Why OpenTofu Has Become the Default Infrastructure-as-Code Engine of 2026

Three years ago, reaching for Terraform was the obvious move. You wrote some HCL, pointed it at your cloud, and moved on. The question was never the tool, because there was only one tool. That default has quietly moved.

It did not move because of a hardware shortage or a new methodology. It moved because of a license, a fork, and a run of releases that shipped what engineers kept asking for. The result: in 2026, OpenTofu is the default engine for new infrastructure-as-code workspaces.

The fork that stopped being a fork

In August 2023, HashiCorp relicensed Terraform from MPL-2.0 to the Business Source License — source-available, not open source. The community forked the last free version within weeks, and the fork became OpenTofu under Linux Foundation governance (high confidence). When IBM closed its $6.4 billion acquisition of HashiCorp in February 2025, the BSL stayed (high confidence). The license was never going back.

Governance followed. The CNCF accepted OpenTofu as a Sandbox project in April 2025 (high confidence), giving the community fork neutral, multi-vendor backing.

The tipping point, measured

Terraform's installed base is enormous, and migration is incomplete — but that is the past. The question for 2026 is where new work lands.

On Scalr's platform, OpenTofu runs about 63% of Terraform-compatible runs and powers about 72% of newly created workspaces as of mid-2026 (high confidence, platform telemetry reported September 2026). That 72% matters more than the 63%. Runs include legacy scheduled applies. New workspaces are choices made this quarter.

The global picture is more mixed. CodeOxi tracked about 12% overall adoption in April 2026, with another 27% of teams evaluating (medium confidence). Both numbers are true at once: the installed base is overwhelmingly Terraform, the direction of new work is OpenTofu, and completed migrations lag behind both.

The feature lead is the real argument

The strongest case is not licensing. It is what OpenTofu ships.

The headline is end-to-end state-file encryption, native in v1.7 — an answer to years of requests. Terraform chose ephemeral resources instead, which keep secrets out of state but never encrypt the file (high confidence). Both approaches help; one closes the vault door.

The v1.12.0 release, out May 14, 2026, kept the pace up (high confidence):

• Dynamic prevent_destroy, so you can pin a production database's lifecycle conditionally from a variable.
• Full provider checksums in zh: and h1: recorded automatically — no manual tofu providers lock.
• Concurrent provider install for faster tofu init.
• A -json-into=FILENAME flag that writes machine output to a file while keeping the human UI.

Earlier releases led the way too: early variable evaluation in v1.8, provider for_each and the -exclude flag in v1.9, and OCI registry plus native S3 locking without DynamoDB from v1.10 (high confidence).

The ecosystem came with it. OpenTofu runs its own registry with 3,900+ providers and 23,600+ modules (medium confidence). And institutional pressure is real: GitLab removed its built-in Terraform CI/CD templates in 18.0 because it could no longer ship BSL binaries, and now recommends its OpenTofu CI/CD component (high confidence).

Fidelity is the proof at scale: it moved over 70% of projects — about 2,000 apps, 50,000+ state files, 4M+ cloud resources — to OpenTofu within two quarters, with no state conversion, because the state format is shared (medium confidence).

What this is not

This is not "Terraform is dead." It is not. Terraform remains the installed-base incumbent, and for good reasons. If a contract, HCP Terraform or Terraform Enterprise, or Stacks pins you there, stay. That is a legitimate choice, not a failure.

But when a team is free to pick — no vendor lock, no commercial tie — the fork is now the honest default for new workspaces. For self-hosters and platform teams, that means one decision: adopt OpenTofu for greenfield work, keep Terraform where it already runs, and revisit state as contracts allow. The shift is real, measured, and two years in. The new default simply took the default.