diff --git a/auth.php b/auth.php
index 1f5ad8a..0ef6fbf 100644
--- a/auth.php
+++ b/auth.php
@@ -40,7 +40,9 @@
 	if ( !$accepted )
 	{
 		http_response_code(403);
-		print "<html><body>Access from IP address ".htmlspecialchars($ip)." is not allowed</body></html>";
+		// (api.php doesn't load the locale)
+		$text = function_exists('__') ? __('Access from IP address %s is not allowed') : 'Access from IP address %s is not allowed';
+		print "<html><body>" . sprintf($text, htmlspecialchars($ip)) . "</body></html>";
 		exit;
 	}
 }
diff --git a/functions.php b/functions.php
index bf19c2d..b3f6ced 100644
--- a/functions.php
+++ b/functions.php
@@ -51,6 +51,17 @@ function __( $label, $alt_word = null )
 	return h($w2_word_set[$label]);
 }
 
+/**
+ * Get translated word as a JavaScript string literal (with quotes), for inline scripts
+ *
+ * String	$label		Key for locale word
+ * return	String
+ */
+function __js( $label )
+{
+	return json_encode(html_entity_decode(__($label), ENT_QUOTES | ENT_HTML5, W2_CHARSET), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_UNICODE);
+}
+
 function descLengthSort($val_1, $val_2)
 {
 	$firstVal = strlen($val_1);
diff --git a/index.php b/index.php
index 4d0ac5e..6b7a174 100644
--- a/index.php
+++ b/index.php
@@ -68,26 +68,26 @@ function printDrawer()
 		"###### ".__('Header')." 6<br/>".
 		"<br/>".
 		"*".__('Emphasize')."* - <em>".__('Emphasize')."</em><br/>".
-		"_".__('Emphasize')."* - <em>".__('Emphasize')."</em><br/>".
+		"_".__('Emphasize')."_ - <em>".__('Emphasize')."</em><br/>".
 		"**".__('Bold')."** - <strong>".__('Bold')."</strong><br/>".
 		"__".__('Bold')."__ - <strong>".__('Bold')."</strong><br/>".
 		"<br/>".
-		"[[Link to page]]<br/>".
+		"[[".__('Link to page')."]]<br/>".
 		"&lt;http://example.com/&gt;<br/>".
-		"[link text](http://url)<br/><br/>".
-		"![Alt text](/images/image.jpg)<br/>".
-		"![Alt text](/images/image.jpg \"Optional title\")<br/>".
+		"[".__('link text')."](http://url)<br/><br/>".
+		"![".__('Alt text')."](/images/image.jpg)<br/>".
+		"![".__('Alt text')."](/images/image.jpg \"".__('Optional title')."\")<br/>".
 		"<br/>".
-		"- Unordered list<br/>".
-		"+ Unordered list<br/>".
-		"* Unordered list<br/>".
-		"1. Ordered list<br/>".
+		"- ".__('Unordered list')."<br/>".
+		"+ ".__('Unordered list')."<br/>".
+		"* ".__('Unordered list')."<br/>".
+		"1. ".__('Ordered list')."<br/>".
 		"<br/>".
-		"> Blockquote<br/>".// <blockquote>Blockquotes</blockquote>\n".
-		"```Code```<br/>". //<pre>Code</pre>\n\n".
-		"`inline-code`<br/><br/>".
-		"*** Horizontal rule<br/>".
-		"--- Horizontal rule<br/>\n".
+		"> ".__('Blockquote')."<br/>".
+		"```".__('Code')."```<br/>".
+		"`".__('Inline code')."`<br/><br/>".
+		"*** ".__('Horizontal rule')."<br/>".
+		"--- ".__('Horizontal rule')."<br/>\n".
 		"        </div>\n".
 		"      </div>\n".
 		"      <a id=\"drawer-control\" href=\"\" onclick=\"toggleDrawer(); return false;\">\n".
@@ -128,7 +128,7 @@ function printDrawer()
 		}
 		if ( (!defined('W2_PASSWORD_HASH') || W2_PASSWORD_HASH === '') && defined('W2_PASSWORD') && W2_PASSWORD === 'secret' )
 		{
-			print "    <p class=\"note\">Login is disabled while the default password is configured; please set W2_PASSWORD_HASH (or W2_PASSWORD) in config.php.</p>\n";
+			print "    <p class=\"note\">" . __('Login is disabled while the default password is configured; please set W2_PASSWORD_HASH (or W2_PASSWORD) in config.php.') . "</p>\n";
 		}
 		print "    <form method=\"post\">\n";
 		print "      ".__('Password') . ": <input type=\"password\" name=\"p\">\n";
@@ -174,7 +174,7 @@ function checkedExecute(&$msg, $cmd)
 	{
 		// details (command, output) may reveal server internals, so only log them
 		error_log("W2: error executing command $cmd (return value: $returnValue): ".implode(" ", $output));
-		$msg .= "<br/>Error executing git command (return value: ".$returnValue."); see the web server's error log for details.";
+		$msg .= "<br/>".sprintf(__("Error executing git command (return value: %s); see the web server's error log for details."), h($returnValue));
 	}
 	return ($returnValue == 0);
 }
@@ -221,7 +221,7 @@ function destroy_session()
 	($_SERVER['REQUEST_METHOD'] !== 'POST' || !isValidCSRFToken($_POST['csrf_token'] ?? null)))
 {
 	http_response_code(403);
-	die('Invalid request: missing or wrong security token. Please go back, reload the page and try again.');
+	die(__('Invalid request: missing or wrong security token. Please go back, reload the page and try again.'));
 }
 if ($action === 'logout' && !isValidCSRFToken($_GET['csrf_token'] ?? null))
 {
@@ -269,7 +269,7 @@ function destroy_session()
 		{
 			$basePage = basename($p);
 			if ($basePage == $page) {
-				redirectWithMessage($p, "Page ".h($page)." does not exist, redirected instead to first page in a subfolder with matching filename (".h($p).")");
