OpenTofu vs Terraform: the differences that matter
OpenTofu began as a fork of Terraform 1.5 and still runs most Terraform configurations unchanged. The differences are in license, governance, and a growing set of features each project added on its own.
How OpenTofu started
In August 2023 HashiCorp announced that Terraform would move from the Mozilla Public License 2.0 to the Business Source License (BSL), starting with version 1.6. The BSL restricts using Terraform in products that compete with HashiCorp.
A group of companies and community members forked the last MPL-licensed release, Terraform 1.5, as OpenTF. The project was renamed OpenTofu, joined the Linux Foundation, and shipped its first stable release, OpenTofu 1.6.0, in January 2024.
OpenTofu vs Terraform at a glance
| OpenTofu | Terraform | |
|---|---|---|
| License | MPL 2.0 (open source) | Business Source License 1.1 |
| Governance | Linux Foundation, community steering committee | HashiCorp, an IBM company |
| CLI | tofu | terraform |
| Language | HCL | HCL |
| Providers | Same providers, served from registry.opentofu.org | registry.terraform.io |
| State encryption | Built in, client-side, since 1.7 | Relies on the backend's storage encryption |
| Managed platform | Several, including StackShip | HCP Terraform and Terraform Enterprise |
Is OpenTofu compatible with Terraform?
Largely, yes. Because OpenTofu forked from Terraform 1.5, it reads the same HCL, uses the same provider plugin protocol, and understands the same state format. The public registry mirrors the providers and modules you already use, so hashicorp/aws resolves the same way.
Two things deserve a check before you switch:
- Features added to Terraform after 1.5. The projects have added features independently since the fork. If a configuration uses something introduced in a later Terraform release, confirm OpenTofu supports it in the version you plan to use.
- State written by a newer Terraform. Make sure your OpenTofu version can read state last written by your current Terraform version. Run a plan before you write anything.
What OpenTofu added
OpenTofu has shipped features the community asked Terraform for over many years:
- State and plan encryption (1.7). Encrypt state and plan files on the client with a passphrase or a cloud key management service, so the backend only ever stores ciphertext.
- Early variable evaluation (1.8). Use variables and locals in places that used to need literals, such as backend configuration and module sources.
- Provider
for_each(1.9). Create one provider configuration per region or account from a single block. - The
-excludeflag (1.9). The opposite of-target: plan everything except the addresses you name.
Terraform, in turn, has features tied to HashiCorp's platform, such as Sentinel policies and Terraform Stacks in HCP Terraform.
Which should you choose?
Choose OpenTofu if you want:
- an open-source license with no restrictions on how you use it;
- a tool governed by a foundation rather than a single vendor;
- client-side state encryption; or
- freedom to pick any managed platform, or none.
Stay on Terraform if you depend on HCP Terraform-only features such as Sentinel or Stacks and are happy with its pricing.
How to switch from Terraform to OpenTofu
- Install OpenTofu and pick a version. Pin it in CI and in your platform's workspace settings.
- Back up your state.
- In your configuration directory, run
tofu init. Commit any changes it makes to.terraform.lock.hcl. - Run
tofu plan. It should show no changes. Investigate anything unexpected before you apply. - Replace
terraformwithtofuin scripts and CI.
tofu init
tofu plan # expect: No changes. Your infrastructure matches the configuration.If you also want to leave Terraform Cloud, StackShip works as an OpenTofu cloud backend: set hostname = "stackship.run" in your cloud block and follow the migration guide.