tinyhmacmd5 0.4.2-es2026 → 0.4.2

package/README.md

@@ -4,7 +4,7 @@ English | [中文](README-zh.md)
 
 A tiny and reliable HMAC-MD5 implementation for JavaScript:
 
-[`browser.min.js`](browser.min.js) is only **975 bytes**.
+[`browser.min.js`](browser.min.js) is only **1007 bytes**.
 
 - **Input type**: `string` (UTF‑8), `Uint8Array` or `Uint8ClampedArray`
 - **Output type**: hex `string` or bytes `Uint8Array`
@@ -12,10 +12,14 @@ A tiny and reliable HMAC-MD5 implementation for JavaScript:
 - **TypeScript‑ready**: [`main.d.ts`](main.d.ts)
 - **0 dependencies**
 
+**Live demo**: https://bddjr.github.io/tinyhmacmd5/
+
 `tinyhmacmd5` does not simply aim for the smallest possible size.  
 Its goal is to balance code size and runtime performance, so some performance-oriented implementations are intentionally retained.  
 As a result, the final size is not the smallest theoretically achievable.
 
+If you need a smaller implementation that targets ECMAScript 2026, see the [`es2026`](https://github.com/bddjr/tinyhmacmd5/tree/es2026) branch.
+
 > [!WARNING]  
 > MD5 is cryptographically broken and unsafe for security-sensitive applications.  
 > Do not rely on it for password hashing, digital signatures, or certificate verification.
@@ -25,7 +29,7 @@ As a result, the final size is not the smallest theoretically achievable.
 ### npm
 
 ```
-npm i tinyhmacmd5@es2026
+npm i tinyhmacmd5
 ```
 
 ```js
@@ -41,7 +45,7 @@ You can also use other package managers (e.g. `pnpm` or `yarn`) in place of `npm
 See https://www.jsdelivr.com/package/npm/tinyhmacmd5
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5@es2026"></script>
+<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -49,7 +53,7 @@ It will define the `md5` function using `var`.
 ### UNPKG
 
 ```html
-<script src="https://unpkg.com/tinyhmacmd5@es2026"></script>
+<script src="https://unpkg.com/tinyhmacmd5"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -140,22 +144,22 @@ md5(data)
 
 ## Runtime Environment
 
-Environments that support [`Uint8Array.prototype.toHex()`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array/toHex) :
+Environments that support [Exponentiation (`**`)](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Operators/Exponentiation) and [`TextEncoder`](https://developer.mozilla.org/docs/Web/API/TextEncoder) :
 
 - Desktop
-  - Chrome ≥ 140 (2025-09-02)
-  - Edge ≥ 140 (2025-09-05)
-  - Firefox ≥ 133 (2024-11-26)
-  - Opera ≥ 124 (2025-11-13)
-  - Safari ≥ 18.2 (2024-12-11)
+  - Chrome ≥ 52 (2016-07-20)
+  - Edge ≥ 79 (2020-01-15)
+  - Firefox ≥ 52 (2017-03-07)
+  - Opera ≥ 39 (2016-08-02)
+  - Safari ≥ 10.1 (2017-03-27)
 - Mobile
-  - Chrome Android ≥ 140 (2025-09-02)
-  - Firefox for Android ≥ 133 (2024-11-26)
-  - Opera Android ≥ 92 (2025-10-08)
-  - Safari on iOS ≥ 18.2 (2024-12-11)
-  - Samsung Browser ×
-  - WebView Android ≥ 140 (2025-09-02)
-  - WebView on iOS ≥ 18.2 (2024-12-11)
+  - Chrome Android ≥ 52 (2016-07-27)
+  - Firefox for Android ≥ 52 (2017-03-07)
+  - Opera Android ≥ 41 (2016-10-25)
+  - Safari on iOS ≥ 10.3 (2017-03-27)
+  - Samsung Browser ≥ 6 (2017-08-23)
+  - WebView Android ≥ 51 (2016-06-08)
+  - WebView on iOS ≥ 10.3 (2017-03-27)
 
 Not recommended for use in environments that support `node:crypto`, as `node:crypto` already provides HMAC-MD5.
 
@@ -208,7 +212,7 @@ During the adaptation, I discovered that `blueimp-md5` did not correctly handle
 
 I also found that using `Array` to process inputs over 512 MiB could throw a `RangeError`, so I replaced it with `Int32Array`.
 
-I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (975 bytes) while also improving reliability.
+I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (1007 bytes) while also improving reliability.
 