+				redirectWithMessage($p, sprintf(__("Page %s does not exist, redirected instead to first page in a subfolder with matching filename (%s)"), h($page), h($p)));
 			}
 		}
 		$newPage = $page;
@@ -291,8 +291,8 @@ function destroy_session()
 	if ($isNew && (file_exists($filename) || !isValidPageName($page)))
 	{
 		$msg .= file_exists($filename)
-			? "Error creating page '".h($page)."' - it already exists! Please choose a different name, or <a href=\"?action=edit&amp;page=".urlencode($page)."\">edit</a> the existing page (this discards current text!)!\n"
-			: "Error creating page '".h($page)."' - invalid page name! Page names must not start with '".UPLOAD_FOLDER."/', or contain empty or hidden ('.'-prefixed) folder names.\n";
+			? sprintf(__("Error creating page '%s' - it already exists! Please choose a different name, or %s the existing page (this discards current text!)!"), h($page), "<a href=\"?action=edit&amp;page=".urlencode($page)."\">".__('edit')."</a>")."\n"
+			: sprintf(__("Error creating page '%s' - invalid page name! Page names must not start with '%s/', or contain empty or hidden ('.'-prefixed) folder names."), h($page), h(UPLOAD_FOLDER))."\n";
 		$action = 'new';
 		$text = $newText;
 		$newPage = $page;
@@ -311,7 +311,7 @@ function destroy_session()
 		$success = file_put_contents($filename, $newText);
 		if ( $success === FALSE)
 		{
-			$msg .= "Error saving changes! Make sure your web server has write access to the pages folder.\n";
+			$msg .= __('Error saving changes! Make sure your web server has write access to the pages folder.')."\n";
 			error_log("W2: error saving $filename");
 			$action = ($isNew ? 'new' : 'edit');
 			$text = $newText;
@@ -361,7 +361,7 @@ function destroy_session()
 			{
 				if (levenshtein(strtoupper($newPage), strtoupper($pageName)) < sqrt(min(strlen($newPage), strlen($pageName))) )
 				{
-					$html .= "<br/><strong>Note:</strong> Found similar page ".pageLink($pageName, h($pageName)).". Maybe you meant to edit this instead?";
+					$html .= "<br/><strong>".__('Note').":</strong> ".sprintf(__('Found similar page %s. Maybe you meant to edit this instead?'), pageLink($pageName, h($pageName)));
 				}
 			}
 			$html .= "</div>\n";
@@ -373,7 +373,7 @@ function destroy_session()
 	$html .= "<p><textarea id=\"text\" name=\"newText\" rows=\"" . EDIT_ROWS . "\" autocomplete=\"off\" autocorrect=\"off\" autocapitalize=\"off\" spellcheck=\"false\">".h($text)."</textarea></p>\n";
 	if (GIT_COMMIT_ENABLED)
 	{
-		$html .= "<p>Message: <input type=\"text\" id=\"gitmsg\" name=\"gitmsg\" value=\"".h($oldgitmsg)."\" /></p>\n";
+		$html .= "<p>".__('Message').": <input type=\"text\" id=\"gitmsg\" name=\"gitmsg\" value=\"".h($oldgitmsg)."\" /></p>\n";
 	}
 
 	$html .= "<p><input type=\"hidden\" name=\"action\" value=\"save\" />\n";
@@ -417,14 +417,14 @@ function destroy_session()
 			'function processForm(e) {'."\n".
 			'    e.preventDefault();'."\n".
 			'    var fileInput = document.getElementById("file");'."\n".
-			'    if (fileInput.files.length == 0) { alert("No file selected!"); return; }'."\n".
+			'    if (fileInput.files.length == 0) { alert('.__js('No file selected!').'); return; }'."\n".
 			'    var filename = fileInput.files[0].name;'."\n".
 			'    fetch("'.BASE_URI.'/api.php?task=checkupload&filename="+encodeURIComponent(filename))'."\n".
 			'        .then((response) => {'."\n".
 			'            response.json().then((data) => {'."\n".
 			'                upload = true;'."\n".
 			'                if (data) {'."\n".
-			'                     upload = window.confirm("File "+filename+" already exists. Overwrite?");'."\n".
+			'                     upload = window.confirm('.__js('File %s already exists. Overwrite?').'.replace("%s", () => filename));'."\n".
 			'                }'."\n".
 			'                if (upload) {'."\n".
 			'                    document.getElementById("overwrite").value = data ? "true" : "";'."\n".
@@ -490,10 +490,10 @@ function destroy_session()
 
 	$html .= "<table><thead>";
 	$html .= "<tr>".
-		"<th>".(($sortBy!='name')?("<a href=\"".SELF."?action=upload&sortBy=name\">Name</a>"):"<span class=\"sortBy\">Name</span>")."</th>".
+		"<th>".(($sortBy!='name')?("<a href=\"".SELF."?action=upload&sortBy=name\">".__('Name')."</a>"):"<span class=\"sortBy\">".__('Name')."</span>")."</th>".
 		"<th>".__("Usage")."</th>".
-		"<th>".(($sortBy!='recent')?("<a href=\"".SELF."?action=upload&sortBy=recent\">Modified</a>"):"<span class=\"sortBy\">Modified</span>")."</th>".
-		"<th>".(($sortBy!='size')?("<a href=\"".SELF."?action=upload&sortBy=size\">Size</a>"):"<span class=\"sortBy\">Size</span>")."</th>".
+		"<th>".(($sortBy!='recent')?("<a href=\"".SELF."?action=upload&sortBy=recent\">".__('Modified')."</a>"):"<span class=\"sortBy\">".__('Modified')."</span>")."</th>".
+		"<th>".(($sortBy!='size')?("<a href=\"".SELF."?action=upload&sortBy=size\">".__('Size')."</a>"):"<span class=\"sortBy\">".__('Size')."</span>")."</th>".
