Encore vs
OpenTofu requires writing HCL configuration files, just like Terraform. Encore infers infrastructure from your application code. Both deploy to your own cloud account, with very different approaches.
“What used to take days or weeks of back-and-forth between developers and infra teams is now automated and completed in minutes.”
Josef Sima, Engineering Director at Groupon
How they work
OpenTofu describes infrastructure in separate HCL files you write and keep in sync. Encore infers it from the application code, then provisions the managed service, its networking, IAM, and secrets.
Encore
3 lines of TypeScriptimport { SQLDatabase } from "encore.dev/storage/sqldb";
const db = new SQLDatabase("users", {
migrations: "./migrations",
});OpenTofu
50+ lines of HCLresource "aws_db_instance" "users" {
identifier = "users-db"
engine = "postgres"
instance_class = "db.t3.micro"
allocated_storage = 20
db_name = "users"
username = var.db_username
password = var.db_password
vpc_security_group_ids = [
aws_security_group.rds.id
]
# ... plus networking, IAM, secrets
}Feature Comparison
See how Encore and OpenTofu differ across key capabilities.
 |  | |
|---|---|---|
| Approach | Infrastructure-from-code | Infrastructure as Code (HCL) |
| Configuration | Zero config needed | Hand-written .tf files |
| Cloud Support | AWS and GCP | AWS, GCP, Azure, and more |
| State Management | Handled automatically | Manual state files |
| Local Development | Automatic (DBs, queues included) | Not supported |
| Observability | Built-in tracing & metrics | Not included |
| Preview Environments | Automatic per PR | Manual setup |
| Learning Curve | TypeScript/Go only | HCL + cloud knowledge |
| License | Open source | Open source (MPL 2.0) |
| Time to Deploy | Minutes | Hours to days |
Same Cloud, Different Approach
With OpenTofu you write HCL that maps directly to cloud provider APIs. Every resource is something you declare by hand: the database instance, the security groups, the IAM policies, the networking. You manage the state file that tracks what exists and keep your configuration in sync with reality to avoid drift.
OpenTofu's advantage over Terraform is its license. It stays open source under MPL 2.0 with community governance, so you avoid the BSL restrictions while keeping Terraform-compatible workflows. The day-to-day work is the same though: you are still hand-writing HCL that mirrors cloud APIs.
Encore takes a different layer of abstraction. You write application code and Encore provisions the cloud-specific details like networking, IAM, and security using sensible defaults for each provider. When you need more control, those defaults are yours to configure.
Learn more about infrastructure ownership →Local Development
OpenTofu provisions cloud resources. It does not help you run your application locally. To develop against a database or a queue you either point at real cloud infrastructure or set up and wire those services yourself.
Encore runs encore run and automatically provisions local PostgreSQL, Pub/Sub emulation, and cron scheduling. A local dashboard shows distributed tracing and architecture diagrams.
Your local and production environments use the same code, eliminating "works on my machine" problems.
Learn more about local development →Least-privilege access, without writing IAM
With OpenTofu, every IAM role, policy document, and trust relationship is something you write and maintain by hand, and over-broad permissions are easy to ship by accident.
Encore knows which services touch each database, queue, bucket, and secret, and generates per-service IAM policies with only those permissions. Secrets are referenced by name and stay encrypted and environment-scoped, so credentials never enter the repository.
- Per-service IAM generated from the code
- Policies updated as the application changes
- Encrypted, environment-scoped secrets
- Every infrastructure change tied to a commit
Every other combination stays denied — you never write the policy.
AI-Assisted Development
With OpenTofu, infrastructure lives in separate HCL files away from your application code. When an AI agent like Cursor or Claude Code works on a feature, it sees the application but not the matching infrastructure, so it produces changes that drift from what is actually provisioned.
With Encore, infrastructure is declared as TypeScript objects alongside the code that uses it. An AI agent sees the application and its infrastructure in one context, so the database, the queue, and the service that depend on each other stay consistent.
Because the infrastructure comes from Encore's defaults rather than hand-written config, you can let an AI agent build features and trust the result is provisioned correctly. Guardrails, auto-generated docs, and built-in observability keep what it produces readable and maintainable as it grows.
Learn about AI-assisted development →
Loved by teams
who refuse to slow down
"Encore is our foundation for all new development. Since adopting it, we've seen a 2-3x increase in development speed and 90% shorter project lead times."
Josef Sima · Engineering Director"Encore lets us go from idea to shipped product at least 3x faster and saves us hours of devops work every week."
Will · Co-founder"We've reduced time spent on DevOps by 95%, and we're now on track to save $60K annually in cloud costs."
Mason Stewart · CTO"Encore is an unfair advantage. At Pave we've moved 2x faster than we did at Monzo."
Simon Vans-Colina · CTO"We're saving $200k+ annually compared to additional hiring. The ROI is outstanding, easily 10x."
Daniel Stocks · CTO"You define infrastructure in your code and it's automatically spun up for you. You can go from zero to a deployed service on GCP in an hour. I don't know how else to do it."
Nilkanth Patel · CTO"Encore's inferred infrastructure has allowed us to move at unprecedented speed. Combined with database branching in Neon, we're able to spin ephemeral environments up and down with incredible ease. Stakeholders love preview app URLs."
Justin Foley · VP of Engineering
Frequently asked questions
Common questions about Encore vs OpenTofu.
OpenTofu is infrastructure as code: you write HCL in .tf files that maps to cloud provider APIs, then run tofu apply. Encore is infrastructure-from-code: you write your backend in TypeScript or Go, and Encore infers the infrastructure from that code and provisions it in your cloud account. OpenTofu describes infrastructure directly, while Encore derives it from your application.
Encore is built specifically for backend developers. You define APIs, databases, and queues in your application code and get local development, tracing, and per-PR preview environments without extra setup. OpenTofu is a general-purpose IaC tool for provisioning any cloud resource, so it does more across infrastructure but offers nothing dedicated to building a backend.
OpenTofu expects you to know HCL, cloud provider resources, IAM, networking, and state management, which is squarely DevOps work. Encore handles networking, security, and IAM from your code, so backend developers can provision a working system without deep cloud operations knowledge. You keep full access to your AWS or GCP account either way.
Yes. OpenTofu is the community-governed fork of Terraform, created in 2023 after Terraform moved to the Business Source License, and it is now a Linux Foundation project under MPL 2.0. It uses the same HCL, the same .tf files, and a Terraform-compatible provider ecosystem. Because the approach is identical to Terraform, the comparison with Encore is the same: hand-written HCL versus infrastructure inferred from your code.
Choose Encore if you want to build backends without writing and maintaining infrastructure configuration. You get local development, distributed tracing, automatic IAM, type-safe APIs, and per-PR preview environments out of the box, all driven by your application code. OpenTofu remains the right choice when your goal is to provision and manage cloud infrastructure directly with open-source tooling.
Yes. They operate at different layers and run in the same cloud account. Encore can manage your application infrastructure while OpenTofu manages networking, DNS, and other resources in the same AWS or GCP account. Many teams use Encore for the backend and keep OpenTofu for the surrounding cloud setup.
Start building with Encore
Deploy to your own AWS or GCP account, with infrastructure provisioned automatically.