tinyhmacmd5 0.4.0 → 0.4.1-es2026

package/README.md

@@ -2,7 +2,7 @@ English | [中文](README-zh.md)
 
 # Tiny HMAC MD5
 
-A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](browser.min.js) is only **1021 bytes**.
+A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](browser.min.js) is only **982 bytes**.
 
 - **Input type**: `string` (UTF‑8), `Uint8Array` or `Uint8ClampedArray`
 - **Output type**: hex `string` or bytes `Uint8Array`
@@ -10,14 +10,10 @@ A tiny and reliable HMAC-MD5 implementation for JavaScript: [`browser.min.js`](b
 - **TypeScript‑ready**: [`main.d.ts`](main.d.ts)
 - **0 dependencies**
 
-**Live demo**: https://bddjr.github.io/tinyhmacmd5/
-
 `tinyhmacmd5` does not simply aim for the smallest possible size.  
 Its goal is to balance code size and runtime performance, so some performance-oriented implementations are intentionally retained.  
 As a result, the final size is not the smallest theoretically achievable.
 
-If you need a smaller implementation that targets ECMAScript 2026, see the [`es2026`](https://github.com/bddjr/tinyhmacmd5/tree/es2026) branch.
-
 > [!WARNING]  
 > MD5 is cryptographically broken and unsafe for security-sensitive applications.  
 > Do not rely on it for password hashing, digital signatures, or certificate verification.
@@ -27,7 +23,7 @@ If you need a smaller implementation that targets ECMAScript 2026, see the [`es2
 ### npm
 
 ```
-npm i tinyhmacmd5
+npm i tinyhmacmd5@es2026
 ```
 
 ```js
@@ -43,7 +39,7 @@ You can also use other package managers (e.g. `pnpm` or `yarn`) in place of `npm
 See https://www.jsdelivr.com/package/npm/tinyhmacmd5
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5"></script>
+<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5@es2026"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -51,7 +47,7 @@ It will define the `md5` function using `var`.
 ### UNPKG
 
 ```html
-<script src="https://unpkg.com/tinyhmacmd5"></script>
+<script src="https://unpkg.com/tinyhmacmd5@es2026"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -142,22 +138,22 @@ md5(data)
 
 ## Runtime Environment
 
-Environments that support [Exponentiation (`**`)](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Operators/Exponentiation) and [`TextEncoder`](https://developer.mozilla.org/docs/Web/API/TextEncoder) :
+Environments that support [`Uint8Array.prototype.toHex()`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array/toHex) :
 
 - Desktop
-  - Chrome ≥ 52 (2016-07-20)
-  - Edge ≥ 79 (2020-01-15)
-  - Firefox ≥ 52 (2017-03-07)
-  - Opera ≥ 39 (2016-08-02)
-  - Safari ≥ 10.1 (2017-03-27)
+  - Chrome ≥ 140 (2025-09-02)
+  - Edge ≥ 140 (2025-09-05)
+  - Firefox ≥ 133 (2024-11-26)
+  - Opera ≥ 124 (2025-11-13)
+  - Safari ≥ 18.2 (2024-12-11)
 - Mobile
-  - Chrome Android ≥ 52 (2016-07-27)
-  - Firefox for Android ≥ 52 (2017-03-07)
-  - Opera Android ≥ 41 (2016-10-25)
-  - Safari on iOS ≥ 10.3 (2017-03-27)
-  - Samsung Browser ≥ 6 (2017-08-23)
-  - WebView Android ≥ 51 (2016-06-08)
-  - WebView on iOS ≥ 10.3 (2017-03-27)
+  - Chrome Android ≥ 140 (2025-09-02)
+  - Firefox for Android ≥ 133 (2024-11-26)
+  - Opera Android ≥ 92 (2025-10-08)
+  - Safari on iOS ≥ 18.2 (2024-12-11)
+  - Samsung Browser ×
+  - WebView Android ≥ 140 (2025-09-02)
+  - WebView on iOS ≥ 18.2 (2024-12-11)
 
 Not recommended for use in environments that support `node:crypto`, as `node:crypto` already provides HMAC-MD5.
 