 		"<th>".__("Action")."</th>";
 	if (SHOW_PAGES_WHERE_FILE_USED)
 	{
@@ -541,7 +541,7 @@ function destroy_session()
 {
 	if ( DISABLE_UPLOADS )
 	{
-		die('Invalid access. Uploads are disabled in the configuration.');
+		die(__('Invalid access. Uploads are disabled in the configuration.'));
 	}
 	$uploadError = $_FILES['userfile']['error'] ?? UPLOAD_ERR_NO_FILE;
 	if ( $uploadError === UPLOAD_ERR_INI_SIZE || $uploadError === UPLOAD_ERR_FORM_SIZE )
@@ -586,12 +586,12 @@ function destroy_session()
 		}
 		if ( file_exists($finalPath) && ($_POST['overwrite'] ?? '') !== 'true' )
 		{
-			$msg .= __('Upload error').": ".h(basename($finalPath))." already exists!";
+			$msg .= __('Upload error').": ".sprintf(__('%s already exists!'), h(basename($finalPath)));
 		}
 		else if ( ($svgData !== null) ? (file_put_contents($path, $svgData) !== false) : (move_uploaded_file($tmpName, $path) === true) )
 		{
 			$commitMsg = "File '$dstName' uploaded!";
-			$msg .= h($commitMsg)." ";
+			$msg .= sprintf(__("File '%s' uploaded!"), h($dstName))." ";
 			$processFailed = false;
 			if ($doProcess)
 			{
@@ -614,11 +614,11 @@ function destroy_session()
 						try
 						{
 							$img->resizeImage($newSize[0], $newSize[1], imagick::FILTER_LANCZOS, 1);
-							$msg .= "Original size was $size[0]x$size[1], resized to $newSize[0]x$newSize[1]. ";
+							$msg .= sprintf(__('Original size was %s, resized to %s.'), "$size[0]x$size[1]", "$newSize[0]x$newSize[1]")." ";
 						}
 						catch (ImagickException $e)
 						{
-							$msg .= "Resizing file failed! ";
+							$msg .= __('Resizing file failed!')." ";
 						}
 					}
 					$ori = $img->getImageOrientation();
@@ -627,15 +627,15 @@ function destroy_session()
 						switch($ori)
 						{
 						case imagick::ORIENTATION_RIGHTTOP:
-							$msg .= "Image rotated by +90°. ";
+							$msg .= sprintf(__('Image rotated by %s°.'), '+90')." ";
 							$img->rotateImage('#000',90);
 							break;
 						case imagick::ORIENTATION_BOTTOMRIGHT:
-							$msg .= "Image rotated by 180°. ";
+							$msg .= sprintf(__('Image rotated by %s°.'), '180')." ";
 							$img->rotateImage('#000',180);
 							break;
 						case imagick:: ORIENTATION_LEFTBOTTOM:
-							$msg .= "Image rotated by -90°. ";
+							$msg .= sprintf(__('Image rotated by %s°.'), '-90')." ";
 							$img->rotateImage('#000',-90);
 							break;
 //						default:
@@ -648,7 +648,7 @@ function destroy_session()
 					{
 						$dstName = substr($dstName, 0, strlen($dstName)-strlen($fileExt)).CONVERT_FORMAT;
 						$img->setImageFormat(CONVERT_FORMAT);
-						$msg .= "Converted to format ".CONVERT_FORMAT.". ";
+						$msg .= sprintf(__('Converted to format %s.'), h(CONVERT_FORMAT))." ";
 					}
 					$img->writeImage($finalPath);
 					unlink($path);
@@ -663,14 +663,14 @@ function destroy_session()
 						unlink($path);
 					}
 					$processFailed = true;
-					$msg = __('Upload error').": ".h($dstName)." could not be processed (is it a valid image?)";
+					$msg = __('Upload error').": ".sprintf(__('%s could not be processed (is it a valid image?)'), h($dstName));
 				}
 			}
 
 			if (!$processFailed)
 			{
 				gitChangeHandler($commitMsg, $msg);
-				$msg .= "Use <pre>".h(imageLinkText($dstName))."</pre> to refer to it!";
+				$msg .= sprintf(__('Use %s to refer to it!'), "<pre>".h(imageLinkText($dstName))."</pre>");
 			}
 		}
 		else
@@ -680,15 +680,15 @@ function destroy_session()
 			{
 				// Likely a permissions issue
 				error_log("W2: can't write upload to $path");
-				$msg .= __('Upload error') .": Can't write to the uploads folder<br/><br/>\n".
-					"Check that your permissions are set correctly.";
+				$msg .= __('Upload error') .": ".__("Can't write to the uploads folder")."<br/><br/>\n".
+					__('Check that your permissions are set correctly.');
 			}
 			else
 			{
 				// Give generic error message
 				$msg .= __('Upload error').", error #".$error_code."<br/><br/>\n".
-					"Please see <a href=\"https://www.php.net/manual/en/features.file-upload.errors.php\">here</a> for more information.<br/><br/>\n".
-					"If you see this message, please <a href=\"https://github.com/codeling/w2wiki/issues\">file a bug to improve w2wiki</a>";
+					sprintf(__('Please see %s for more information.'), "<a href=\"https://www.php.net/manual/en/features.file-upload.errors.php\">".__('here')."</a>")."<br/><br/>\n".
+					sprintf(__('If you see this message, please %s'), "<a href=\"https://github.com/codeling/w2wiki/issues\">".__('file a bug to improve w2wiki')."</a>");
 			}
 		}
 	}
@@ -715,7 +715,7 @@ function destroy_session()
 			: "?")
 		. "</p>";
 	$html .= "<p><input id=\"$action\" type=\"submit\" value=\"$actionName\">";
-	$html .= "<input id=\"cancel\" type=\"button\" onclick=\"history.go(-1);\" value=\"Cancel\" />\n";
+	$html .= "<input id=\"cancel\" type=\"button\" onclick=\"history.go(-1);\" value=\"".__('Cancel')."\" />\n";
 	$html .= "<input type=\"hidden\" name=\"action\" value=\"{$action}d\" />";
 	$html .= "<input type=\"hidden\" name=\"oldPageName\" value=\"" . h($page) . "\" />";
 	if ($action === 'imgDelete' || $action === 'imgRename')
@@ -889,7 +889,7 @@ function destroy_session()
 	$html .= "<p>".__('Total').": ".count($pageNames)." ".__("pages")."</p>";
 	$html .= "<table><thead>";
 	$html .= "<tr>".
-		"<th>".(($sortBy!='name')?("<a href=\"".SELF."?action=all&sortBy=name\">Name</a>"):"<span class=\"sortBy\">".__('Name')."</span>")."</th>".
+		"<th>".(($sortBy!='name')?("<a href=\"".SELF."?action=all&sortBy=name\">".__('Name')."</a>"):"<span class=\"sortBy\">".__('Name')."</span>")."</th>".
 		"<th>".(($sortBy!='recent')?("<a href=\"".SELF."?action=all&sortBy=recent\">".__('Modified')."</a>"):"<span class=\"sortBy\">".__('Modified')."</span>")."</th>".
 		"<th>".(($sortBy!='size')?("<a href=\"".SELF."?action=all&sortBy=size\">".__('Size')."</a>"):"<span class=\"sortBy\">".__('Size')."</span>")."</th>".
 		"<th>".__('Action')."</th>".
