hex
-  for (; i;) {
-    out[--i] = bdata[i >> 2] >> i * 8
+  for (; i;
+    raw
+      ? out[i] = temp
+      : out = (temp >> 4 && '') + temp.toString(16) + out
+  ) {
+    temp = bdata[--i >> 2] >> i * 8 & 0xff
   }
 
-  return raw ? out : out.toHex()
+  return out
 }
 
 export default md5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tinyhmacmd5",
-  "version": "0.3.2-es2026",
-  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 952 bytes.",
+  "version": "0.3.3",
+  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 982 bytes.",
   "author": "bddjr",
   "license": "MIT",
   "type": "module",
@@ -63,7 +63,7 @@
     "typescript": "^7.0.2"
   },
   "scripts": {
-    "build": "tsc && node scripts/build.mjs && es-check es2026 --module --checkFeatures main.js browser.min.js",
+    "build": "tsc && node scripts/build.mjs && es-check es2016 --module --checkFeatures main.js browser.min.js",
     "build:unchanged": "node scripts/build-unchanged.mjs",
     "test": "pnpm build && pnpm test:only",
     "test:only": "node scripts/test.mjs && node scripts/test-513MiB.mjs",