tinyhmacmd5 0.4.2 → 0.5.0-es2026

package/LICENSE

@@ -1,22 +1,24 @@
-The MIT License
+This is free and unencumbered software released into the public domain.
 
-Copyright © 1999-2009 Paul Johnston 
-Copyright © 2011 Sebastian Tschan, https://blueimp.net
-Copyright © 2026 bddjr
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
-the Software, and to permit persons to whom the Software is furnished to do so,
-subject to the following conditions:
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+For more information, please refer to <https://unlicense.org/>

package/README.md

@@ -4,32 +4,65 @@ English | [中文](README-zh.md)
 
 A tiny and reliable HMAC-MD5 implementation for JavaScript:
 
-[`browser.min.js`](browser.min.js) is only **1007 bytes**.
+[`browser.min.js`](browser.min.js) is only **947 bytes**.
 
 - **Input type**: `string` (UTF‑8), `Uint8Array` or `Uint8ClampedArray`
 - **Output type**: hex `string` or bytes `Uint8Array`
-- **Supports inputs ≥ 512 MiB**: The input length theoretically supports 0 to 2⁵³-1 (`Number.MAX_SAFE_INTEGER`).
+- **Supports inputs ≥ 512 MiB**: The input length theoretically supports 0 to 2⁵³-137
 - **TypeScript‑ready**: [`main.d.ts`](main.d.ts)
 - **0 dependencies**
 
 **Live demo**: https://bddjr.github.io/tinyhmacmd5/
 
-`tinyhmacmd5` does not simply aim for the smallest possible size.  
-Its goal is to balance code size and runtime performance, so some performance-oriented implementations are intentionally retained.  
-As a result, the final size is not the smallest theoretically achievable.
-
 If you need a smaller implementation that targets ECMAScript 2026, see the [`es2026`](https://github.com/bddjr/tinyhmacmd5/tree/es2026) branch.
 
 > [!WARNING]  
 > MD5 is cryptographically broken and unsafe for security-sensitive applications.  
 > Do not rely on it for password hashing, digital signatures, or certificate verification.
 
+---
+
+## Benchmark
+
+```
+pnpm benchmark
+```
+
+```
+Data length: 104857600 chars (100MiB)
+--------------------------------------------------
+tinyhmacmd5     : 550.92 ms
+js-md5          : 128.96 ms
+blueimp-md5     : 3837.83 ms
+crypto-js       : 1562.08 ms
+node:crypto     : 129.08 ms
+--------------------------------------------------
+✅ All pure JS implementations match node:crypto result.
+
+--- Pure 513MiB Test (No prior small tests) ---
+tinyhmacmd5 HMAC-MD5 timer: 2.706s
+node:crypto HMAC-MD5 timer: 547.808ms
+tinyhmacmd5 MD5 timer: 2.693s
+node:crypto MD5 timer: 550.144ms
+```
+
+CPU: i5-10600KF  
+DRAM: 64GiB DDR4 3333MT/s  
+OS: Windows 11 Pro for Workstations 25H2 26200.8737  
+Node.js: v26.8.1
+
+`tinyhmacmd5` does not simply aim for the smallest possible size.  
+Its goal is to balance code size and runtime performance, so some performance-oriented implementations are intentionally retained.  
+As a result, the final size is not the smallest theoretically achievable.
+
+---
+
 ## Setup
 
 ### npm
 
 ```
-npm i tinyhmacmd5
+npm i tinyhmacmd5@es2026
 ```
 
 ```js
@@ -45,7 +78,7 @@ You can also use other package managers (e.g. `pnpm` or `yarn`) in place of `npm
 See https://www.jsdelivr.com/package/npm/tinyhmacmd5
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5"></script>
+<script src="https://cdn.jsdelivr.net/npm/tinyhmacmd5@es2026"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -53,7 +86,7 @@ It will define the `md5` function using `var`.
 ### UNPKG
 
