Key Takeaways Quick Answer: How Do You Manage Secrets Securely in OpenTofu? OpenTofu has no built-in secrets manager. Local state stores secrets in plain text by default, and even encrypted state only protects data at rest, not while OpenTofu is actively using it.