@@ -911,7 +911,7 @@ function destroy_session()
 {
 	$matches = 0;
 	$q = $_REQUEST['q'];
-	$html .= "    <h1>Search: ".h($q)."</h1>\n";
+	$html .= "    <h1>".__('Search').": ".h($q)."</h1>\n";
 
 	if ( trim($q) != "" )
 	{
diff --git a/locales/de.php b/locales/de.php
index a5b601b..7a4d74f 100644
--- a/locales/de.php
+++ b/locales/de.php
@@ -19,8 +19,6 @@
 	'Created' => 'Angelegt',
 	'Upload' => 'Hochladen',
 	'All'    => 'Alle',
-	'Recent' => 'Zuletzt',
-	'Exit'   => 'Ausloggen',
 	'Search' => 'Suchen',
 	'Formatting help' => 'Formatierungshilfe',
 	'Bold'   => 'Fett',
@@ -30,9 +28,10 @@
 	'Cancel' => 'Abbrechen',
 	'Saved'  => 'Gespeichert',
 	'Log In' => 'Einloggen',
-	'Log Out' => 'Ausloggen',
+	'Log out' => 'Ausloggen',
 	'Password' => 'Passwort',
 	'Wrong password' => 'Falsches Passwort',
+	'Invalid page name' => 'Ungültiger Seitenname',
 	'Title'  => 'Titel',
 	'Image Description' => 'Bildbeschreibung',
 	'Name'   => 'Name',
@@ -63,13 +62,52 @@
 	'Error renaming file' => 'Fehler beim Umbenennen der Datei',
 	'Sidebar file could not be found' => 'Seitenleisten-Datei nicht gefunden',
 	'Name of new page (restrictions in tip)' => 'Seitenname (Einschränkungen im Tip)',
-	"Character restrictions: '#' and '|' have a special meaning in page links, they will therefore be removed; also, characters '~', '/', '\\', ':', '|', '&' might cause trouble in filenames and are therefore replaced by '-'." => "Buchstaben-Beschränkungen: '#' und '|' haben eine spezielle Bedeutung in Links, sie werden deshalb entfernt. Weiters können die Zeichen '~', '/', '\\', ':', '|', '&' Probleme in Dateinamen verursachen, und werden deshalb durch einen Bindestrich '-' ersetzt.",
+	"Character restrictions: '#' and '|' have a special meaning in page links, they will therefore be removed; also, characters '~', '..', '\\', ':', '|', '&' might cause trouble in filenames and are therefore replaced by '-'." => "Buchstaben-Beschränkungen: '#' und '|' haben eine spezielle Bedeutung in Links, sie werden deshalb entfernt. Weiters können die Zeichen '~', '..', '\\', ':', '|', '&' Probleme in Dateinamen verursachen, und werden deshalb durch einen Bindestrich '-' ersetzt.",
 	'Image deleted' => 'Bild gelöscht',
 	'Image renamed' => 'Bild umbenannt',
-	'Error deleting image' => 'Fehler beim Löschen des Bildes',
+	'Error deleting image: ' => 'Fehler beim Löschen des Bildes: ',
 	'Restored unsaved draft from %s.' => 'Ungespeicherter Entwurf vom %s wiederhergestellt.',
 	'Warning: the page was changed since this draft was started.' => 'Achtung: Die Seite wurde geändert, seit dieser Entwurf begonnen wurde.',
 	'Discard draft' => 'Entwurf verwerfen',
+	'Message' => 'Nachricht',
+	'edit' => 'bearbeite',
+	'No file selected!' => 'Keine Datei ausgewählt!',
+	'File %s already exists. Overwrite?' => 'Die Datei %s existiert bereits. Überschreiben?',
+	"Error creating page '%s' - it already exists! Please choose a different name, or %s the existing page (this discards current text!)!" => "Fehler beim Anlegen der Seite '%s' - sie existiert bereits! Bitte wähle einen anderen Namen oder %s die bestehende Seite (der aktuelle Text geht dabei verloren!)!",
+	"Error creating page '%s' - invalid page name! Page names must not start with '%s/', or contain empty or hidden ('.'-prefixed) folder names." => "Fehler beim Anlegen der Seite '%s' - ungültiger Seitenname! Seitennamen dürfen nicht mit '%s/' beginnen und keine leeren oder versteckten (mit '.' beginnenden) Ordnernamen enthalten.",
+	'Error saving changes! Make sure your web server has write access to the pages folder.' => 'Fehler beim Speichern der Änderungen! Stelle sicher, dass der Webserver Schreibzugriff auf den Seitenordner hat.',
+	'Note' => 'Hinweis',
+	'Found similar page %s. Maybe you meant to edit this instead?' => 'Ähnliche Seite gefunden: %s. Vielleicht wolltest du stattdessen diese bearbeiten?',
+	"Page %s does not exist, redirected instead to first page in a subfolder with matching filename (%s)" => "Die Seite %s existiert nicht, stattdessen wurde auf die erste Seite in einem Unterordner mit passendem Dateinamen weitergeleitet (%s)",
+	'Login is disabled while the default password is configured; please set W2_PASSWORD_HASH (or W2_PASSWORD) in config.php.' => 'Das Einloggen ist gesperrt, solange das Standardpasswort eingestellt ist; bitte setze W2_PASSWORD_HASH (oder W2_PASSWORD) in config.php.',
+	'Invalid request: missing or wrong security token. Please go back, reload the page and try again.' => 'Ungültige Anfrage: Das Sicherheitstoken fehlt oder ist falsch. Bitte gehe zurück, lade die Seite neu und versuche es erneut.',
+	'Invalid access. Uploads are disabled in the configuration.' => 'Ungültiger Zugriff. Hochladen ist in der Konfiguration deaktiviert.',
+	"Error executing git command (return value: %s); see the web server's error log for details." => "Fehler beim Ausführen des git-Befehls (Rückgabewert: %s); Details stehen im Fehlerprotokoll des Webservers.",
+	'Access from IP address %s is not allowed' => 'Zugriff von der IP-Adresse %s ist nicht erlaubt',
+	'%s already exists!' => '%s existiert bereits!',
+	"File '%s' uploaded!" => "Datei '%s' hochgeladen!",
+	'Original size was %s, resized to %s.' => 'Ursprüngliche Größe war %s, verkleinert auf %s.',
+	'Resizing file failed!' => 'Verkleinern der Datei fehlgeschlagen!',
+	'Image rotated by %s°.' => 'Bild um %s° gedreht.',
+	'Converted to format %s.' => 'In das Format %s umgewandelt.',
+	'%s could not be processed (is it a valid image?)' => '%s konnte nicht verarbeitet werden (ist es ein gültiges Bild?)',
+	'Use %s to refer to it!' => 'Verwende %s, um darauf zu verweisen!',
+	"Can't write to the uploads folder" => 'Der Upload-Ordner ist nicht beschreibbar',
+	'Check that your permissions are set correctly.' => 'Prüfe, ob die Berechtigungen richtig gesetzt sind.',
+	'Please see %s for more information.' => 'Weitere Informationen stehen %s.',
+	'here' => 'hier',
+	'If you see this message, please %s' => 'Wenn du diese Meldung siehst, bitte %s',
+	'file a bug to improve w2wiki' => 'melde einen Fehler, um w2wiki zu verbessern',
+	'Link to page' => 'Link auf Seite',
+	'link text' => 'Linktext',
+	'Alt text' => 'Alternativtext',
+	'Optional title' => 'Optionaler Titel',
+	'Unordered list' => 'Aufzählung',
+	'Ordered list' => 'Nummerierte Liste',
+	'Blockquote' => 'Zitat',
+	'Code' => 'Code',
+	'Inline code' => 'Code im Text',
+	'Horizontal rule' => 'Horizontale Linie',
 	// Override TITLE_DATE and TITLE_DATE_NO_TIME if set.
 	'date_format'         => 'd.m.Y H:i',
 	'date_format_no_time' => 'd.m.Y',
diff --git a/locales/en.php b/locales/en.php
index 46de617..7b51124 100644
--- a/locales/en.php
+++ b/locales/en.php
@@ -6,34 +6,16 @@
  * Do not change variable name $w2_word_set.
