HSM
Hardware Security Module
ELI5 — The Vibe Check
HSM stands for Hardware Security Module — a tamper-proof physical device that manages cryptographic keys. If someone tries to open it, the keys self-destruct. Cloud KMS services use HSMs behind the scenes, so you get the hardware security without buying a $20K appliance. It's the Fort Knox of cryptographic key storage.
Real Talk
HSM (Hardware Security Module) is a dedicated cryptographic device providing FIPS 140-2/3 validated key generation, storage, and operations. Keys generated inside an HSM never leave in plaintext. HSMs are used for PKI, payment processing (PCI-DSS requirement), code signing, and TLS termination. Cloud offerings include AWS CloudHSM, GCP Cloud HSM, and Azure Dedicated HSM.
When You'll Hear This
"PCI-DSS requires us to store payment encryption keys in an HSM." / "AWS CloudHSM gives us a single-tenant HSM in the cloud."
Related Terms
Encryption
Encryption is scrambling your message into gibberish so only someone with the secret decoder ring can read it.
Hardware Security Module
An HSM is a physical device that generates, stores, and uses cryptographic keys without ever exposing them.
KMS (Key Management Service)
KMS is the cloud service that holds your encryption keys in a hardware vault and does crypto operations for you. Need to encrypt something? Send it to KMS.
TPM (Trusted Platform Module)
TPM is the security chip on your computer's motherboard that stores encryption keys and verifies boot integrity. It's why Windows 11 requires TPM 2.0 — Mic