Terraform or OpenTofu?

For about a decade, the question "which tool should we use for infrastructure as code?" had a boring answer: Terraform. Then, in 2023, things got interesting. Today there are two tools that look almost identical, share most of their history, and come from very different places.

If you're starting a new project or thinking about switching, here's how I see it.

How we got here

August 2023: HashiCorp changed Terraform's license from the open-source Mozilla Public License (MPL) to the Business Source License (BSL). In short: you can still use Terraform freely, but you can't build a competing commercial product on it. Many companies and community members felt this broke the promise of an open tool that thousands had contributed to.

September 2023: A group of companies forked the last open-source version. The fork became OpenTofu and joined the Linux Foundation, later becoming a CNCF project.

2024–2025: IBM announced it would acquire HashiCorp, and completed the acquisition in early 2025. Terraform is now an IBM product.

Since then, both tools have released new versions, and they've started to grow apart.

What's different now

The core is still very similar. Both use HCL, the same provider ecosystem, the same state format (mostly), and the same init, plan, apply workflow. Your existing code generally works in both.

But each has features the other doesn't, or implements differently.

OpenTofu highlights: - State encryption built in. Your state file, which often contains secrets, can be encrypted client-side with keys from a KMS. - Early variable evaluation: variables and locals can be used in places like module sources and backend configuration. - for_each on providers, making multi-region and multi-account setups much cleaner. - A community-driven roadmap, where many long-requested features from the Terraform issue tracker landed.

Terraform highlights: - Terraform Stacks for managing many related configurations and deployments together, tied to HCP Terraform. - Ephemeral resources and values, keeping secrets out of state and plan files. - Deep integration with HCP Terraform (the managed service) and the wider HashiCorp and IBM tooling. - Commercial support from a large vendor, which matters to some enterprises.

The code you write is still almost the same. The question is really about license, governance and which features you need.

The license question, honestly

For most companies that simply use Terraform to manage their own infrastructure, the BSL changes nothing in practice. You can keep using it for free.

It matters if:

• You build a product or service that competes with HashiCorp's offerings.
• Your company has a policy of only using OSI-approved open-source software.
• You care about the long-term governance: a vendor-controlled tool versus a foundation-governed one.

Switching, step by step

Moving from Terraform to OpenTofu is usually straightforward, especially from Terraform 1.5 or earlier:

1. Back up your state.
2. Install OpenTofu and run tofu init in a test configuration.
3. Run tofu plan. If it shows no changes, you're compatible.
4. Check providers: OpenTofu uses its own registry, which mirrors the common providers.
5. Update CI to use the tofu binary.
6. Avoid using new features of one tool until you've decided, so you can still switch back.

The further both tools diverge, the harder moving between them becomes. Using Terraform Stacks or OpenTofu's state encryption ties you to that tool.

Where each one is heading

Terraform is focused on enterprise workflows: HCP Terraform, Stacks, integrations with IBM's portfolio, and policy and governance features.

OpenTofu is focused on community-requested features, openness, and being a neutral foundation for the ecosystem. Several infrastructure automation platforms (like Spacelift, env0, Scalr and Harness) support it actively.

Both look healthy. Neither is going away soon.

Which one I'd pick

• New project, no strong vendor ties: I'd lean towards OpenTofu. Open governance, useful features like state encryption, and full compatibility with the ecosystem.
• Already deep in HCP Terraform or HashiCorp's enterprise tools: stay with Terraform. Switching costs more than it saves.
• Existing Terraform setup, no problems: no urgency. Keep your code compatible with both for now, and decide when a feature or policy makes the choice for you.

My take: the HCL you write matters more than the binary that runs it. Keep your code clean and portable, and the choice stays yours.

— Desly