Editor42: Motivation & Goals
Editor42 is an open-source, MIT-licensed rich text editor — a security-maintained fork of TinyMCE 6.8.6, built for teams who need a permissively-licensed, self-hosted WYSIWYG editor they can keep shipping with. This page explains why the project exists, who it is for, and the principles that will guide every release.
The short version
If you have spent years building on the open-source TinyMCE WYSIWYG editor, you already know how good it is — and you may also know that the open-source TinyMCE 6 line has reached end of life, while version 7 and later moved to a GPL-or-commercial license. For a large class of products, neither outcome works. A permissive MIT license is a hard requirement, an unmaintained editor carrying known vulnerabilities is a non-starter, and a copyleft or paid license simply does not fit the way the software ships.
Editor42 exists to resolve exactly that tension. It is the same familiar, battle-tested editor you already trust — an MIT-licensed alternative to the now GPL-or-commercial TinyMCE — kept on a permissive license and brought back to a secure baseline. Nothing more, nothing less.
Standing on the shoulders of TinyMCE
We want to be unambiguous about this: TinyMCE is a genuine gem of open-source software, and the people behind it are excellent engineers who earned every bit of the editor's reputation. A rich text editor that handles real-world content — pasting from Word, complex tables, embedded media, accessibility, and the long tail of browser quirks — is one of the hardest things to build well on the web. TinyMCE is the product of two decades of patient, human-written, pre-AI-era engineering, refined through use by millions of developers and end users. The result is remarkably stable and broadly standards- and browser-compatible.
That kind of software cannot simply be reproduced from scratch — and, frankly, it should not be. The open-source community does not need yet another half-finished editor; it needs the proven one to stay available. The release we fork from, TinyMCE 6.8.6, is already a highly capable, fully embeddable editor that satisfies the overwhelming majority of use cases out of the box and extends cleanly through its plugin system when it does not. Our work begins from deep respect for that foundation.
We also respect Tiny's decision to change its licensing and business model. That is entirely their right, and it reflects a legitimate need to fund ongoing development. Our point is narrower, and it is not adversarial: those terms — GPL-or-commercial, together with the end of support for the last MIT release — no longer fit everyone. The resulting licensing uncertainty is real, and for many teams it is disqualifying.
An independent project
To be clear, Editor42 is an independent project: we are not affiliated with, endorsed by, or sponsored by Tiny Technologies Inc. or the TinyMCE project, and we use the TinyMCE name only to describe where the code comes from. In practice that also means support and issues are ours to handle — if something needs fixing, you come to us, not them.
Why a fork, and why now
Editor42 did not appear out of nowhere. We have supported TinyMCE in production for our clients for a long time, and the same request kept arriving: we need to stay on the permissive MIT version, and we need it to be secure. When the open-source 6.x line stopped receiving security updates, that request became urgent — the code was left in place with a handful of known, publicly documented vulnerabilities and no upstream fixes coming.
Rather than keep solving this privately, one client at a time, we decided to turn it into a public, polished, openly maintained solution. Editor42 is that solution: a secure, familiar, permissively-licensed editor that any team can adopt with confidence.
As a first step on security, we cherry-picked the available upstream MIT patches for two of those CVEs and wrote our own fixes for the remaining four — the Security page lists every one of them. But Editor42 is an actively maintained project, not a frozen snapshot of someone else's code. We keep a hand on the pulse — watching for newly disclosed vulnerabilities, shipping fixes, and carrying the editor forward release after release. Keeping this baseline secure and dependable over time is a standing commitment, not a one-off.
What Editor42 is — and what it is not
Our goal is deliberately modest, and that is the entire point. Editor42 is not a reinvention, not a rewrite, and not an attempt to "improve" a mature editor by piling on features. It is the editor you already know, made safe to keep using under MIT.
Everything follows from one principle: the code must stay auditable. We keep changes to the core to an absolute minimum and lean on the existing plugin system as the mechanism for adding functionality — so the editor's well-understood internals stay well-understood. The first release is deliberately small, with changes confined to three areas: rebranding, decoupling from hosted cloud services, and closing security vulnerabilities. The guiding rule does not change after that — anything we take on stays minimal, corrective, and easy to review — so that whatever the version, you can read exactly what we changed and why, without wading through noise.
To respect the TinyMCE trademark, we renamed the project to Editor42 and replaced the TinyMCE-branded identifiers throughout the code — for example, the global window.tinymce becomes window.editor42, and the tox-tinymce container class becomes editor42-t-editor42. For migration convenience we keep a few compatibility aliases in place, and they can be disabled entirely if you do not want them. The complete, exhaustive list of changes lives in our companion article on technical details and compatibility, for the readers who need that depth.
Built to be audited
Auditability is not a slogan for us; it shapes how the repository is structured. The brand renaming alone, applied across the entire codebase, would produce an enormous diff that buries the changes that actually matter. So we keep the meaningful, technical work — security fixes, cloud decoupling, and anything we change thereafter — in the main branch, on top of a minimal rename, where you can follow each change and compare it against the original. The full brand-string cleanup is then preprocessed from the latest main commit into the editor42 release branch, so that branch diffs cleanly against main and you can verify for yourself that the difference consists of nothing but brand strings. Trust, in other words, is something we want you to be able to check rather than take on faith — and that holds for this release and every release after it.
Documentation we actually maintain
We are developers ourselves, so we know that an editor is only as good as its documentation — and that for a component you embed in your own product, the API reference is the part that matters most. So we host the full documentation right here, and we did not stop at republishing what already existed: we went back and updated the parts that had drifted behind the code, closing gaps that had accumulated over time. If you are integrating Editor42, the reference should describe the editor you are actually running — not the one it used to be.
Where to go next
If you want the full technical breakdown — every renamed namespace, every compatibility shim, the security fixes, and the compatibility guarantees — read our Technical Details & Compatibility article. If you want to see how all of this can be checked rather than taken on trust, read Auditing Editor42. If you simply want a secure, MIT-licensed rich text editor that behaves exactly like the TinyMCE 6 you already rely on, you are in the right place.