Glossary
Trusted Platform Module (TPM)
A hardware security chip that generates and protects keys, records boot measurements and anchors BitLocker, Windows Hello and attestation.
A Trusted Platform Module is a secure cryptoprocessor, either a discrete chip or firmware running in a protected area of the CPU, that creates and stores cryptographic keys so they cannot be exported. It also contains Platform Configuration Registers (PCRs) that record measurements of firmware and boot components during startup. Keys can be sealed to a set of PCR values, so they are only released when the device boots in a known-good state. TPM 2.0 is a requirement for Windows 11, and its status can be checked with tpm.msc or Get-Tpm.
The TPM is the root of trust for many Windows protections: BitLocker seals the volume key to it, Windows Hello for Business stores its private key in it, Credential Guard can use it to protect its keys, and device health attestation reads its measurements. A TPM alone does not stop an attacker with physical access from sniffing some bus traffic, so high-risk devices should combine it with a pre-boot PIN. Keep TPM firmware updated, because past vulnerabilities affected key generation.
See BitLocker with TPM and PIN and Secure Boot and UEFI hardening.