 ```html
-<script src="https://unpkg.com/tinyhmacmd5"></script>
+<script src="https://unpkg.com/tinyhmacmd5@es2026"></script>
 ```
 
 It will define the `md5` function using `var`.
@@ -67,10 +100,6 @@ It will define the `md5` function using `var`.
 
 ## Example
 
-> [!NOTE]  
-> Please ensure that the input type matches the definition in [`main.d.ts`](main.d.ts).  
-> Invalid types may return an incorrect MD5 hash.
-
 HMAC-MD5:
 
 ```js
@@ -144,88 +173,30 @@ md5(data)
 
 ## Runtime Environment
 
-Environments that support [Exponentiation (`**`)](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Operators/Exponentiation) and [`TextEncoder`](https://developer.mozilla.org/docs/Web/API/TextEncoder) :
+Environments that support [`Uint8Array.prototype.toHex()`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array/toHex) :
 
 - Desktop
-  - Chrome ≥ 52 (2016-07-20)
-  - Edge ≥ 79 (2020-01-15)
-  - Firefox ≥ 52 (2017-03-07)
-  - Opera ≥ 39 (2016-08-02)
-  - Safari ≥ 10.1 (2017-03-27)
+  - Chrome ≥ 140 (2025-09-02)
+  - Edge ≥ 140 (2025-09-05)
+  - Firefox ≥ 133 (2024-11-26)
+  - Opera ≥ 124 (2025-11-13)
+  - Safari ≥ 18.2 (2024-12-11)
 - Mobile
-  - Chrome Android ≥ 52 (2016-07-27)
-  - Firefox for Android ≥ 52 (2017-03-07)
-  - Opera Android ≥ 41 (2016-10-25)
-  - Safari on iOS ≥ 10.3 (2017-03-27)
-  - Samsung Browser ≥ 6 (2017-08-23)
-  - WebView Android ≥ 51 (2016-06-08)
-  - WebView on iOS ≥ 10.3 (2017-03-27)
+  - Chrome Android ≥ 140 (2025-09-02)
+  - Firefox for Android ≥ 133 (2024-11-26)
+  - Opera Android ≥ 92 (2025-10-08)
+  - Safari on iOS ≥ 18.2 (2024-12-11)
+  - Samsung Browser ×
+  - WebView Android ≥ 140 (2025-09-02)
+  - WebView on iOS ≥ 18.2 (2024-12-11)
 
 Not recommended for use in environments that support `node:crypto`, as `node:crypto` already provides HMAC-MD5.
 
 ---
 
-## Benchmark
-
-```
-pnpm benchmark
-```
-
-```
-Data length: 104857600 chars (100MiB)
---------------------------------------------------
-tinyhmacmd5     : 550.92 ms
-js-md5          : 128.96 ms
-blueimp-md5     : 3837.83 ms
-crypto-js       : 1562.08 ms
-node:crypto     : 129.08 ms
---------------------------------------------------
-✅ All pure JS implementations match node:crypto result.
-
---- Pure 513MiB Test (No prior small tests) ---
-tinyhmacmd5 HMAC-MD5 timer: 2.706s
-node:crypto HMAC-MD5 timer: 547.808ms
-tinyhmacmd5 MD5 timer: 2.693s
-node:crypto MD5 timer: 550.144ms
-```
-
-CPU: i5-10600KF  
-DRAM: 64GiB DDR4 3333MT/s  
-OS: Windows 11 Pro for Workstations 25H2 26200.8737  
-Node.js: v26.8.1
-
----
-
-## Why I Made This Project
-
-I initially used HMAC-MD5 just to call a certain website's API. That site signs the request body with `crypto-js`'s HMAC-MD5 to make reverse engineering harder.
-
-But I only needed HMAC-MD5. Depending on `crypto-js` felt way too bloated. The Web Crypto API doesn't support HMAC-MD5, so I had no choice but to drag in a dependency.
-
-Then I found `blueimp-md5`. Its `md5.min.js` is only 3750 bytes, even smaller than `js-md5`.
-
-But I felt `blueimp-md5` was still far too bloated. It has some completely unnecessary design choices—it repeatedly parses strings and creates new ones, adding a lot of unnecessary overhead.
-
-So I decided to adapt it, use a more modern implementation, and shrink the size even further. That's how `tinyhmacmd5` was born.
-
-During the adaptation, I discovered that `blueimp-md5` did not correctly handle the 64-bit length field required by MD5 when the input bit-length exceeded 32 bits. It wrote only the low 32 bits and ignored the high 32 bits. I fixed this bug.
-
-I also found that using `Array` to process inputs over 512 MiB could throw a `RangeError`, so I replaced it with `Int32Array`.
-
-I demonstrated in practice that HMAC-MD5 can be implemented in an extremely small footprint (1007 bytes) while also improving reliability.
-
-Maybe not many people care about saving just a few KB, but `tinyhmacmd5` exists precisely to "explore the unknown".
-
-INVINCIBLE EXPERIMENT!
-
-[Read the original Chinese text](README-zh.md#为什么做这个项目)
-
----
-
 ## License
 
