OpenTofu: encrypt state and plans with the encryption block

TL;DR

Encrypting state does not remove secrets already in old state snapshots or in backend version history. The passphrase is a secret.

Steps

1. The passphrase is a secret. Never commit it. Supply it via env var or a key provider that reads from a secret store.
2. Encrypting state does not remove secrets already in old state snapshots or in backend version history. Rotate secrets after enabling encryption on a brownfield workspace.
3. If OpenTofu cannot decrypt (wrong passphrase, lost key provider config), the state is unreadable. Back up the unencrypted state and guard the passphrase before enabling.
4. This block is OpenTofu-only. A config with an encryption block will not parse under Terraform CLI.

When to use

You are seeing this: Terraform state routinely contains secrets: database passwords, private keys, tokens. Use this skill when you run into "OpenTofu: encrypt state and plans with the encryption block".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

Terraform state routinely contains secrets: database passwords, private keys, tokens.

OpenTofu state/plan encryption docs: encryption block with keyprovider (e.g. pbkdf2 with passphrase) and method (e.g. aesgcm), applied to state and plan blocks. Verified against live docs 2026-09-26.