  * Rewrite values in your locale and rename this file to locale code.
  * Set "LOCALE" to your locale in config.php.
+ *
+ * The English texts are the keys themselves: __() shows the key of a text which has no entry
+ * here, so this file only has the entries which are not the same as their key. To translate,
+ * add an entry for every text used with __() in the code (see the other files in this folder,
+ * and tests/Unit/LocaleFilesTest.php for the list of missing translations).
  */
 $w2_word_set = array(
-	// Buttons / Labels
-	'Home'   => 'Home',
-	'New'    => 'New',
-	'Edit'   => 'Edit',
-	'Upload' => 'Upload',
+	// Titles of the actions (the key is the name of the action)
 	'imgDelete' => 'Delete image',
 	'imgRename' => 'Rename image',
-	'All'    => 'All',
-	'Recent' => 'Recent',
-	'Exit'   => 'Exit',
-	'Search' => 'Search',
-	'Save'   => 'Save',
-	'Cancel' => 'Cancel',
-	'Saved'  => 'Saved',
-	'Log In' => 'Log In',
-	'Title'  => 'Title',
-	// Messages
-	'Upload error' => 'Upload error',
-	'Upload error: invalid file type' => 'Upload error: invalid file type',
-	'The upload is too large: the server accepts requests of up to %s (post_max_size).' => 'The upload is too large: the server accepts requests of up to %s (post_max_size).',
-	'Nothing was uploaded or saved. Please go back and try again with a smaller file.' => 'Nothing was uploaded or saved. Please go back and try again with a smaller file.',
-	'Upload error: the file is larger than the allowed %s (upload_max_filesize).' => 'Upload error: the file is larger than the allowed %s (upload_max_filesize).',
-	'Image uploading has been disabled on this installation.' => 'Image uploading has been disabled on this installation.',
-	'Restored unsaved draft from %s.' => 'Restored unsaved draft from %s.',
-	'Warning: the page was changed since this draft was started.' => 'Warning: the page was changed since this draft was started.',
-	'Discard draft' => 'Discard draft',
 	// Override TITLE_DATE and TITLE_DATE_NO_TIME if set.
 	'date_format'         => 'Y-m-d H:i:s',
 	'date_format_no_time' => 'Y-m-d',
diff --git a/locales/ja.php b/locales/ja.php
index 26ca03a..c528a0c 100644
--- a/locales/ja.php
+++ b/locales/ja.php
@@ -14,8 +14,7 @@
 	'Edit'   => '編集',
 	'Upload' => 'アップロード',
 	'All'    => '全て',
-	'Recent' => '最近',
-	'Exit'   => 'ログアウト',
+	'Log out' => 'ログアウト',
 	'Search' => '検索',
 	'Save'   => '保存',
 	'Cancel' => 'キャンセル',
diff --git a/locales/oc.php b/locales/oc.php
index 449a762..ff79cf7 100644
--- a/locales/oc.php
+++ b/locales/oc.php
@@ -18,8 +18,6 @@
 	'Created' => 'Creacion',
 	'Upload' => 'Enviar',
 	'All'    => 'Tot',
-	'Recent' => 'Recents',
-	'Exit'   => 'Sortir',
 	'Search' => 'Recercar',
 	'Formatting help' => 'Ajuda al formatatge',
 	'Bold'   => 'Gras',
@@ -29,7 +27,7 @@
 	'Cancel' => 'Anullar',
 	'Saved'  => 'Salvat',
 	'Log In' => 'Connexion',
-	'Log Out' => 'Desconnexion',
+	'Log out' => 'Desconnexion',
 	'Password' => 'Senhal',
 	'Title'  => 'Títol',
 	'Image Description' => 'Descripcion de l’imatge',
@@ -57,9 +55,9 @@
 	'Error renaming file' => 'Error en renomenant lo fichièr',
 	'Sidebar file could not be found' => 'Impossible de trobar la barra laterala',
 	'Name of new page (restrictions in tip)' => 'Nom de la pagina novèla (restriccion dins las astúcias)',
-	"Character restrictions: '#' and '|' have a special meaning in page links, they will therefore be removed; also, characters '~', '/', '\\', ':', '|', '&' might cause trouble in filenames and are therefore replaced by '-'." => "Restriccions dels caractèrs : '#' e '|' an una significacion especiala dins los ligams de pagina, seràn doncas tirats ; tanben, los caractèrs '~', '/', '\\', ':', '|', '&' que pòdon causar de problèmas dins los noms de fichièrs seràn remplaçat per '-'.",
+	"Character restrictions: '#' and '|' have a special meaning in page links, they will therefore be removed; also, characters '~', '..', '\\', ':', '|', '&' might cause trouble in filenames and are therefore replaced by '-'." => "Restriccions dels caractèrs : '#' e '|' an una significacion especiala dins los ligams de pagina, seràn doncas tirats ; tanben, los caractèrs '~', '..', '\\', ':', '|', '&' que pòdon causar de problèmas dins los noms de fichièrs seràn remplaçat per '-'.",
 	'Image deleted' => 'Imatge suprimit',
-	'Error deleting image' => 'Error de supression de l’imatge',
+	'Error deleting image: ' => 'Error de supression de l’imatge : ',
 	// Override TITLE_DATE and TITLE_DATE_NO_TIME if set.
 	'date_format'         => 'd/m/Y H:i:s',
 	'date_format_no_time' => 'd/m/Y',
diff --git a/locales/sample.php b/locales/sample.php
index c609d05..76ac32a 100644
--- a/locales/sample.php
+++ b/locales/sample.php
@@ -14,8 +14,6 @@
 	'Edit'   => 'Edit',
 	'Upload' => 'Upload',
 	'All'    => 'All',
-	'Recent' => 'Recent',
-	'Exit'   => 'Exit',
 	'Search' => 'Search',
 	'Save'   => 'Save',
 	'Cancel' => 'Cancel',
diff --git a/tests/Integration/LocaleEscapingTest.php b/tests/Integration/LocaleEscapingTest.php
new file mode 100644
index 0000000..90d49e9
--- /dev/null
+++ b/tests/Integration/LocaleEscapingTest.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace W2\Tests\Integration;
+
+use W2\Tests\Support\AppTestCase;
+
+/**
+ * Translations are escaped like all other output, so a locale file (e.g. from a third party) with quotes
+ * or markup in its texts can't break out of attributes or add elements. Uses a generated locale file.
