Comparison · Infrastructure
Terraform vs OpenTofu: 2026 comparison
TL;DR: They speak the same HCL and were CLI-compatible at the fork point. Pick OpenTofu for open governance, an MPL license, and features like state encryption. Pick Terraform if you want HashiCorp/IBM commercial support and tight HCP Terraform integration.
See also: What is infrastructure as code?
The headline difference
Terraform and OpenTofu are the same tool with a fork in the road. Both let you describe cloud infrastructure declaratively in HCL, plan a diff against current state, and apply it. The split is about ownership and licensing, not about whether the tool works. In August 2023 HashiCorp moved Terraform from the permissive MPL 2.0 to the Business Source License. The community forked the last MPL release into OpenTofu and handed it to the Linux Foundation. Since then the two roadmaps have diverged enough that the choice is now a real decision, not a coin flip.
Origin and licensing
Terraform ships under BSL 1.1. It is source-available: you can read it, run it, and self-host it, but you cannot use it to build a product that competes with HashiCorp. Each version converts to MPL four years after release. HashiCorp was acquired by IBM in 2024, so Terraform is now an IBM-owned product.
OpenTofu stays on MPL 2.0 — fully open source with no use restrictions — and is governed by a technical steering committee under the Linux Foundation rather than a single company. For most internal teams the license difference is invisible; for vendors and platform builders it is the whole point.
Feature scorecard
| Feature | Terraform | OpenTofu |
|---|---|---|
| License | BSL 1.1 (source-available) | MPL 2.0 (open source) |
| Governance | HashiCorp / IBM | Linux Foundation TSC |
| Language | HCL | HCL (compatible at fork) |
| State encryption | Via backends / external | Built-in client-side |
| Provider registry | HashiCorp Registry | Independent OpenTofu Registry |
| Provider-defined functions | Yes | Yes |
| Managed control plane | HCP Terraform | Spacelift, Scalr, env0, self-host |
| Commercial support | HashiCorp / IBM | Third-party vendors |
State encryption — OpenTofu's headline addition
The most-cited reason teams move to OpenTofu is built-in state encryption. Terraform state files contain secrets in plaintext (database passwords, keys, tokens) and historically had to be protected at the backend layer — encrypting the S3 bucket, locking down access. OpenTofu added client-side encryption of the state and plan files themselves, with key providers for AWS KMS, GCP KMS, Azure Key Vault, and PBKDF2 passphrases. The state is encrypted before it ever leaves the machine, which closes a long-standing gap for security-sensitive teams.
Registry and ecosystem
Terraform draws modules and providers from the HashiCorp Registry; OpenTofu operates its own registry that mirrors the major MPL-licensed providers. Because the big cloud providers (AWS, Azure, Google) remain MPL, both tools can use them. The control-plane ecosystem differs more sharply: Terraform integrates with HCP Terraform for remote state, policy, and runs, while OpenTofu is the default engine for independent platforms like Spacelift, Scalr, and env0. If your CI/CD is built around one of those, OpenTofu is the natural fit.
When to choose which
Choose OpenTofu when you value an open license and open governance, want built-in state encryption, are building tooling on top of the engine, or want insurance against future relicensing. It is the safe long-term default for teams that prize vendor independence.
Choose Terraform when you want first-party commercial support from HashiCorp/IBM, depend on HCP Terraform's managed runs and policy enforcement, or already standardise on the broader HashiCorp stack (Vault, Consul, Nomad).
Migration from Terraform 1.5/1.6 to OpenTofu is usually a binary swap plus updating provider source addresses; state is compatible at the fork point. Going back is harder once you adopt OpenTofu-only features, so treat the move as a one-way door and test in a non-production workspace first.
Verdict
For most engineering teams in 2026 the technical experience is nearly identical, so the decision is about values and support. OpenTofu wins on openness, licensing clarity, and state encryption; Terraform wins on first-party support and HCP integration. New projects that care about vendor independence should default to OpenTofu; teams already invested in HashiCorp's commercial platform have little reason to move.
Frequently asked questions
Why did OpenTofu fork from Terraform?
In August 2023 HashiCorp relicensed Terraform from the permissive MPL 2.0 to the Business Source License (BSL) 1.1. The BSL restricts using the code to build a product that competes with HashiCorp. A coalition of vendors and users forked the last MPL-licensed Terraform, formed the OpenTofu project, and donated it to the Linux Foundation in September 2023. OpenTofu remains MPL 2.0 and is governed openly rather than by a single vendor.
Is OpenTofu a drop-in replacement for Terraform?
For most existing configurations, yes. OpenTofu 1.6 was deliberately CLI- and state-compatible with Terraform 1.5/1.6, and migration is typically swapping the binary and provider source addresses. The two have diverged since: OpenTofu shipped state encryption, provider-defined functions, and an independent registry, while Terraform added its own features under HashiCorp's roadmap (and is owned by IBM after the 2024 acquisition). Newer HCL features from either project are not guaranteed to round-trip.
What is the difference in licensing?
OpenTofu is MPL 2.0 — a permissive open-source license with no use restrictions. Terraform is BSL 1.1, which is source-available: you can read and self-host it, but you cannot use it to build a competing commercial product, and each version converts to MPL only four years after release. For most internal users the BSL is a non-event; for vendors building tooling on top, the license matters.
Do the provider registries differ?
Yes. Terraform pulls from the HashiCorp Registry. OpenTofu runs its own registry that mirrors the major providers (AWS, Azure, Google, etc.) which remain MPL-licensed and usable by both. Most popular providers and modules are available on both, but the registries are operated independently, so availability and versioning can drift over time.
Should a new project pick Terraform or OpenTofu in 2026?
Both are production-ready. Pick OpenTofu if open governance, a permissive license, and features like built-in state encryption matter to you, or if you want to avoid future relicensing surprises. Pick Terraform if you want HashiCorp/IBM's commercial support, tight integration with HCP Terraform (formerly Terraform Cloud), or your organisation already standardises on the HashiCorp ecosystem.