@@ -172,19 +168,19 @@ pnpm benchmark
 ```
 Data length: 104857600 chars (100MiB)
 --------------------------------------------------
-tinyhmacmd5     : 569.00 ms
-js-md5          : 130.30 ms
-blueimp-md5     : 3851.57 ms
-crypto-js       : 1561.18 ms
-node:crypto     : 130.29 ms
+tinyhmacmd5     : 568.29 ms
+js-md5          : 130.97 ms
+blueimp-md5     : 3835.78 ms
+crypto-js       : 1560.48 ms
+node:crypto     : 130.22 ms
 --------------------------------------------------
 ✅ All pure JS implementations match node:crypto result.
 
 --- Pure 513MiB Test (No prior small tests) ---
-tinyhmacmd5 HMAC-MD5 timer: 2.796s
-node:crypto HMAC-MD5 timer: 552.718ms
-tinyhmacmd5 MD5 timer: 2.775s
-node:crypto MD5 timer: 551.291ms
+tinyhmacmd5 HMAC-MD5 timer: 2.789s
+node:crypto HMAC-MD5 timer: 552.479ms
+tinyhmacmd5 MD5 timer: 2.778s
+node:crypto MD5 timer: 550.663ms
 ```
 
 CPU: i5-10600KF  
@@ -210,7 +206,7 @@ During the adaptation, I discovered that `blueimp-md5` did not correctly handle
 
 I also found that using `Array` to process inputs over 512 MiB could throw a `RangeError`, so I replaced it with `Int32Array`.
 
-I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (1021 bytes) while also improving reliability.
+I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (982 bytes) while also improving reliability.
 
 Maybe not many people care about saving just a few KB, but `tinyhmacmd5` exists precisely to "explore the unknown".
 

package/browser.min.js

@@ -1 +1 @@
-/*! npmjs.com/tinyhmacmd5 */{let e=Math,r=Int32Array,n=Uint8Array,t=new r(64).map((r,n)=>2**32*e.abs(e.sin(n+1))),f=new n(t.buffer)[28]<2,o=(n,f,o=0,a,l=1732584193,w=271733878,i,u,s=n.length,c=r.of(l,~w,~l,w),d=new r(c))=>{for(n[s-1]=f/2**29,n[e.floor(f/4)]|=128<<(n[s-2]=f<<3);o<s;o+=16){for(f=0;f<16;f+=4)for(a=0;a<16;)c[u&=3]=((w=c[u]+t[4*f+a]+(l=c[3&++u],w=c[3&++u],i=c[3&++u],w^(f>4?f>8?l|~i:l^i:f?i&(l^w):~l&(w^i)))+n[o+(a*(29521>>f)+(1296>>f)&15)])<<(i="',16%).4$+07&*/5".charCodeAt(3&a++|f))|w>>>32-i)+l;for(;u;)d[--u]=c[u]+=d[u]}return c},a=(t,o,a=("string"==typeof t?t=(new TextEncoder).encode(t):t).length,l=new r(o+16*e.ceil((a+9)/64)),w=new n(l.buffer),i)=>{for(f?w.set(t,4*o):i=0;i<a;3&++i||o++)l[o]|=t[i]<<8*i;return[l,a]};var md5=(e,t,f)=>{var l=16,w=null!=t,[i,u]=a(e,w*l),s=f?new n(l):"";if(w){let[e,n]=a(t,0),f=new r(32);for(n>64&&(e=o(e,n)),n=l;n;)f[--n]=1785358954^(i[n]=909522486^e[n]);f.set(o(i,64+u),l),i=f,u=80}for(i=o(i,u);l;f?s[l]=u:s=(u>>4&&"")+u.toString(16)+s)u=i[--l>>2]>>8*l&255;return s}}
+/*! npmjs.com/tinyhmacmd5 */{let e=Math,r=Int32Array,n=Uint8Array,t=new r(64).map((r,n)=>2**32*e.abs(e.sin(n+1))),f=1&new n(t.buffer)[3],o=(n,f,o=0,a,l=1732584193,w=271733878,u,i,s=n.length,c=r.of(l,~w,~l,w),d=new r(c))=>{for(n[s-1]=f/2**29,n[e.floor(f/4)]|=128<<(n[s-2]=f<<3);o<s;o+=16){for(f=0;f<16;f+=4)for(a=0;a<16;)c[i&=3]=((w=c[i]+t[4*f+a]+(l=c[3&++i],w=c[3&++i],u=c[3&++i],w^(f>4?f>8?l|~u:l^u:f?u&(l^w):~l&(w^u)))+n[o+(a*(29521>>f)+(1296>>f)&15)])<<(u="',16%).4$+07&*/5".charCodeAt(3&a++|f))|w>>>32-u)+l;for(;i;)d[--i]=c[i]+=d[i]}return c},a=(t,o,a=("string"==typeof t?t=(new TextEncoder).encode(t):t).length,l=new r(o+16*e.ceil((a+9)/64)),w=f&&new n(l.buffer,4*o).set(t))=>{for(;w<a;3&++w||o++)l[o]|=t[w]<<8*w;return[l,a]};var md5=(e,t,f)=>{var l=16,w=null!=t,[u,i]=a(e,w*l),s=new n(l);if(w){let[e,n]=a(t,0),f=new r(32);for(n>64&&(e=o(e,n)),n=l;n;)f[--n]=1785358954^(u[n]=909522486^e[n]);f.set(o(u,64+i),l),u=f,i=80}for(u=o(u,i);l;)s[--l]=u[l>>2]>>8*l;return f?s:s.toHex()}}

