By Uniqcli Team
A Trusted Platform Module (TPM) is a dedicated hardware security chip that provides cryptographic functions and a hardware root of trust for a computer. It generates and stores encryption keys, passwords, and digital certificates in a tamper-resistant environment kept separate from the main operating system, and it measures the integrity of the boot process so the system can prove it has not been altered. Because the keys it protects never leave the chip in usable form, a TPM can safeguard credentials even if the operating system itself is compromised.
The TPM specification is maintained by the Trusted Computing Group and standardized internationally as ISO/IEC 11889. The current generation, TPM 2.0, replaced the older TPM 1.2 with a more flexible design and stronger algorithm support. A TPM is a passive component — it responds to commands from the operating system rather than acting on its own — but the functions it anchors are foundational to modern platform security: full-disk encryption, secure and measured boot, device attestation, and the hardware-backed identity that underpins a zero-trust device posture.
How does a TPM chip work?
A TPM holds a small number of permanent keys that are created inside the chip and never exported in plaintext. The most important is the Endorsement Key, a unique key pair burned in during manufacturing that acts as the module's cryptographic identity, together with a Storage Root Key that protects the additional keys the system generates over time. When software needs to encrypt data or sign a request, it asks the TPM to perform the operation using a key that physically cannot leave the chip — so an attacker who steals a disk or dumps memory still cannot recover the underlying secret.
The TPM also measures platform integrity. As a machine boots, each stage — firmware, boot loader, operating system — is hashed and the result is extended into Platform Configuration Registers (PCRs) inside the chip. Because each new measurement folds into the previous value, the final PCRs are a fingerprint of exactly what code ran. Data can be 'sealed' to a specific set of PCR values so it unseals only when the machine boots in a known-good state, and those same measurements can be reported to a remote server through attestation to prove a device is trustworthy before it is granted access.
What is the difference between TPM 1.2 and TPM 2.0?
TPM 1.2 and TPM 2.0 are successive versions of the same standard, but they are not interchangeable. TPM 1.2 has a fixed design centered on the SHA-1 hash algorithm and RSA, which limited its cryptographic agility as SHA-1 weakened over time. TPM 2.0 was rewritten around an algorithm-agile library model that supports SHA-256 and newer hashes, elliptic-curve cryptography (ECC) alongside RSA, and multiple key hierarchies. It is the version required by current operating systems and is the one standardized as ISO/IEC 11889.
TPM 2.0 also appears in several form factors that deliver the same functions in different ways. A discrete TPM (dTPM) is a separate chip soldered to the motherboard and offers the strongest physical tamper resistance. A firmware TPM (fTPM) runs the TPM logic inside a trusted execution environment on the main processor — Intel implements this as Platform Trust Technology (PTT) and AMD ships an equivalent fTPM — which is why many modern systems meet the TPM 2.0 requirement without a separate chip. Virtual TPMs (vTPMs) provide the same capabilities to virtual machines under a hypervisor. In every case the software sees a TPM; the trade-offs are cost and the assurance level of the isolation.
Why does Windows 11 require a TPM?
Windows 11 makes TPM 2.0 a baseline hardware requirement, alongside UEFI Secure Boot and a supported processor. The operating system uses the TPM to strengthen features that were optional on earlier releases: BitLocker seals its disk-encryption keys to the TPM so a stolen drive cannot be read on another machine, Windows Hello binds biometric and PIN credentials to the chip, and virtualization-based security uses it to help protect credentials and system integrity. The requirement is why many otherwise-capable machines could not upgrade in place — they either lacked a TPM or shipped with it disabled in firmware.
For federal and enterprise fleets, the TPM 2.0 requirement drives refresh planning. Windows 10 reached end of support on October 14, 2025, so agencies and contractors moving endpoints onto a supported, patched operating system need hardware that can run Windows 11 — which in practice means TPM 2.0 present and enabled. Many systems built in the last several years already include a firmware TPM that only needs to be turned on in UEFI settings, so an audit of the existing fleet often separates the devices that can upgrade from those that must be replaced. When you do replace hardware, confirming TPM 2.0 on the specification sheet avoids surprises during deployment.
