A TPM (Trusted Platform Module) is a dedicated security chip, or firmware equivalent, that generates and stores cryptographic keys and measures the boot process. Keys stored in it cannot be easily extracted.
Why it matters
TPM underpins features like full-disk encryption (BitLocker), passwordless sign-in and measured boot. Windows 11 requires TPM 2.0.
Because keys are bound to the hardware, a stolen drive cannot be decrypted on another machine without recovery keys.
A TPM can be a discrete chip or built into the CPU firmware (often called fTPM or PTT), and both satisfy most operating system requirements.
Example
$ ls /dev/tpm*
/dev/tpm0 /dev/tpmrm0On Linux the presence of these devices indicates an available TPM. In Windows, run tpm.msc to view its status and version.
Common mistakes
- Clearing the TPM without having the disk-encryption recovery key.
- Not realizing the TPM may be disabled by default in the firmware settings.
- Believing TPM encryption protects an unlocked, running machine.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.