Terraform moved from the MPL 2.0 license to the Business Source License on August 10, 2023. OpenTofu is the Linux Foundation fork that kept MPL 2.0 and joined the CNCF Sandbox on April 23, 2025. If you only run your own infrastructure, both work today. The license starts to matter when you sell a product or service built on top of the tool, or when you want the least licensing text to read.
What happened, in order?
| Date | Event | Source |
|---|---|---|
| 2023-08-10 | HashiCorp moves Terraform from MPL 2.0 to the Business Source License (BSL) 1.1 for all future releases | HashiCorp |
| 2023-08-25 | No reply from HashiCorp by this date, so the OpenTofu initiative forks Terraform, and the fork is maintained in the Linux Foundation | OpenTofu manifesto |
| 2024-01-10 | OpenTofu 1.6.0, the first stable release | OpenTofu blog |
| 2025-02-27 | IBM completes its acquisition of HashiCorp | IBM newsroom |
| 2025-04-23 | OpenTofu is accepted into the CNCF at the Sandbox maturity level | CNCF |
HashiCorp’s announcement says the change applies to future releases and that its APIs, SDKs and almost all libraries stay MPL 2.0. The OpenTofu manifesto calls the BSL “a poison pill for Terraform”, which is a position. And the CNCF defines Sandbox as “experimental projects not yet widely tested in production”, which is a maturity level.
What does the Terraform license say today?
The LICENSE file in the Terraform repository on GitHub names IBM as the licensor and covers “Terraform Version 1.6.0 or later”. It grants production use with one exception: you may not offer the tool to third parties “on a hosted or embedded basis in order to compete with” IBM’s paid versions. It then says that “hosting or using the Licensed Work(s) for internal purposes within an organization is not considered a competitive offering”. Each version converts to MPL 2.0 on a change date four years after it is published.
I’m not a lawyer, but the plain reading is that a company running its own infrastructure with Terraform is inside the grant. If you’re building a product that wraps Terraform, resells it, or hosts it for customers, have counsel read the text. The OpenTofu FAQ makes the same point from the other side: it calls the grant “ambiguous” and says the definition of “competitive” could change. That’s their argument too, and I wouldn’t take either side of it on faith. Whichever you pick, if you want the pipeline around it rebuilt, that’s our CI/CD and IaC package.
What stays the same, and what doesn’t?
Providers first. The OpenTofu FAQ says it “works with the current Terraform providers”, though through a separate registry.
State is the one to check. According to the same FAQ, OpenTofu “will work with existing state files up to those created with Terraform versions 1.5.x”. If a newer Terraform wrote your state, read the migration guide before you switch, because that line stops at 1.5.x.
Features change every release, so I won’t compare lists, and there’s no speed claim here either. One feature is worth knowing about: OpenTofu documents encrypting state and plan files at rest, for local storage and for backends. Its docs also warn that encryption doesn’t protect you from data loss or from replayed old state files.
What do we run?
OpenTofu on our own infrastructure. State is encrypted with KMS at the backend, a different layer from the client-side encryption in the OpenTofu docs. We keep one state per root, and the apply stops a change that would destroy something nobody named. 53 tests run against mocked providers without touching a cloud account. The whole Google Cloud platform we built for an AI marketing client is OpenTofu too, with 43 mocked-provider tests. At a portfolio-analytics SaaS client, infrastructure changes go through Terraform and OpenTofu with Atlantis, and the move to Crossplane runs as zero-downtime cutovers, each with a rollback.
So the default for new work is OpenTofu, because it’s what we run and can vouch for. I’d pick Terraform in three cases. One, you already pay for HashiCorp or IBM products you want to keep. Two, a newer Terraform already wrote your state and nobody has time to test the switch. Three, a vendor you depend on supports only Terraform.
What would it cost to move?
It depends on one number, covered below. Moving or rebuilding the pipeline and the infrastructure as code under it is the scope of our CI/CD & IaC package: USD 4,000, fixed, 2 weeks. If you’d rather have an engineer run it for months, a Senior is USD 45 to 50 an hour with a 6-month minimum. How we work with Terraform and OpenTofu has its own page, and what a fixed-price IaC build looks like is in another post.
Open your repository and run terraform version in CI. Write down which version last wrote your state. That one number tells you whether switching is a Friday afternoon or a project.
Sources, accessed 2026-10-08: the five pages in the table above, the Terraform LICENSE, the OpenTofu FAQ and OpenTofu, State and Plan Encryption.