Version 3.1.3 - Sep 24, 2025

This release fixes a bug with base64 codecs when ext-sodium installed.

What's Changed

    FIX: Trim padding characters from encoded string before calling sodium decode by @peldax in #67
    Update .gitattributes for psalm files by @erikn69 in #68
    Revert #67 and fix padding stripping by @paragonie-security in #69
    Add test case to prevent regressions by @paragonie-security in #70

Version 3.1.2 - Sep 24, 2025

Thanks @TimWolla for identifying a performance hit caused by attempting to find global functions such as strlen() in the current namespace before the global namespace.

What's Changed

    Improve sodium implementation performance by @TimWolla in #64
    Replace qualifiers with imports by @paragonie-security in #65

Version 3.1.1 - Sep 22, 2025

What's Changed

    Remove mbstring.func_overload compatibility layer by @TimWolla in #58
    Fixed #27 by making the test less redundant.

Version 3.1.0 - Sep 22, 2025

Important: If you enable ext-sodium, some codecs will now be faster with our library: hex, base64, base64url. This requires the actual extension be installed; sodium_compat will not provide these implementations.

As with the recent sodium_compat release, this library now incorporates fuzz-testing and mutation testing as part of our development strategy. Fuzz testing is enabled on pull requests; mutation tests on releases.

The current metrics for a mutation test run (using the latest version of Infection):

 1782 mutations were generated:
    1470 mutants were killed by Test Framework
     296 covered mutants were not detected
       5 errors were encountered
      11 time outs were encountered
Metrics:
         Mutation Code Coverage: 100%
         Covered Code MSI: 83%

We set the minimum MSI for covered code to 80% by policy, but will slowly be increasing it in future releases.

What's Changed

    Add parameter type to Base32::doEncode()’s $pad parameter by @TimWolla in #60
    Re-enable CI for Pull Requests by @TimWolla in #59
    Use ext-sodium (if available) to accelerate performance. by @paragonie-security in #61
    Test improvements (+PHP 8.5) by @paragonie-security in #62

Version 3.0.0 - May 8, 2024

    New major bump due to increased minimum PHP requirements (from PHP 7 to PHP 8)
    Supports PHP 8.4 without deprecation warnings for implicit null

Version 2.7.0 - May 8, 2024

    Apply PHP 8.2's SensitiveParameter attribute to all string parameters by @TimWolla in #48
    Remove obsolete psalm suppressions by @TimWolla in #47
    Fix typo by @krsriq in #51
    Add PHP 8.2 to ci.yml by @TimWolla in #49
    Make CanonicalTrait::getNextChar() an abstract method instead a `@m… by @TimWolla in #54
    Make PHPUnit data providers static by @TimWolla in #53
    Add PHP 8.3 to ci.yml by @TimWolla in #52
    chore: fix ci deprecations by @Chris53897 in #57
    Fix: unreachable code typo by @Grundik in #56

New Contributors

    @krsriq made their first contribution in #51
    @Chris53897 made their first contribution in #57
    @Grundik made their first contribution in #56

Version 2.6.3 - Jun 14, 2022

    #40 - Improved performance of Hex
    #43 / #46 - Add .gitattributes to .gitattributes
    #41 - Consistent use of \ global namespace qualifiers


Version 2.6.2 - Jun 13, 2022

    #45 Fix regression from 2.6.1


Version 2.6.1 - Jun 11, 2022

    Fix #44 - Thanks @HacKanCuBa!


Version 2.6.0 - Jun 10, 2022

    Resolved #22 by fixing the behavior of strict mode (decode($str, true)).
    Added decodeNoPadding() to Base32, Base64, and its child classes.
        This is a strict variant of the encoding that doesn't accept = padding at all.


Version 2.5.0 - Jan 17, 2022

    Switched from Travis CI to GitHub Actions
    Fix parameter names for PHP 8
    Cover PHP 8.1+ in unit testing


Version 2.4.0 - Dec 6, 2020

    #25 - Fixed exception message
    Support PHP 8


Version 2.3.0 - Nov 5, 2019

    Supports PHP 7.3, 7.4, and 8.x (currently only for testing against the master branch in Travis CI)


Version 2.2.2 - Mar 10, 2018

    This library now has 100% type-safety.
    Added unit tests to detect string truncation bugs that were (mistakenly?) reported.


Version 2.2.1 - Jan 22, 2018

    Fix a pasto reported by Ed Barnard on Twitter.


Version 2.2.0 - Sep 22, 2017

    Adds encodeUnpadded() to Base32 and Base64 (and their derived classes). Satisfies #9.


Version 2.1.1 - Sep 16, 2017

Fix composer.json typo.


Version 2.1.0 - Sep 16, 2017

Previous tag was a false alarm. This is the real deal.

This library is now type-safe. Encoding functions (e.g. Base64::decode()) will always return a string or throw a RangeException. They will never return false.

Furthermore, type safety is assured with Psalm.


Version 2.0.3 - Jul 11, 2016

Throw a RangeException instead of returning false in a function with a return type of string.


Version 2.0.2 - Jun 13, 2016

Handle an edge-case reported in #4


Version 2.0.1 - May 10, 2016

    Added scalar type declarations to Binary.


Version 2.0.0 - Apr 8, 2016

Version 2 will require PHP 7 and use scalar type declarations.


Version 1.0.1 - Jun 13, 2016

Handle edge-case reported in #4


Version 1.0.0 - Apr 8, 2016

We're now stable (and with sufficient test coverage to be confident about the correctness of our implementation).


Version 0.6.0 - Apr 8, 2016

    Base32: Default to lowercase output, add encodeUpper() and decodeUpper().
    RFC4648: Removed erroneous encodeUpper() references. Base64 is case-sensitive.


Version 0.5.1 - Mar 24, 2016

    Return false instead of throwing a RangeException in Base64::decode()


Version 0.5.0 - Mar 14, 2016

    Add Base64UrlSafe
    Create an RFC4648 class for strict RFC conformity
    Added more unit tests


Version 0.4.0 - Mar 13, 2016

Relaxed the version requirements to accommodate PHP 5.3 and PHP 5.4. No other code changes were made.


Version 0.3.0 - Mar 12, 2016

    Added Base32Hex
    Restructured into classes
    We now cover all of the encoding formats specified by RFC 4648


Version 0.2.1 - Mar 12, 2016

    Mitigate chr()/ord() related cache-timing vulnerability.


Version 0.2.0 - Mar 12, 2016

Added Base32 (as specified in RFC 4648).


Version 0.1.0 - Feb 3, 2016

Initial release