+ */
+final class LocaleEscapingTest extends AppTestCase
+{
+	private const PAYLOAD = '"><img src=x onerror=alert(1)>\'<script>alert(2)</script>&amp;';
+
+	protected function configOverrides(): array
+	{
+		return ['W2_LOCALE' => 'generated'];
+	}
+
+	protected function setUp(): void
+	{
+		parent::setUp();
+		$texts = [];
+		foreach (['All', 'New', 'Upload', 'Search', 'Home', 'Edit', 'Save', 'Cancel', 'Title', 'Close', 'Formatting help', 'Header', 'Bold', 'Emphasize'] as $key) {
+			$texts[$key] = self::PAYLOAD . $key;
+		}
+		file_put_contents($this->server->rootDir() . '/locales/generated.php', "<?php\n\$w2_word_set = " . var_export($texts, true) . ";\n");
+	}
+
+	protected function tearDown(): void
+	{
+		@unlink($this->server->rootDir() . '/locales/generated.php');
+		parent::tearDown();
+	}
+
+	public function testTextsWithMarkupAndQuotesAreEscaped(): void
+	{
+		foreach (['/index.php', '/index.php?action=all', '/index.php?action=new', '/index.php?action=edit&page=Home'] as $url) {
+			$response = $this->http->get($url);
+			$this->assertSame(200, $response->status, $url);
+			$this->assertStringNotContainsString('<script>alert(2)', $response->body, $url);
+			$this->assertStringNotContainsString('<img src=x', $response->body, $url);
+			$this->assertStringNotContainsString('onerror=alert(1)>', $response->body, $url);
+			$this->assertStringContainsString(
+				'title="' . htmlspecialchars(self::PAYLOAD . 'All', ENT_QUOTES, 'UTF-8') . '"',
+				$response->body,
+				"the text is shown, escaped: $url"
+			);
+		}
+	}
+
+	public function testAttributesCannotBeClosedByTranslations(): void
+	{
+		$dom = new \DOMDocument();
+		@$dom->loadHTML('<?xml encoding="UTF-8">' . $this->http->get('/index.php')->body);
+		foreach ($dom->getElementsByTagName('img') as $img) {
+			$this->assertFalse($img->hasAttribute('onerror'), 'an img element got an event handler');
+			$this->assertNotSame('x', $img->getAttribute('src'));
+		}
+	}
+}
diff --git a/tests/Integration/LocaleTest.php b/tests/Integration/LocaleTest.php
new file mode 100644
index 0000000..aec8db8
--- /dev/null
+++ b/tests/Integration/LocaleTest.php
@@ -0,0 +1,214 @@
+<?php
+
+namespace W2\Tests\Integration;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use W2\Tests\Support\AppTestCase;
+
+/**
+ * Every locale file can be used: the main views are shown (PHP warnings fail the test, see AppTestCase::tearDown),
+ * with the language of the page set, and the translated texts used.
+ *
+ * The locale is the name of the data set (see configOverrides()).
+ */
+final class LocaleTest extends AppTestCase
+{
+	private const VIEWS = [
+		'/index.php',
+		'/index.php/MarkdownSyntax',
+		'/index.php?action=all',
+		'/index.php?action=new',
+		'/index.php?action=upload',
+		'/index.php?action=edit&page=Home',
+		'/index.php?action=rename&page=Home',
+		'/index.php?action=delete&page=Home',
+		'/index.php?action=view&page=Home&linkshere=true',
+		'/index.php/Nonexistent',
+		'/index.php?action=search&q=home',
+		'/index.php?action=imgRename&imgName=a.gif&prevpage=Home',
+		'/index.php?action=imgDelete&imgName=a.gif&prevpage=Home',
+	];
+
+	public static function locales(): array
+	{
+		$result = [];
+		foreach (glob(dirname(__DIR__, 2) . '/locales/*.php') as $file) {
+			$result[basename($file, '.php')] = [basename($file, '.php')];
+		}
+		return $result;
+	}
+
+	protected function configOverrides(): array
+	{
+		return ['W2_LOCALE' => (string)$this->dataName()];
+	}
+
+	/** @return array<string, string> */
+	private static function words(string $locale): array
+	{
+		return (function () use ($locale) {
+			defined('W2APP') || define('W2APP', true);
+			$w2_word_set = [];
+			require dirname(__DIR__, 2) . "/locales/$locale.php";
+			return $w2_word_set;
+		})();
+	}
+
+	#[DataProvider('locales')]
+	public function testAllViewsAreShown(string $locale): void
+	{
+		foreach (self::VIEWS as $url) {
+			$response = $this->http->get($url);
+			$this->assertSame(200, $response->status, "$locale: $url");
+			$this->assertStringContainsString('<div class="main">', $response->body, "$locale: $url");
+			$this->assertStringContainsString('</html>', $response->body, "$locale: $url");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testLanguageAndCharsetOfThePage(string $locale): void
+	{
+		$response = $this->http->get('/index.php');
+		$this->assertStringContainsString("<html lang=\"$locale\">", $response->body);
+		$this->assertStringContainsString('<meta charset="UTF-8">', $response->body);
+		$this->assertTrue(mb_check_encoding($response->body, 'UTF-8'), 'the page is not valid UTF-8');
+	}
+
+	#[DataProvider('locales')]
+	public function testToolbarTooltipsAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$body = $this->http->get('/index.php')->body;
+		foreach (['All', 'New', 'Upload'] as $key) {
+			$text = htmlspecialchars($words[$key] ?? $key, ENT_QUOTES, 'UTF-8');
+			$this->assertStringContainsString("title=\"$text\"", $body, "$locale: tooltip '$key'");
+		}
+		$this->assertStringContainsString('placeholder="' . htmlspecialchars($words['Search'] ?? 'Search', ENT_QUOTES, 'UTF-8') . '"', $body);
+	}
+
+	#[DataProvider('locales')]
+	public function testTitlesAndDatesUseTheLocale(string $locale): void
+	{
+		$words = self::words($locale);
+		$body = $this->http->get('/index.php?action=all')->body;
+		$this->assertStringContainsString('<span class="title">' . htmlspecialchars($words['All'] ?? 'All', ENT_QUOTES, 'UTF-8') . '</span>', $body);
+		$page = $this->http->get('/index.php/Home')->body;
+		$format = $words['date_format'] ?? null;
+		if ($format !== null) {
+			$this->assertMatchesRegularExpression('/<span class="titledate">[^<]+<\/span>/', $page);
+		}
+	}
+
+	private static function text(array $words, string $key): string
+	{
+		return htmlspecialchars($words[$key] ?? $key, ENT_QUOTES, 'UTF-8');
+	}
+
+	#[DataProvider('locales')]
+	public function testListHeadersAndFormButtonsAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		foreach (['/index.php?action=upload', '/index.php?action=all'] as $url) {
+			$body = $this->http->get($url)->body;
+			foreach (['Name', 'Modified', 'Size'] as $key) {
+				$this->assertStringContainsString('>' . self::text($words, $key) . '</', $body, "$locale: $url $key");
