OpenTofu
Open-source fork of Terraform under the Linux Foundation / CNCF — 100% backward compatible, with native state encryption.
Overview
OpenTofu is a community-driven, CNCF Sandbox fork of Terraform 1.5.x, created after HashiCorp's BSL license change. It is a drop-in replacement for Terraform, maintaining 100% compatibility with existing Terraform configurations, state files, and providers. Its key differentiator is native client-side state encryption — a feature absent from Terraform.
Key Facts
| Attribute |
Detail |
| Repository |
github.com/opentofu/opentofu |
| Stars |
~24k+ ⭐ |
| Latest Version |
v1.12.0-beta1 (April 7, 2026) |
| Language |
Go |
| License |
MPL 2.0 (truly open-source) |
| Governance |
CNCF Sandbox (Linux Foundation) |
| Config Language |
HCL (same as Terraform) |
Evaluation
| Pros |
Cons |
| 100% Terraform compatible |
Newer, less battle-tested at hyperscale |
| MPL 2.0 — truly open-source |
Smaller community than Terraform |
| Native state encryption (AES-GCM) |
Feature parity lag on some Terraform features |
| CNCF governance, vendor-neutral |
No managed cloud offering (yet) |
| Community-driven roadmap |
Fewer third-party integrations |
| Drop-in replacement |
|
| Feature |
OpenTofu |
Terraform |
| License |
MPL 2.0 ✅ |
BSL 1.1 ⚠️ |
| State encryption |
Native (AES-GCM, AWS/GCP KMS, OpenBao) |
❌ Not available |
| Plan file encryption |
Yes |
❌ |
| Governance |
CNCF (community) |
HashiCorp (single vendor) |
| Key rotation |
Built-in fallback mechanism |
N/A |
| Provider compatibility |
Same Terraform providers |
Same |
Notes
Sources
Questions
Answered
- Q: Is OpenTofu a drop-in TF replacement? — Yes — same HCL, state, providers. Minutes to migrate.
Open
- Q: What is the migration path from Terraform Cloud to self-hosted OpenTofu state backends? — Evaluate state backend options (S3, GCS, pg) with state encryption enabled.
- Q: How does OpenTofu's provider development ecosystem compare to Terraform's? — Are there providers that work with one but not the other?