package/main.js

@@ -12,7 +12,7 @@ let $Uint8Array = Uint8Array
 let K = new $Int32Array(64).map((v, i) => 2 ** 32 * $Math.abs($Math.sin(i + 1)))
 
 /** is little-endian */
-let isLE = new $Uint8Array(K.buffer)[28] < 2
+let isLE = new $Uint8Array(K.buffer)[3] & 1
 
 /**
  * Calculate the MD5 of an array of little-endian words, and a byte length.
@@ -89,7 +89,7 @@ let wordsMD5 = (
  * @param {*} input
  * @param {number} j pad int32 length (0 or 16)
  * 
- * @param {number} [i]
+ * @param {*} [i]
  * 
  * @returns {[Int32Array<ArrayBuffer>, number]}
  */
@@ -105,13 +105,9 @@ let inputToWords = (
   // Using `Array` to process inputs over 512 MiB could throw a `RangeError`,
   // so I replaced it with `Int32Array`.
   output = new $Int32Array(j + $Math.ceil((byteLen + 9) / 64) * 16),
-  outputBytes = new $Uint8Array(output.buffer),
-  i,
-) => {
   // (fast) little-endian
-  isLE
-    ? outputBytes.set(input, j * 4)
-    : i = 0
+  i = isLE && new $Uint8Array(output.buffer, j * 4).set(input),
+) => {
   // (slow) big-endian
   for (; i < byteLen; ++i & 3 || j++) {
     output[j] |= input[i] << 8 * i
@@ -134,9 +130,7 @@ var md5 = (data, key, raw) => {
   var i = 16
     , hasKey = key != null
     , [bdata, temp] = inputToWords(data, /**@type {*}*/(hasKey) * i)
-
-  /** @type {*} */
-  var out = raw ? new $Uint8Array(i) : ''
+    , out = new $Uint8Array(i)
 
   if (hasKey) {
     // HMAC
@@ -157,15 +151,11 @@ var md5 = (data, key, raw) => {
   bdata = wordsMD5(bdata, temp)
 
   // words to bytes or hex
-  for (; i;
-    raw
-      ? out[i] = temp
-      : out = (temp >> 4 && '') + temp.toString(16) + out
-  ) {
-    temp = bdata[--i >> 2] >> i * 8 & 0xff
+  for (; i;) {
+    out[--i] = bdata[i >> 2] >> i * 8
   }
 
-  return out
+  return raw ? out : out.toHex()
 }
 
 export default md5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tinyhmacmd5",
-  "version": "0.4.0",
-  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 1021 bytes.",
+  "version": "0.4.1-es2026",
+  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 982 bytes.",
   "author": "bddjr",
   "license": "MIT",
   "type": "module",
@@ -63,7 +63,7 @@
     "typescript": "^7.0.2"
   },
   "scripts": {
-    "build": "tsc && node scripts/build.mjs && es-check es2016 --module --checkFeatures main.js browser.min.js",
+    "build": "tsc && node scripts/build.mjs && es-check es2026 --module --checkFeatures main.js browser.min.js",
     "build:unchanged": "node scripts/build-unchanged.mjs",
     "test": "pnpm build && pnpm test:only",
     "test:only": "node scripts/test.mjs && node scripts/test-513MiB.mjs",