Terraform vs OpenTofu: Which to Use in 2026

Terraform and OpenTofu read the same HCL configuration and drive the same providers, so the real decision is about licence, governance and a few features rather than syntax. The short answer: if you only use Terraform for your own or your clients’ infrastructure, both are workable and you can stay where you are. If you build a product or hosted service on top of it, want a licence that never restricts use, or want built-in state encryption, OpenTofu is the safer pick. Facts below were checked against the official sites on 14 October 2026. Not tested yet: we have not benchmarked either tool, so there are no speed claims here.

Side-by-side comparison

The licence difference in plain terms

Terraform 1.6.0 and later are released under the Business Source License 1.1. According to the LICENSE file in the Terraform repository, the Additional Use Grant allows production use, except offering the software to others for payment, hosted or embedded, in a way that competes with the vendor’s paid products. Internal use inside your own organization is not treated as competitive, and free products are not either. The licence converts to MPL 2.0 four years after each version is published.

For a typical sysadmin or MSP team running its own infrastructure code, that grant is not a blocker. It matters if you ship Terraform inside a commercial product, run a managed-infrastructure platform, or your legal team simply prefers a licence without a “competitive offering” test. The OpenTofu repository uses MPL-2.0, and the project’s FAQ says it was created as a fork because the BSL and its use grant were considered ambiguous. This is not legal advice; read the licence text for your own case.

Is OpenTofu a drop-in replacement?

Mostly, but with limits. OpenTofu aims for compatibility with Terraform configurations, and most code should work unchanged. The FAQ states that OpenTofu works with existing state files up to those created by Terraform 1.5.x, and that it aims for feature parity while the community decides what to include. If your state was written by a newer Terraform release, read the official migration guide before touching it. Features that exist in only one tool will not port automatically, so check every version-specific attribute you rely on.

Migrating a small project

The official guide describes the move as safe and reversible and lists four steps: back up state and code, install OpenTofu, initialize and verify, then test with a small change. In practice:

1. Back up state. For local state, copy terraform.tfstate and its backup file. For a remote backend, use that backend’s own backup, for example object versioning on a bucket.
2. Install OpenTofu and run tofu init in the project. This downloads providers from the OpenTofu registry and initializes the backend.
3. Run tofu plan and confirm it reports no unexpected changes.
4. Apply one small, low-risk change before moving everything else.

Configurations that read each other with terraform_remote_state need extra care: the guide has a separate page for interdependent configurations, so migrate them in a planned order rather than one by one at random.

Where OpenTofu is ahead: state encryption

OpenTofu can encrypt state and plan files at rest, locally and through a backend. According to the encryption documentation, key providers include PBKDF2 (a passphrase of at least 16 characters), AWS KMS, GCP KMS and OpenBao. The shape of the configuration is:

terraform {
  encryption {
    key_provider "pbkdf2" "main" {
      passphrase = var.passphrase
    }
    method "aes_gcm" "main" {
      keys = key_provider.pbkdf2.main
    }
    state {
      method = method.aes_gcm.main
    }
  }
}

The same structure can be passed through the TF_ENCRYPTION environment variable. This is useful when state holds secrets and you cannot guarantee the storage bucket is locked down.

Other changes in recent OpenTofu releases

The release notes for OpenTofu 1.13 list official Windows on ARM64 builds, a convert function, and two experiments: basic linting through a -lint flag and Symbol Libraries. They also note that WinRM support for provisioners was removed, which matters if you used provisioners to configure Windows hosts. A better pattern is to let Terraform or OpenTofu create the machines and hand configuration to a tool built for it, such as Ansible, which manages Windows over WinRM or SSH.

Which one should you choose?

• Stay on Terraform if your team already uses it for internal infrastructure, relies on vendor-specific features, and has no licence concerns.
• Move to OpenTofu if you embed IaC in a product or service, want a foundation-governed MPL-2.0 project, or need state encryption without extra tooling.
• Starting fresh and unsure? Write plain HCL with common providers. Because the languages are close, you can switch later; just pin versions and keep backups.

Either tool pairs well with a local virtualization platform. If you want a lab target, Proxmox VE is free and open source, and our DevOps automation tools hub covers the surrounding CI/CD and configuration-management options.

Limitations

This comparison is based on official documentation and repositories, not on our own runs. We have not tested plan speed, provider compatibility or state migration on real projects. Version numbers change quickly; check each project’s release page before you upgrade.

FAQ

Is OpenTofu compatible with Terraform?

For most configurations, yes. OpenTofu works with current Terraform providers and with state files up to those created by Terraform 1.5.x. For newer state, follow the official migration guide and test on a copy.

Is OpenTofu free and open source?

Yes. It is released under MPL-2.0 and maintained as a Linux Foundation project.

Is OpenTofu a fork of Terraform?

Yes. It was created in response to the change of Terraform’s licence to the Business Source License.

Is Terraform still free to use?

Terraform can be used in production for internal purposes under its Additional Use Grant. The restriction targets offering competing hosted or embedded products. Check the LICENSE file for your situation.

Can I switch back from OpenTofu to Terraform?

The official guide calls the migration reversible, provided you kept backups and have not used features that exist only in OpenTofu, such as its state encryption.

OpenTofu vs Terraform vs Ansible: what is the difference?

Terraform and OpenTofu provision infrastructure from declarative code. Ansible configures what runs on that infrastructure. Many teams use one of each.

Last updated: 14 October 2026 · ITForgePro editorial team. Licence, version and platform details are checked against each developer's official documentation.