How to Install & Set Up OpenTofu

Prerequisites

• ✓A Linux, macOS, or Windows machine
• ✓For the walkthrough below: nothing extra, the local provider needs no credentials
• ✓For real infrastructure: credentials for whichever cloud/provider you plan to manage

Why a fork exists, and what actually changed

OpenTofu split off from Terraform in 2023 after HashiCorp relicensed Terraform under the BUSL, a source-available license that isn't OSI-approved open source. A group of contributors and vendors took the last MPL-licensed Terraform codebase, moved governance under the Linux Foundation, and kept building — so OpenTofu today reads the same HCL, uses the same provider plugin protocol, and understands the same state file format as Terraform.

In practice that means the entire workflow you'd learn for Terraform — init/plan/apply/destroy, remote backends, modules — applies unchanged; the only routine difference is typing tofu instead of terraform. OpenTofu has also started shipping features Terraform doesn't have, most notably native state encryption (see below).

Install with the official script (any Linux distro)

This one script is the officially recommended route on Linux precisely because it works the same on RHEL, Fedora, Debian, Ubuntu, or anything else — it detects your distro and package manager rather than you needing a distro-specific repo.

curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh -o install-opentofu.sh
chmod +x install-opentofu.sh
./install-opentofu.sh --install-method standalone
rm -f install-opentofu.sh

Install with a package manager

brew install opentofu

choco install opentofu

sudo snap install opentofu --classic

Build from source

OpenTofu is a genuinely open source Go project, so compiling your own binary — for a platform without prebuilt binaries, or to run an unreleased fix — is a first-class, documented path, not a hack.

git clone --depth=1 https://github.com/opentofu/opentofu.git
cd opentofu
go build -o tofu ./cmd/tofu
sudo mv tofu /usr/local/bin/

Verify the installation

tofu --version

Your first configuration

Create a main.tf, then initialize and apply it. OpenTofu is a drop-in replacement — the CLI is tofu instead of terraform.

tofu init
tofu plan
tofu apply

Moving an existing Terraform project over

Because the state format is compatible, switching a project you already have is mostly a matter of swapping the binary you invoke — there's no conversion step and no re-import of resources.

cd my-terraform-project
tofu init          # re-initializes using the existing .terraform.lock.hcl and state
tofu plan          # should show no changes if nothing actually drifted

State encryption (an OpenTofu-only feature)

State files routinely contain secrets in plain text — database passwords, generated private keys. OpenTofu 1.7+ can encrypt state at rest and in transit to a remote backend using a key you control, without needing the backend itself to support encryption.

terraform {
  encryption {
    key_provider "pbkdf2" "mykey" {
      passphrase = var.state_encryption_passphrase
    }
    method "aes_gcm" "example" {
      keys = key_provider.pbkdf2.mykey
    }
    state {
      method = method.aes_gcm.example
    }
  }
}

Related Guides