thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

TPM vs HSM: What's the Difference?

A TPM is a chip built into a single computer's motherboard that stores keys and measurements for that device, supporting secure boot and disk encryption. An HSM is a dedicated, high-performance appliance or card that generates, stores, and uses keys for many applications and servers.

Trusted Platform Module (TPM)

Full definition
vs

Hardware Security Module (HSM)

Full definition
Trusted Platform ModuleHardware Security Module
Form factorChip on the motherboard (or firmware TPM)Network appliance, PCIe card, or cloud service
ScopeOne deviceEnterprise-wide, many applications
PerformanceLow, not built for bulk cryptoHigh throughput cryptographic operations
Typical useBitLocker, measured/secure boot, device attestationCA keys, payment processing, code signing, key management
CostLow, included with hardwareHigh
CertificationsTPM 2.0 specFIPS 140-2/140-3, often Level 3
Remember it

TPM protects one machine; HSM protects the whole kingdom's keys.

Exam tip

Full disk encryption on a laptop points to TPM. Protecting a CA root key or high-volume signing points to HSM.

Tested on

More Security Fundamentals & Crypto look-alikes