OpenTofu vs Terraform in 2026: which should a startup use?

Every few months a founder or a new engineer asks me the same question: should we use Terraform or OpenTofu? Three years after the split, the honest answer for most startups is that both work, and the choice matters less than people think. What matters is picking one on purpose, knowing which features tie you to it, and keeping the door open.

Here is where things stand in late 2026, and how to decide.

How we got here

• August 2023: HashiCorp moved Terraform from the open-source MPL 2.0 licence to the Business Source License (BSL).
• Late 2023: The community forked the last open-source version (1.5) as OpenTofu, now hosted by the Linux Foundation under MPL 2.0.
• 2025: IBM completed its acquisition of HashiCorp. The licence stayed the same.

As of late October 2026, the current releases are Terraform 1.17 and OpenTofu 1.13 (Encore comparison, October 2026). Both ship regular releases, and both run the AWS provider you already use.

Does the licence affect your startup?

For most startups, no. The BSL restricts offering Terraform as a competing commercial product. Using Terraform to manage your own company’s infrastructure, in CI or on a laptop, is allowed.

Where it can matter:

• You build a product for other companies that runs Terraform for them (an internal developer platform you sell, a hosting product).
• Your company or your customers have a policy that requires open-source licences for core tooling.
• You want the security of a community-governed project that no single company can change.

If none of those apply, choose on features and ecosystem instead.

Features only one of them has

Both tools have moved on since the fork, mostly in different directions:

Feature	Terraform	OpenTofu
Same HCL, state format and AWS provider	Yes	Yes
Provider-defined functions	1.8+	1.7+
Ephemeral resources (secrets that never touch state)	1.10+	1.11+
State and plan encryption	No	1.7+
Variables and locals in the backend block	No	1.8+
for_each on provider configurations	No	1.9+
-exclude flag for plans	No	1.9+
Modules from OCI registries	No	1.10+
terraform query and list blocks (bulk import)	1.14+	No
Actions blocks	1.14+	No
Stacks (multi-deployment orchestration)	HCP Terraform	No

Source: Encore’s 2026 comparison and each project’s release notes.

The two that small teams care about most:

• State encryption (OpenTofu). Terraform state contains secrets: database passwords, generated keys, outputs. OpenTofu can encrypt the state file itself with a KMS key, so a leaked state file is useless. With Terraform, you rely on the S3 bucket’s encryption and access policy, which is fine if done well: see Terraform remote state on S3 with KMS.
• Bulk import (Terraform). terraform query searches the account and writes import blocks for you, which saves hours when bringing a click-built account into code: see importing existing AWS resources into Terraform.

What it looks like in the code

OpenTofu’s state encryption, using a KMS key you already have:

terraform {
  encryption {
    key_provider "aws_kms" "main" {
      kms_key_id = "alias/tofu-state"
      region     = "us-east-1"
      key_spec   = "AES_256"
    }
    method "aes_gcm" "main" {
      keys = key_provider.aws_kms.main
    }
    state {
      method = method.aes_gcm.main
    }
    plan {
      method = method.aes_gcm.main
    }
  }
}

And OpenTofu’s variables in the backend block, which Terraform still does not allow:

variable "env" {
  type = string
}

terraform {
  backend "s3" {
    bucket       = "acme-tofu-state"
    key          = "${var.env}/network.tfstate"
    region       = "us-east-1"
    use_lockfile = true
  }
}

The moment you add either of these, your code only works with OpenTofu. That is fine if it is a decision, not an accident.

How to choose

Pick Terraform if:

• You use or plan to use HCP Terraform (runs, policy, private registry, Stacks).
• You want terraform query and the newest Terraform features as soon as they ship.
• Your team, contractors and hiring pool all know “Terraform” and you see no reason to change.

Pick OpenTofu if:

• You need or prefer an open-source licence and community governance.
• You want state encryption without extra tooling.
• You run your own CI pipeline (GitHub Actions, GitLab) and do not need HCP Terraform.

If you are unsure, start with whichever your team already knows, and avoid the features in the bold rows of the table for now. That keeps switching cheap.

Switching from Terraform to OpenTofu safely

The tools share a state format, so there is no data to convert. Test it on a copy first:

# 1. Install OpenTofu next to Terraform (example: macOS or Linux with Homebrew)
brew install opentofu
tofu version

# 2. Work on a copy of the state, not production
terraform state pull > backup.tfstate

# 3. Initialise and plan with OpenTofu
tofu init
tofu plan

The plan should say No changes. If it does, switch CI by replacing the setup step. In GitHub Actions:

- uses: opentofu/setup-opentofu@v1
  with:
    tofu_version: 1.13.2
- run: tofu init -input=false
- run: tofu plan -input=false -no-color

Things to check before switching:

1. Your Terraform version. Moving from a Terraform release much newer than OpenTofu’s base can mean state written by newer features. Check that tofu plan reads it cleanly.
2. Terraform-only features in your code: list blocks, action blocks, HCP Terraform cloud blocks. Remove or replace them first.
3. Lock files. Run tofu init -upgrade once so .terraform.lock.hcl records providers from the OpenTofu registry, and commit it.

Going back the other way works the same, as long as you have not used OpenTofu-only features such as state encryption.

My default for small teams

For a startup with one or two AWS accounts, a GitHub Actions pipeline and no HCP Terraform, I am comfortable with either, and I set up both for clients. What matters far more than the tool:

• State in a versioned, encrypted, locked S3 bucket.
• Every change through a pull request with a plan in the review.
• No long-lived AWS keys in CI: see GitHub Actions to AWS with OIDC.
• A scheduled check that catches manual changes: see Terraform drift detection.

Get those right and either tool will serve you well for years.

OpenTofu vs Terraform checklist

1. Check whether the BSL licence actually affects your business. For most startups it does not.
2. List the features you need: state encryption points to OpenTofu, terraform query and HCP Terraform point to Terraform.
3. Pick one on purpose and write the decision down.
4. Avoid features only one tool has, unless you chose that tool for them.
5. If you switch, test plan on a copy of the state and expect “No changes”.

Need a second opinion on your setup? The Terraform consulting service works with both, or start with a Free AWS Review.

Version and feature information is from Encore’s OpenTofu vs Terraform comparison (updated October 2026), the OpenTofu documentation and the Terraform documentation, checked in November 2026.