+			}
+		}
+		$this->assertStringContainsString('value="' . self::text($words, 'Cancel') . '"', $this->http->get('/index.php?action=delete&page=Home')->body);
+		$this->assertStringContainsString('<h1>' . self::text($words, 'Search') . ': home</h1>', $this->http->get('/index.php?action=search&q=home')->body);
+	}
+
+	#[DataProvider('locales')]
+	public function testUploadScriptMessagesAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$body = $this->http->get('/index.php?action=upload')->body;
+		foreach (['No file selected!', 'File %s already exists. Overwrite?'] as $key) {
+			$literal = json_encode($words[$key] ?? $key, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_UNICODE);
+			$this->assertStringContainsString($literal, $body, "$locale: $key");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testPageCreationErrorsAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$existing = $this->savePage('Home', 'again')->body;
+		$key = "Error creating page '%s' - it already exists! Please choose a different name, or %s the existing page (this discards current text!)!";
+		$this->assertStringContainsString(
+			sprintf(self::text($words, $key), 'Home', '<a href="?action=edit&amp;page=Home">' . self::text($words, 'edit') . '</a>'),
+			$existing,
+			$locale
+		);
+		$key = "Error creating page '%s' - invalid page name! Page names must not start with '%s/', or contain empty or hidden ('.'-prefixed) folder names.";
+		$this->assertStringContainsString(
+			sprintf(self::text($words, $key), '.hidden/x', 'images'),
+			$this->savePage('.hidden/x', 'text')->body,
+			$locale
+		);
+	}
+
+	#[DataProvider('locales')]
+	public function testUploadMessagesAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$upload = fn() => $this->upload('a.gif', self::gif());
+		$note = $this->noteAfter($upload());
+		$this->assertStringContainsString(html_entity_decode(sprintf(self::text($words, "File '%s' uploaded!"), 'a.gif'), ENT_QUOTES), $note, $locale);
+		$this->assertStringContainsString(
+			html_entity_decode(sprintf(self::text($words, 'Use %s to refer to it!'), '![' . ($words['Image Description'] ?? 'Image Description') . '](/images/a.gif)'), ENT_QUOTES),
+			$note,
+			$locale
+		);
+		$note = $this->noteAfter($upload());
+		$this->assertStringContainsString(html_entity_decode(sprintf(self::text($words, '%s already exists!'), 'a.gif'), ENT_QUOTES), $note, $locale);
+	}
+
+	#[DataProvider('locales')]
+	public function testSimilarPageNoteIsTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$this->savePage('Similar Page', 'x');
+		$body = $this->http->get($this->pageUrl('Simular Page'))->body;
+		$this->assertStringContainsString('<strong>' . self::text($words, 'Note') . ':</strong>', $body, $locale);
+		$this->assertStringContainsString(
+			sprintf(self::text($words, 'Found similar page %s. Maybe you meant to edit this instead?'), '<a href="/index.php/Similar%20Page">Similar Page</a>'),
+			$body,
+			$locale
+		);
+	}
+
+	#[DataProvider('locales')]
+	public function testMessagesOfRejectedRequestsAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$response = $this->http->post('/index.php', ['action' => 'save', 'page' => 'X', 'newText' => 'x']);
+		$this->assertSame(403, $response->status);
+		$this->assertStringContainsString(
+			self::text($words, 'Invalid request: missing or wrong security token. Please go back, reload the page and try again.'),
+			$response->body,
+			$locale
+		);
+	}
+
+	#[DataProvider('locales')]
+	public function testMarkdownHelpExamplesAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$body = $this->http->get('/index.php?action=edit&page=Home')->body;
+		$expected = [
+			'[[' . self::text($words, 'Link to page') . ']]',
+			'[' . self::text($words, 'link text') . '](http://url)',
+			'![' . self::text($words, 'Alt text') . '](/images/image.jpg "' . self::text($words, 'Optional title') . '")',
+			'- ' . self::text($words, 'Unordered list') . '<br/>',
+			'1. ' . self::text($words, 'Ordered list') . '<br/>',
+			'```' . self::text($words, 'Code') . '```',
+			'`' . self::text($words, 'Inline code') . '`',
+			'--- ' . self::text($words, 'Horizontal rule') . '<br/>',
+		];
+		foreach ($expected as $text) {
+			// (quotes are escaped by __(), the example title is in quotes of the markup)
+			$this->assertStringContainsString(str_replace('&quot;', '"', $text), str_replace('&quot;', '"', $body), $locale);
+		}
+	}
+}
diff --git a/tests/README.md b/tests/README.md
index 4079d1e..1f1cd32 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -33,7 +33,11 @@ also fails if the wiki logged PHP warnings, notices or deprecations while it ran
   `SourceGuardTest` looks at the tokens of the PHP files and fails on dangerous constructs: functions running code or
   commands, variables in regular expressions that are not quoted with `preg_quote()`, files included by variable
   names, and request data read outside the entry points.
-- `tests/Integration`: the tests. To test with another configuration, override
+  `LocaleFilesTest` checks the files in `locales/` (valid PHP, no duplicate keys, UTF-8, date formats) ;
+  `locales/en.php` only has entries that differ from their key (`__()` returns the key for texts without entry).
+  Texts of the code (`__()` calls) missing in the other languages are only reported as "incomplete".
+- `tests/Integration`: the tests. `LocaleTest` runs the main views with every locale file (the data set name is
+  the locale, set with `W2_LOCALE`); `LocaleEscapingTest` uses a generated locale with markup in its texts. To test with another configuration, override
   `configOverrides()` in the test class; it returns values for the constants defined in
   `config.php` (or `$allowedIPs`).
 
diff --git a/tests/Unit/LocaleFilesTest.php b/tests/Unit/LocaleFilesTest.php
new file mode 100644
index 0000000..d8a4703
--- /dev/null
+++ b/tests/Unit/LocaleFilesTest.php
@@ -0,0 +1,194 @@
+<?php
+
+namespace W2\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * The locale files are valid and well-formed. Texts used in the code which a language doesn't translate are
+ * reported as "incomplete" but don't fail, because __() falls back to the English text.
