OpenTofu

OpenTofu is the open-source infrastructure-as-code tool that many sysadmins and DevOps engineers use as a free alternative to Terraform. You describe servers, networks, DNS records and cloud resources in HCL files, run tofu plan to see what would change and tofu apply to make it so. If you are looking for an OpenTofu download, the latest release published on GitHub is 1.13.2 (21 October 2026), a single binary for Windows, Linux and macOS.

The reason it exists is the licence. Terraform moved to the Business Source License in version 1.6.0, while OpenTofu stays under the Mozilla Public License 2.0, the licence Terraform used before. The LICENSE file of the project still carries HashiCorp’s 2014 copyright next to the OpenTofu Authors, which shows where the code base comes from. We compare the two tools in Terraform vs OpenTofu.

OpenTofu at a glance

Last verified: 3 November 2026, on the GitHub releases page, the project README, the LICENSE file and the 1.12 and 1.13 changelogs. The opentofu.org site could not be opened from our checking machine that day, so install steps for package managers are not repeated here; use the official install page for them. Tested by us: Not tested yet. Commands below come from the project documentation and release files.

What it does

• Declares infrastructure in configuration files (HCL): resources, variables, outputs and modules.
• Shows an execution plan before any change, so a reviewer can approve exactly what will be created, updated or destroyed.
• Builds a resource graph and creates independent resources in parallel.
• Tracks what it manages in a state file, locally or in a remote backend, so the next run changes only what differs.
• Works with providers for existing platforms and custom in-house systems.
• New in 1.13: official Windows on ARM64 packages, a convert function and other helpers that let module authors give hints during planning, plus two experiments: built-in linting and symbol libraries.
• Added in 1.12: a destroy setting in lifecycle, input variables declared with const = true, a language block for version constraints and -json-into for writing machine-readable output to a file.

How sysadmins use it

Create and remove a test environment

1. Make a folder and add a main.tf with a required_providers block for your platform and one resource, for example a VM or a DNS record.
2. Run tofu init. It downloads the provider and writes a lock file; commit the lock file to Git.
3. Run tofu plan -out tfplan and read the summary line (“1 to add, 0 to change, 0 to destroy”).
4. Run tofu apply tfplan. When the test is over, tofu destroy removes everything the state file knows about.

Move an existing Terraform project

1. Commit your current code and back up the state file or the remote state before anything else.
2. Run tofu init in the project folder and then tofu plan. A clean plan with no unexpected changes means the project reads correctly.
3. Switch the CI job from terraform to tofu, and keep the whole team on one tool, because both programs write to the same state.

Check the official migration notes for your Terraform version first; the two tools have been adding different features since the fork, so a very new Terraform feature may have no equivalent.

Review infrastructure changes like code

1. Store the files in Git and keep state in a remote backend with locking.
2. In CI, run tofu fmt -check, tofu validate and tofu plan on every pull request and post the plan as a comment.
3. Apply only from the main branch, by a pipeline job, never from laptops.

Install and first run

Windows. Download the zip for your CPU from the GitHub release (the 1.13.2 amd64 zip is about 36 MB), unpack tofu.exe into a folder such as C:Toolsopentofu, add that folder to the PATH environment variable, open a new terminal and run tofu version. Windows 10 and 11 use the same amd64 build; ARM laptops can use the arm64 build.

Linux. Each release carries deb, rpm and apk packages next to the tar.gz and zip archives. The simplest manual route is to unpack the archive for your architecture and copy tofu to /usr/local/bin. The official install page also describes package repositories and other methods.

macOS. Archives for Intel and Apple Silicon are published; version 1.13 requires macOS 13 Ventura or later.

Checks and gotchas. Every release ships a SHA256SUMS file and signature files (.sig, .pem, .gpgsig); verify the archive before unpacking on a build server. Providers download at init time, so a proxy or air-gapped network needs a provider mirror. Keep credentials in environment variables, not in the configuration, and never commit the state file. Nightly builds exist for testing, but they are experimental and removed after 30 days, so do not use them in production.

Limitations

• Not a configuration tool. It provisions machines and cloud objects; installing packages and settings inside a VM is a job for Ansible.
• State is a single source of truth that must be protected: a lost or corrupted state file means OpenTofu no longer knows what it created.
• Compatibility with Terraform is not guaranteed forever. The two projects add features separately, and OpenTofu 1.13 removed the WinRM connection type for provisioners and is the last series with official 32-bit builds.
• Release notes for 1.13.2 list two security fixes (a possible high CPU load when connecting to a hostile HTTP/2 server during tofu init, and filtering of compromised intermediate certificates), so stay on the newest patch of your series.
• No built-in team portal. Remote runs, approvals and permissions come from your CI system or a separate platform.

OpenTofu vs alternatives

The closest alternative is Terraform, which uses the same style of configuration and a different licence; our comparison explains when each one fits. Pulumi lets you write declarations in a general-purpose language, and AWS CloudFormation or Azure Bicep are tied to one cloud each. For local test VMs on a workstation, Vagrant is simpler. More tools of this kind are in our DevOps and automation tools guide.

FAQ

Where is the OpenTofu download?

Releases are published on GitHub (opentofu/opentofu) as zip, tar.gz, deb, rpm and apk files, and the official site opentofu.org has the install page. There is no Windows installer in the release files; you unpack tofu.exe and add it to PATH.

OpenTofu vs Terraform: what is the difference?

The main difference is the licence: OpenTofu is MPL 2.0 open source, Terraform is under the Business Source License 1.1. The command is tofu instead of terraform, and each project now adds its own features.

How do I install OpenTofu?

Unpack the archive for your system, put the tofu binary on PATH and run tofu version. Linux users can also take the deb, rpm or apk package from the release. Package-manager commands are on the official install page.

Which OpenTofu versions are supported?

According to the changelogs, 1.13.x is supported until 1 August 2027 and 1.12.x until 1 February 2027. Use the newest patch release of the series you run.

Is OpenTofu free?

Yes. It is free and open source under the Mozilla Public License 2.0, including for commercial use.

Where is the OpenTofu source code?

On GitHub in the opentofu/opentofu repository, together with the changelog, the release notes and the issue tracker.

Does OpenTofu work on Windows on ARM?

Yes. Starting with version 1.13.0 the project publishes official Windows ARM64 packages.

Last checked against official sources: 3 November 2026 (developer website: opentofu.org). Versions and licence terms change — confirm on the developer's site before deploying in production.