What is good, is that, by design rather than luck, up to +20mA can be pushed into an HC input without triggering destructive latch-up.
Tale a look at page 28 in this Philips (now Nexperia) application note.
BTW, I am not sure if 20mA continuous is possible – the internal resistance might get a little too warm.
According to my paper RCA high-speed CMOS logic ICs data book (SSD-290C), a 12V to 5V logic interface for CD74HC logic is simply a 100k resiestor (page 659-660) “RCA HC/HCT designs guarantee that forced input current into Vcc will result in less than 0.05 of this current flowing into ground…. Other high-to-low voltage-interface combinations with different resistor valuses may be determined with the knowledge of the 0.05 current gain [alpha] between adjacent inputs. The typical value of alpha for the bipolar transistor parasitic transistor is 0.001.”
So the last bit says, and it is worked out on the page, that if two inputs have 100k series resistors, and one is attached to 12V and one to 0V, that the current stuffed into the 12V-attached input can only cause enough current to be pushed out of the 0V-connected input to cause that input pin to rise up to 0.34V, far below the maximum logic 0 threshold – so no logic errors will be cause and no CMOS will be harmed.
Anyway, users of Arduinos are not this lucky, because Microchip (Atmel) made no such design decision. The ATmega328_P data sheet only says limit voltages on inputs to less that 0.5V outside the power rails, and not how much current will cause this.
However, all is not lost, because there is a Microchip app note that reveals something useful.
This next bit, in passing, mentions connections to the electricity mains, and is is possible folk other than professional engineers will read this so:
Never connect an AVR or Arduino to the mains, unless you really know what you are doing already and have read AVR182.
‘AVR182: Zero Cross Detector‘ describes a scheme to connect mains voltage to an AVR microcontroler via two 1M resistors (see diag). It goes on to say: “The series input resistor is a 1MΩ resistor. It is not recommended that the [input protection] clamping diodes are conducting more than maximum 1mA, and 1MΩ will then allow a maximum voltage of approximately 1,000V.”
Page 8 goes on to say: “The series resistor can also be modified… …but note that the maximum current through the AVR’s clamping diode should not be higher than 1mA.”
So it looks like, so long as forced input current is less than 1mA, AVRs can be connected to voltages higher than Vdd, and so an AVR like an ATmega328 could be used to monitor the existence of a related 12V power supply using a simple series resistor (at least 12kΩ) on the input – and this could work on an Arduino Uno on input pins that are not connected to anything else.
That said, this scheme might cause errors on any ADC input, as that helpful information about parasitic-transistor-induced adjacent pin output current is not provided.