 Maybe not many people care about saving just a few KB, but `tinyhmacmd5` exists precisely to "explore the unknown".
 

package/browser.min.js

@@ -1 +1 @@
-/*! npmjs.com/tinyhmacmd5 */{let e=Int32Array,r=Uint8Array,n=new e(64).map((e,r)=>2**32*Math.abs(Math.sin(r+1))),t=1&new r(n.buffer)[3],f=(r,t,f=0,o,a=1732584193,w=271733878,l,u,h=r.length,s=e.of(a,~w,~a,w),d=new e(s))=>{for(r[h-1]=t/2**29,r[(t-t%4)/4]|=128<<(r[h-2]=t<<3);f<h;f+=16){for(t=o=0;t<16;t+=4)for(;o<4*t+16;)s[u&=3]=((w=s[u]+n[o]+(a=s[3&++u],w=s[3&++u],l=s[3&++u],w^(t>4?t>8?a|~l:a^l:t?l&(a^w):~a&(w^l)))+r[f+(o*(29521>>t)+(1296>>t)&15)])<<(l="',16%).4$+07&*/5".charCodeAt(3&o++|t))|w>>>32-l)+a;for(;u;)d[--u]=s[u]+=d[u]}return s},o=(n,f,o=("string"==typeof n?n=(new TextEncoder).encode(n):n).length,a=new e(f+18+(o-(o+8&63))/4),w=t&&new r(a.buffer,4*f).set(n))=>{for(;w<o;3&++w||f++)a[f]|=n[w]<<8*w;return[a,o]};var md5=(n,t,a)=>{var w=16,l=null!=t,[u,h]=o(n,l*w),s=new r(w);if(l){let[r,n]=o(t,0),a=new e(32);for(n>64&&(r=f(r,n)),n=w;n;)a[--n]=1785358954^(u[n]=909522486^r[n]);a.set(f(u,64+h),w),u=a,h=80}for(u=f(u,h);w;)s[--w]=u[w>>2]>>8*w;return a?s:s.toHex()}}
+/*! npmjs.com/tinyhmacmd5 */{let e=Int32Array,r=Uint8Array,n=new e(64).map((e,r)=>2**32*Math.abs(Math.sin(r+1))),t=1&new r(n.buffer)[3],f=(r,t,f=0,o,a=1732584193,w=271733878,l,u,h=r.length,i=e.of(a,~w,~a,w),s=new e(i))=>{for(r[h-1]=t/2**29,r[(t-t%4)/4]|=128<<(r[h-2]=t<<3);f<h;f+=16){for(t=o=0;t<16;t+=4)for(;o<4*t+16;)i[u&=3]=((w=i[u]+n[o]+(a=i[3&++u],w=i[3&++u],l=i[3&++u],w^(t>4?t>8?a|~l:a^l:t?l&(a^w):~a&(w^l)))+r[f+(o*(29521>>t)+(1296>>t)&15)])<<(l="',16%).4$+07&*/5".charCodeAt(3&o++|t))|w>>>32-l)+a;for(;u;)s[--u]=i[u]+=s[u]}return i},o=(n,f,o=("string"==typeof n?n=(new TextEncoder).encode(n):n).length,a=new e(f+18+(o-(o+8&63))/4),w=t&&new r(a.buffer,4*f).set(n))=>{for(;w<o;3&++w||f++)a[f]|=n[w]<<8*w;return[a,o]};var md5=(n,t,a)=>{var w=16,l=null!=t,[u,h]=o(n,l*w),i=a?new r(w):"";if(l){let[r,n]=o(t,0),a=new e(32);for(n>64&&(r=f(r,n)),n=w;n;)a[--n]=1785358954^(u[n]=909522486^r[n]);a.set(f(u,64+h),w),u=a,h=80}for(u=f(u,h);w;a?i[w]=h:i=(h>>4&&"")+h.toString(16)+i)h=u[--w>>2]>>8*w&255;return i}}

package/main.js

@@ -129,7 +129,9 @@ var md5 = (data, key, raw) => {
   var i = 16
     , hasKey = key != null
     , [bdata, temp] = inputToWords(data, /**@type {*}*/(hasKey) * i)
-    , out = new $Uint8Array(i)
+
+  /** @type {*} */
+  var out = raw ? new $Uint8Array(i) : ''
 
   if (hasKey) {
     // HMAC
@@ -150,11 +152,15 @@ var md5 = (data, key, raw) => {
   bdata = wordsMD5(bdata, temp)
 
   // words to bytes or hex
-  for (; i;) {
-    out[--i] = bdata[i >> 2] >> i * 8
+  for (; i;
+    raw
+      ? out[i] = temp
+      : out = (temp >> 4 && '') + temp.toString(16) + out
+  ) {
+    temp = bdata[--i >> 2] >> i * 8 & 0xff
   }
 
-  return raw ? out : out.toHex()
+  return out
 }
 
 export default md5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tinyhmacmd5",
-  "version": "0.4.2-es2026",
-  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 975 bytes.",
+  "version": "0.4.2",
+  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 1007 bytes.",
   "author": "bddjr",
   "license": "MIT",
   "type": "module",
@@ -63,7 +63,7 @@
     "typescript": "^7.0.2"
   },
   "scripts": {
-    "build": "tsc && node scripts/build.mjs && es-check es2026 --module --checkFeatures main.js browser.min.js",
+    "build": "tsc && node scripts/build.mjs && es-check es2016 --module --checkFeatures main.js browser.min.js",
     "build:unchanged": "node scripts/build-unchanged.mjs",
     "test": "pnpm build && pnpm test:only",
     "test:only": "node scripts/test.mjs && node scripts/test-513MiB.mjs",