-The MIT License  
-See: [`LICENSE`](LICENSE)
+This project is released into the public domain under the [Unlicense](https://unlicense.org).
 
 ---
 

package/browser.min.js

@@ -1 +1 @@
-/*! npmjs.com/tinyhmacmd5 */{let e=Int32Array,r=Uint8Array,n=new e(64).map((e,r)=>2**32*Math.abs(Math.sin(r+1))),t=1&new r(n.buffer)[3],f=(r,t,f=0,o,a=1732584193,w=271733878,l,u,h=r.length,i=e.of(a,~w,~a,w),s=new e(i))=>{for(r[h-1]=t/2**29,r[(t-t%4)/4]|=128<<(r[h-2]=t<<3);f<h;f+=16){for(t=o=0;t<16;t+=4)for(;o<4*t+16;)i[u&=3]=((w=i[u]+n[o]+(a=i[3&++u],w=i[3&++u],l=i[3&++u],w^(t>4?t>8?a|~l:a^l:t?l&(a^w):~a&(w^l)))+r[f+(o*(29521>>t)+(1296>>t)&15)])<<(l="',16%).4$+07&*/5".charCodeAt(3&o++|t))|w>>>32-l)+a;for(;u;)s[--u]=i[u]+=s[u]}return i},o=(n,f,o=("string"==typeof n?n=(new TextEncoder).encode(n):n).length,a=new e(f+18+(o-(o+8&63))/4),w=t&&new r(a.buffer,4*f).set(n))=>{for(;w<o;3&++w||f++)a[f]|=n[w]<<8*w;return[a,o]};var md5=(n,t,a)=>{var w=16,l=null!=t,[u,h]=o(n,l*w),i=a?new r(w):"";if(l){let[r,n]=o(t,0),a=new e(32);for(n>64&&(r=f(r,n)),n=w;n;)a[--n]=1785358954^(u[n]=909522486^r[n]);a.set(f(u,64+h),w),u=a,h=80}for(u=f(u,h);w;a?i[w]=h:i=(h>>4&&"")+h.toString(16)+i)h=u[--w>>2]>>8*w&255;return i}}
+{let e=Int32Array,r=Uint8Array,n=new e(64).map((e,r)=>2**32*Math.abs(Math.sin(r+1))),t=1&new r(n.buffer)[3],f=(r,t,f=0,o,a=1732584193,w=271733878,l,u,h=r.length,s=e.of(a,~w,~a,w),d=new e(s))=>{for(r[h-1]=t/2**29,r[(t-t%4)/4]|=128<<(r[h-2]=t<<3);f<h;f+=16){for(t=o=0;t<16;t+=4)for(;o<4*t+16;)s[u&=3]=((w=s[u]+n[o]+(a=s[3&++u],w=s[3&++u],l=s[3&++u],w^(t>4?t>8?a|~l:a^l:t?l&(a^w):~a&(w^l)))+r[f+(o*(29521>>t)+(1296>>t)&15)])<<(l="',16%).4$+07&*/5".charCodeAt(3&o++|t))|w>>>32-l)+a;for(;u;)d[--u]=s[u]+=d[u]}return s},o=(n,f,o=("string"==typeof n?n=(new TextEncoder).encode(n):n).length,a=new e(f+18+(o-(o+8&63))/4),w=t&&new r(a.buffer,4*f).set(n))=>{for(;w<o;3&++w||f++)a[f]|=n[w]<<8*w;return[a,o]};var md5=(n,t,a)=>{var w=16,l=null!=t,[u,h]=o(n,l*w),s=new r(w);if(l){let[r,n]=o(t,0),a=new e(32);for(n>64&&(r=f(r,n)),n=w;n;)a[--n]=1785358954^(u[n]=909522486^r[n]);a.set(f(u,64+h),w),u=a,h=80}for(u=f(u,h);w;)s[--w]=u[w>>2]>>8*w;return a?s:s.toHex()}}