What should you check when buying for TPM?
Because a TPM is a foundational security component rather than a feature you can bolt on later, the most reliable approach is to confirm it on the product specification before purchase. Look for 'TPM 2.0' explicitly — a listing that says only 'TPM' may mean the older 1.2 version, which current operating systems no longer accept. On business-class laptops, desktops, and servers a TPM 2.0, whether discrete or firmware, is now effectively standard, but it can ship disabled, so plan to enable it and, where required, take ownership of the module during imaging.
If your environment carries stricter assurance requirements, check the certifications behind the module. Many TPM 2.0 chips carry Common Criteria evaluation and FIPS 140 validation of their cryptographic functions, which matters when hardware must meet federal cryptographic standards or feed a device-attestation program. For virtualized or server workloads, verify whether the platform exposes a physical TPM, a firmware TPM, or a virtual TPM to its guests, since that affects how you anchor keys and attestation. When you are standardizing a fleet, listing TPM 2.0 as a required line item — and validating it at receiving — keeps every endpoint on the same security baseline.
Key takeaways
- A TPM (Trusted Platform Module) is a dedicated hardware chip that provides a cryptographic root of trust, generating, storing, and using keys in a tamper-resistant environment kept separate from the operating system.
- It underpins full-disk encryption such as BitLocker, secure and measured boot, credential protection, and remote attestation that lets a device prove its integrity before being granted access.
- TPM 2.0 is the current standard (ISO/IEC 11889), maintained by the Trusted Computing Group; it replaced TPM 1.2 with algorithm agility, elliptic-curve support, and modern hashes.
- TPMs ship as discrete chips (dTPM), firmware TPMs running on the CPU (Intel PTT, AMD fTPM), or virtual TPMs for virtual machines — the software sees a TPM in each case.
- Windows 11 requires TPM 2.0 alongside UEFI Secure Boot and a supported CPU, which is the main reason many older machines cannot upgrade in place.
- For federal and enterprise fleets, Windows 10's end of support (October 14, 2025) makes TPM 2.0 a practical requirement — audit existing devices and confirm 'TPM 2.0' on new-hardware specifications.
Shop it at Uniqcli
Frequently asked
- Is a TPM the same as a security chip or an HSM?
- A TPM is one kind of hardware security chip, but it is not the same as a hardware security module (HSM). A TPM is a low-cost, fixed root of trust bound to a single computer, designed to protect that machine's keys, measure its boot integrity, and prove its identity. An HSM is a higher-performance, often network-attached device built to generate and manage large volumes of keys and perform bulk cryptographic operations for many systems at once. They address related problems at very different scales.
- Do I need a separate TPM chip, or is one built in?
- Most business-class computers built in recent years already include TPM 2.0 — often as a firmware TPM running inside the processor (Intel Platform Trust Technology or AMD's fTPM) rather than as a separate soldered chip. In many cases the capability is present but switched off, so it simply needs to be enabled in the UEFI/BIOS firmware settings. A discrete add-on TPM module exists for some desktop motherboards that lack one, but for laptops and most modern desktops a built-in TPM is the norm; check the specification sheet to confirm.
- Why does BitLocker or disk encryption need a TPM?
- Disk-encryption tools like BitLocker use the TPM to protect the encryption key and bind it to the machine's measured boot state. The key is 'sealed' so it is released only when the firmware and boot components match a known-good configuration, which means a drive removed and mounted in another computer stays encrypted and unreadable. This ties the data to specific, verified hardware and defeats offline attacks that bypass the operating system's logon. Encryption can run without a TPM, but it then leans on a password or USB key instead of hardware-anchored protection.
- Is a TPM required for security compliance or zero trust?
- A TPM is not a compliance certificate in itself, but it is increasingly the hardware foundation that security frameworks assume. A hardware root of trust supports the device pillar of a zero-trust architecture: it gives each endpoint a verifiable identity and lets the device attest to its health before access is granted. It also enables measured boot and hardware-anchored encryption that many baselines expect. For environments with formal requirements, look for TPMs whose cryptography carries FIPS 140 validation, and route specific procurement questions to a quote so the exact certifications can be confirmed.