Cloud Parts

OpenTofu

The open-source fork of Terraform, created after HashiCorp’s 2023 licence change: same HCL, same providers, tofu instead of terraform.

What it is
Infrastructure as code
Type
Open source
Made by
Cloud Native Computing Foundation
License
MPL 2.0
Facts checked
6 October 2026
Website Source code

What it is

OpenTofu works the way Terraform does. You declare resources in HCL files, tofu plan compares them with a state file and shows what will be created, changed or destroyed, and tofu apply calls the cloud APIs through provider plugins. It began as a copy of Terraform’s last MPL-licensed code, so existing configurations, modules and providers work unchanged, and the project calls it a drop-in replacement: it reads state files created by Terraform up to the 1.5.x versions. Providers and modules come from the OpenTofu Registry, a public index kept in a git repository, where publishing is a pull request.

Since the fork the two tools have moved apart. OpenTofu added features the community had asked HashiCorp for: client-side encryption of state and plan files (1.7, April 2024), variables in backend and module source settings (1.8), and for_each on provider blocks for multi-region setups (1.9). Code that uses OpenTofu-only features can live in .tofu files, which OpenTofu reads in preference to a .tf file of the same name, so one module can serve both tools. The project started at the Linux Foundation in September 2023 and was accepted into the Cloud Native Computing Foundation as a Sandbox project in April 2025. Version 1.13, released at the end of September 2026, is supported until August 2027.

Why teams pick it

  • Open source under MPL 2.0 with neutral foundation governance, so it can be embedded in commercial products and hosted services that Terraform’s BSL rules out
  • Familiar to anyone who knows Terraform: the same HCL, the same providers and a documented migration path
  • Built-in state and plan encryption with a passphrase or a key from AWS KMS, GCP KMS, Azure Key Vault or OpenBao, whatever backend stores the state
  • Features Terraform doesn’t have, such as for_each over providers and variables in backend configuration

Watch out for

  • The two tools keep diverging: OpenTofu-only syntax won’t run on Terraform, and migration is documented for state from Terraform 1.5.x and earlier
  • The same model’s chores as Terraform: a state file to store, lock and protect, and drift whenever someone edits resources by hand
  • Encrypted state is unrecoverable without its key; the docs tell you to back up keys and an unencrypted state copy before turning it on
  • Still a CNCF Sandbox project, the earliest maturity level, which the CNCF describes as experimental

Alternatives

What all infrastructure as code have in common →
AWS Cloud Development Kit (CDK)AWSDefine AWS infrastructure in TypeScript, Python, Java, C# or Go; the CDK turns it into CloudFormation templates and CloudFormation deploys them.HashiCorp PackerCommercialBuilds machine images (AMIs, Azure and Google images, VMware, Docker) from one HCL template, so every server starts already configured.HCP WaypointCommercialHashiCorp’s hosted internal developer platform: developers create apps and add databases from templates that run Terraform modules in HCP Terraform.SSTOpen sourceA TypeScript framework that defines a whole app, from Next.js front end to functions, containers and databases, in one config file and deploys it to your own AWS or Cloudflare account.TerraformCommercialThe most widely used infrastructure-as-code tool: declare resources in HCL, review a plan, and apply it through provider plugins.

How it fits with other technologies

State on S3, locked with a lock file and encrypted with a KMS key · hcl

terraform {
  backend "s3" {
    bucket       = "acme-tofu-state"
    key          = "prod/network.tfstate"
    region       = "eu-west-1"
    use_lockfile = true  # S3-native locking, no DynamoDB table
  }
  encryption {
    key_provider "aws_kms" "main" {
      kms_key_id = "alias/tofu-state"
      region     = "eu-west-1"
      key_spec   = "AES_256"
    }
    method "aes_gcm" "main" {
      keys = key_provider.aws_kms.main
    }
    state {
      method   = method.aes_gcm.main
      enforced = true  # require encryption
    }
  }
}
# $ tofu init && tofu plan

See it in a real stack

No architecture uses OpenTofu yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2023–2026

Terraform was open source under the Mozilla Public License from its release in 2014, and a large ecosystem of modules, providers and companies grew around it. On August 10, 2023, HashiCorp moved it to the Business Source License, which allows free use but forbids competing with HashiCorp’s own products. Companies whose products were built on Terraform published the OpenTF Manifesto (now the OpenTofu Manifesto), calling the new licence vague and a “poison pill” and asking HashiCorp to return Terraform to open source. Gruntwork, Spacelift, Harness, env0 and Scalr were among those behind it.

HashiCorp didn’t, so they forked the last MPL code. On September 20, 2023, the Linux Foundation announced the project under its new name, OpenTofu, with pledges from more than 140 organisations and 600 individuals. The first stable release, 1.6.0, came out on January 10, 2024 after four months of work by almost 60 contributors, with a new registry and a testing feature.

The project then shipped what the community had long wanted from Terraform. State encryption in 1.7, released in April 2024, came from an RFC by a community member who had tried for years to get it into Terraform. In April 2025 OpenTofu was accepted into the CNCF Sandbox, and it has shipped a new minor version every few months since, reaching 1.13 in September 2026.

Why it’s built this way

Fork from the last open-source release
Starting from Terraform’s MPL code kept every existing configuration, module and provider working, so switching could be as simple as installing a different binary.
Stay backward compatible, and mark the differences
Users had years of Terraform code. New features land in OpenTofu, and the .tofu file extension lets module authors use them while keeping .tf files for Terraform users.
Neutral foundation governance
The fork existed because one company could change the licence. Placing it under the Linux Foundation, and later the CNCF, means no single vendor can relicense it.
A registry that is just a git repository
The team consulted the authors of earlier registries such as Homebrew’s and built a Homebrew-like index, so publishing a provider or module is a pull request.

Timeline

  1. 2023

    HashiCorp relicenses Terraform under the BSL on August 10; the OpenTF Manifesto follows

  2. 2023

    The Linux Foundation launches the fork as OpenTofu on September 20

  3. 2024

    OpenTofu 1.6.0, the first stable release, on January 10

  4. 2024

    1.7.0 adds end-to-end state encryption in April

  5. 2025

    1.9.0 adds provider for_each; accepted into the CNCF Sandbox in April

  6. 2026

    OpenTofu 1.13.0 released on September 29

Sources15 · facts checked 6 October 2026

Improve this page on GitHub