package/main.js

@@ -1,7 +1,3 @@
-/*! npmjs.com/tinyhmacmd5 */
-
-// Adapted from https://github.com/blueimp/JavaScript-MD5
-
 let $Int32Array = Int32Array
 
 let $Uint8Array = Uint8Array
@@ -125,13 +121,11 @@ let inputToWords = (
  * @param {boolean} [raw] If true, the hash is returned as raw bytes (Uint8Array); otherwise, as a hex string.
  * @returns {string | Uint8Array<ArrayBuffer>} The MD5 (or HMAC‑MD5) digest, either as a hex string or a Uint8Array.
  */
-var md5 = (data, key, raw) => {
+let md5 = (data, key, raw) => {
   var i = 16
     , hasKey = key != null
     , [bdata, temp] = inputToWords(data, /**@type {*}*/(hasKey) * i)
-
-  /** @type {*} */
-  var out = raw ? new $Uint8Array(i) : ''
+    , out = new $Uint8Array(i)
 
   if (hasKey) {
     // HMAC
@@ -152,15 +146,11 @@ var md5 = (data, key, raw) => {
   bdata = wordsMD5(bdata, temp)
 
   // words to bytes or hex
-  for (; i;
-    raw
-      ? out[i] = temp
-      : out = (temp >> 4 && '') + temp.toString(16) + out
-  ) {
-    temp = bdata[--i >> 2] >> i * 8 & 0xff
+  for (; i;) {
+    out[--i] = bdata[i >> 2] >> i * 8
   }
 
-  return out
+  return raw ? out : out.toHex()
 }
 
 export default md5

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "tinyhmacmd5",
-  "version": "0.4.2",
-  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 1007 bytes.",
+  "version": "0.5.0-es2026",
+  "description": "A tiny and reliable HMAC-MD5 implementation for JavaScript: browser.min.js is only 947 bytes.",
   "author": "bddjr",
-  "license": "MIT",
+  "license": "Unlicense",
   "type": "module",
   "main": "main.js",
   "types": "main.d.ts",
@@ -63,7 +63,7 @@
     "typescript": "^7.0.2"
   },
   "scripts": {
-    "build": "tsc && node scripts/build.mjs && es-check es2016 --module --checkFeatures main.js browser.min.js",
+    "build": "tsc && node scripts/build.mjs && es-check es2026 --module --checkFeatures main.js browser.min.js",
     "build:unchanged": "node scripts/build-unchanged.mjs",
     "test": "pnpm build && pnpm test:only",
     "test:only": "node scripts/test.mjs && node scripts/test-513MiB.mjs",