The 43 KB editor that made me stop paying for a rich text field

For fifteen years the answer to "I need a WYSIWYG editor on this page" was one of three names: Summernote if you were already living in jQuery, TinyMCE if you wanted the safe enterprise pick, CKEditor if you wanted the other safe enterprise pick. They are good software. They are also, in 2026, heavier and more entangled than the job usually needs -- a plugin architecture, a build step, a license key, a telemetry ping, a pricing page.

RTE Pro is the counter-argument. It is one JavaScript file -- 171 KB, 43 KB over the wire gzipped -- with zero dependencies, MIT-licensed, that you drop in with a single script tag. No npm required. No bundler required. No account, no API key, no "contact sales." You can read the whole thing. And for the overwhelming majority of "let a human write formatted content into a box" problems, it is simply the better tool.

Here is the honest case.

One file, no supply chain

<script src=class="rte-pro-str">"rte-pro.js"></script>
<div id=class="rte-pro-str">"editor"></div>
<script>RTEPro.init(class="rte-pro-str">'class=class="rte-pro-str">"rte-pro-cmt">#editor')</script>

That is the entire integration. Not "install this package, then its seventeen peer dependencies, then configure the build to tree-shake them." One file you can host yourself, pin by hash, and audit end to end in an afternoon.

Compare the alternatives:

• Summernote cannot exist without jQuery and Bootstrap. That was a reasonable ask in 2015. Today it means dragging two large runtimes into a page to get a text box, and betting your editor's future on a stack the rest of the industry has moved past.
• TinyMCE ships a capable open-source core, then gates its cloud behind an API key and its genuinely useful features -- and its support -- behind a subscription. The moment your needs grow, you are on a pricing page.
• CKEditor 5 is a real feat of engineering, but its headline features -- real-time collaboration, the AI assistant, export to Word and PDF -- are commercial, and you consume the thing as a build artifact or a licensed CDN. The "free" version is the appetizer.

None of that is a scandal; it is how those businesses are funded. But if what you actually need is a self-contained editor you own outright, all three make you pay -- in bytes, in dependencies, or in dollars -- for a business model you did not ask to join.

Security is built in, not your homework

Most editors hand you raw HTML and wish you luck. RTE Pro treats the editor as a trust boundary, because it is one.

Paste something into it and the content runs through an allowlist sanitizer before it touches the document: <script> dropped, on* event handlers stripped, javascript: URLs neutralized. The same applies when you set content programmatically. The editor's own AI output is sanitized on the same path -- so a prompt-injected or simply hallucinated <img onerror=...> cannot become stored XSS in your users' browsers. That is the kind of thing you are supposed to bolt on around TinyMCE and CKEditor yourself, and the kind of thing that quietly does not get bolted on.

It is also Content-Security-Policy clean: no eval, no new Function. You can run it under a strict script-src 'self' with no unsafe-eval and it just works -- which is more than can be said for a lot of bundled editors whose dev builds smuggle eval in through their source maps.

AI that keeps your key on the server

RTE Pro has an AI writing assistant built into the base file -- rewrite, summarize, expand, fix grammar, translate, generate -- and it is provider-agnostic across Anthropic, OpenAI, and Google. The part that matters: it is built to keep your API key off the client. Point it at a server proxy (or the simple { prompt } -> { ok, text } endpoint mode) and the browser never sees the key; the server owns the model, the system prompt, and the rate limits.

Contrast the going rate: TinyMCE's AI is a paid add-on, CKEditor's AI Assistant is a premium feature. Here it is in the box, and it is architected so the naive "put the key in the browser" mistake is the road not taken.

It is not a toy

Zero dependencies tends to imply "and zero features." Not here. Tables with column resizing, image resize with float and text-wrap, multi-column layouts, slash commands, @-mentions, #-hashtags, checklists, find-and-replace, a source view, full-screen mode, autosave with version history, a Markdown surface (getMarkdown / setMarkdown), one-click export to HTML, text, or print, and built-in readability, SEO, and accessibility checks. The toolbar is sticky, the dropdowns track your cursor, and it degrades sanely on mobile. It is a serious editor that happens to fit in a script tag.

Where the big editors still win -- and why it probably doesn't matter to you

An honest pitch names the tradeoffs. TinyMCE and CKEditor are older, have been through more accessibility audits, ship deeper internationalization, and carry ecosystems and commercial support that a single-file editor does not. If you are building a compliance-bound authoring tool for a Fortune 100, with WCAG sign-off and a hundred locales and a procurement department that wants a vendor to sue, buy the enterprise editor. That is what it is for.

But most of us are not building that. We are putting a formatted-content field into a CMS, a comment box, a docs tool, an internal admin, a marketing page. For that -- the ninety percent case -- the enterprise editor is a cannon aimed at a nail, and its price is paid in weight, lock-in, and a key you have to keep alive.

The point

RTE Pro is opinionated in the way good tools are: it decided that a rich text editor should be one file you own, safe by default, with no runtime tax and no license to renew. It gives up the enterprise checklist to buy back simplicity, self-hosting, and a security posture you get for free instead of building.

If you have ever pasted a TinyMCE API key into a config and thought "why does a text box need a subscription," this is the editor for you. It is on npm as rte-rich-text-editor-pro -- or just grab the file.

Zero dependencies. MIT. 43 KB gzipped. One script tag.