+ */
+final class LocaleFilesTest extends TestCase
+{
+	private const SOURCE_FILES = ['index.php', 'api.php', 'auth.php', 'auth_functions.php', 'functions.php'];
+	private const ROOT_LOCALE = 'en';
+
+	public static function locales(): array
+	{
+		$result = [];
+		foreach (glob(dirname(__DIR__, 2) . '/locales/*.php') as $file) {
+			$result[basename($file, '.php')] = [basename($file, '.php')];
+		}
+		return $result;
+	}
+
+	/** Loads a locale file the way index.php does, but in isolation from the globals of the test run */
+	private static function load(string $locale): array
+	{
+		$file = dirname(__DIR__, 2) . "/locales/$locale.php";
+		return (function () use ($file) {
+			$w2_word_set = null;
+			require $file;
+			return $w2_word_set;
+		})();
+	}
+
+	/** @return string[] keys of literal __() calls in the code (dynamic calls such as __($action) can't be known) */
+	private static function usedKeys(): array
+	{
+		$keys = [];
+		foreach (self::SOURCE_FILES as $file) {
+			$tokens = array_values(array_filter(
+				token_get_all((string)file_get_contents(dirname(__DIR__, 2) . "/$file")),
+				fn($token) => !is_array($token) || !in_array($token[0], [T_WHITESPACE, T_COMMENT, T_DOC_COMMENT], true)
+			));
+			foreach ($tokens as $i => $token) {
+				$previous = $tokens[$i - 1] ?? '';
+				if (is_array($token) && $token[0] === T_STRING && in_array($token[1], ['__', '__js'], true) && ($tokens[$i + 1] ?? '') === '('
+					&& !(is_array($previous) && $previous[0] === T_FUNCTION)
+					&& is_array($tokens[$i + 2] ?? null) && $tokens[$i + 2][0] === T_CONSTANT_ENCAPSED_STRING) {
+					$keys[] = eval('return ' . $tokens[$i + 2][1] . ';');
+				}
+			}
+		}
+		return array_values(array_unique($keys));
+	}
+
+	/** The keys of the array literal in the file, in order, to find duplicates (PHP silently keeps the last one) */
+	private static function declaredKeys(string $locale): array
+	{
+		$tokens = array_values(array_filter(
+			token_get_all((string)file_get_contents(dirname(__DIR__, 2) . "/locales/$locale.php")),
+			fn($token) => !is_array($token) || !in_array($token[0], [T_WHITESPACE, T_COMMENT, T_DOC_COMMENT], true)
+		));
+		$keys = [];
+		foreach ($tokens as $i => $token) {
+			if (is_array($token) && $token[0] === T_DOUBLE_ARROW && is_array($tokens[$i - 1])
+				&& $tokens[$i - 1][0] === T_CONSTANT_ENCAPSED_STRING) {
+				$keys[] = eval('return ' . $tokens[$i - 1][1] . ';');
+			}
+		}
+		return $keys;
+	}
+
+	#[DataProvider('locales')]
+	public function testFileDefinesAnArrayOfStrings(string $locale): void
+	{
+		$words = self::load($locale);
+		$this->assertIsArray($words);
+		$this->assertNotEmpty($words);
+		foreach ($words as $key => $value) {
+			$this->assertIsString($key);
+			$this->assertIsString($value, "value of '$key'");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testFileHasNoOutputAndNoByteOrderMark(string $locale): void
+	{
+		$source = (string)file_get_contents(dirname(__DIR__, 2) . "/locales/$locale.php");
+		$this->assertStringStartsWith('<?php', $source, 'no byte order mark or output before the PHP tag');
+		ob_start();
+		self::load($locale);
+		$this->assertSame('', ob_get_clean());
+	}
+
+	#[DataProvider('locales')]
+	public function testFileIsValidUtf8WithoutControlCharacters(string $locale): void
+	{
+		$source = (string)file_get_contents(dirname(__DIR__, 2) . "/locales/$locale.php");
+		$this->assertTrue(mb_check_encoding($source, 'UTF-8'), 'not UTF-8');
+		foreach (self::load($locale) as $key => $value) {
+			$this->assertDoesNotMatchRegularExpression('/[\x00-\x08\x0B-\x1F\x7F]/', $value, "value of '$key'");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testFileHasNoDuplicateKeys(string $locale): void
+	{
+		$keys = self::declaredKeys($locale);
+		$this->assertNotEmpty($keys);
+		$this->assertSame([], array_keys(array_filter(array_count_values($keys), fn($n) => $n > 1)));
+	}
+
+	#[DataProvider('locales')]
+	public function testTranslationsAreNotEmpty(string $locale): void
+	{
+		// __() treats empty values like missing ones, so they only hide the fallback
+		foreach (self::load($locale) as $key => $value) {
+			$this->assertNotSame('', trim($value), "value of '$key'");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testDateFormatsAreValid(string $locale): void
+	{
+		$words = self::load($locale);
+		foreach (['date_format', 'date_format_no_time'] as $key) {
+			if (!isset($words[$key])) {
+				continue;
+			}
+			$formatted = date($words[$key], 86400 * 365);
+			$this->assertNotSame($words[$key], $formatted, "$key is not a date format");
+			$this->assertMatchesRegularExpression('/\d/', $formatted, $key);
+			$this->assertNotFalse(\DateTime::createFromFormat($words[$key], $formatted), "$key can't be parsed back");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testPlaceholdersAreKept(string $locale): void
+	{
+		$this->addToAssertionCount(1);
+		foreach (self::load($locale) as $key => $value) {
+			if (str_contains($key, '%s')) {
+				$this->assertSame(substr_count($key, '%s'), substr_count($value, '%s'), "placeholders of '$key'");
+			}
+		}
+	}
+
+	/** Texts used in the code, and the entries which aren't texts of the code (e.g. titles looked up by action name) */
+	private static function knownKeys(): array
+	{
+		// 'Home' is the value of DEFAULT_PAGE, which is looked up with __(DEFAULT_PAGE)
+		return array_values(array_unique(array_merge(self::usedKeys(), ['Home'], array_keys(self::load(self::ROOT_LOCALE)))));
+	}
+
+	public function testEnglishOnlyHasEntriesWhichDifferFromTheirKey(): void
+	{
+		// __() returns the key for texts without entry, so identical entries only need to be maintained
+		foreach (self::load(self::ROOT_LOCALE) as $key => $value) {
+			$this->assertNotSame($key, $value, "'$key' is shown as it is without an entry in locales/en.php");
+		}
+	}
+
+	public function testExtractionFindsTheTextsOfTheCode(): void
+	{
+		$keys = self::usedKeys();
+		foreach (['Wrong password', 'Invalid page name', 'Upload error', 'date_format'] as $key) {
+			$this->assertContains($key, $keys);
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testNoUnknownTexts(string $locale): void
+	{
+		// e.g. a text of the code was renamed or has a typo (then it's never used)
+		$unknown = array_values(array_diff(array_keys(self::load($locale)), self::knownKeys()));
+		$this->assertSame([], $unknown, "texts of locales/$locale.php which are not used in the code");
+	}
+
+	#[DataProvider('locales')]
+	public function testMissingTranslationsAreReported(string $locale): void
+	{
+		if ($locale === self::ROOT_LOCALE) {
+			$this->addToAssertionCount(1);
+			return;
+		}
+		$missing = array_values(array_diff(self::knownKeys(), array_keys(self::load($locale))));
+		if ($missing) {
+			$this->markTestIncomplete(count($missing) . " texts of the code are not translated in locales/$locale.php (the English text is shown): " . implode(', ', $missing));
+		}
+		$this->addToAssertionCount(1);
+	}
+}