What is a Trusted Platform Module (TPM)?
If an attacker gains physical access to a computer, they can often bypass locks and passwords to reach the data. That's why encrypting your machines matters — and why a Trusted Platform Module (TPM) is so useful.
What is a Trusted Platform Module chip?
A Trusted Platform Module (TPM) is a tamper-resistant hardware chip on a device that handles cryptographic tasks. It can create, store, and protect passwords and cryptographic keys, and includes features that make it tamper-resistant. Full-disk-encrypted computers often use TPMs for authentication during boot.
TPM chips are a hardware-based security component mounted on the motherboard. In most cases, hardware-level controls are stronger than software-based ones. TPMs have grown steadily in adoption — the US Department of Defense has long required new computers to include TPM 1.2 or later.
What does the TPM chip do?
The TPM improves security in several ways. Here are common Windows features that use it:
| Security feature | Benefit when used with a TPM |
|---|---|
| Platform Crypto Provider | Keeps a certificate's private key from being read even if the device is compromised; protects against dictionary attacks. |
| Virtual Smart Card | Provides the same level of security as physical smart cards. |
| Windows Hello for Business | Credentials can't be copied off the device; verifies the TPM before provisioning. |
| BitLocker Drive Encryption | Secures data-at-rest across many device types. |
| Device Encryption | Simple data-at-rest encryption. |
| Measured Boot | Boot-time measurements that help detect malware. |
| Health Attestation | Lets MDM verify device health before granting access. |
| Credential Guard | Protects credentials from malware with local admin access. |
Platform Crypto Provider
Windows' cryptography framework uses the TPM to add capabilities software alone can't:
- Key protection — keys created and held by the TPM don't have to sit in memory, where malware could read them.
- Dictionary-attack protection — when a PIN is required (as with BitLocker), the TPM can block repeated guesses, and it remembers the lockout even after a reboot.
Virtual smart cards
Smart cards add a strong layer of security: an employee plugs in a card, presses a button, and enters a PIN to access an encrypted drive. Virtual smart cards use the TPM to reproduce this — the TPM stores the key, and the user still enters a PIN (something they have and something they know).
Windows Hello for Business
To move past passwords, Windows Hello supports face scans, fingerprints, PINs, and identity solutions. That data is combined with a cryptographic key and stored in the TPM, protected from tampering and malware.
BitLocker Drive Encryption
BitLocker is Windows' native disk-encryption solution. With a TPM, the user doesn't have to type the decryption key — the TPM stores and provides it, but only after safety checks:
- Hardware root of trust — the TPM hashes important components (like firmware) and verifies them before releasing the key.
- Key released only when boot measurements are correct — the TPM checks the boot process for tampering before proceeding.
Device encryption, measured boot, health attestation, and Credential Guard
Device encryption works similarly to BitLocker with more reliance on code signing. Measured boot takes measurements of firmware and the kernel to spot rootkits and enables remote attestation. Health attestation lets MDM verify a device's state before granting access. Credential Guard isolates credentials in memory so attackers can't "pass the hash" — and with a TPM, credentials become nearly unreachable.
Conclusion
The TPM is part of a broader effort to make endpoints much harder to compromise. Combined with a layered approach to security, it meaningfully hardens a system — and it's worth including in your security strategy.