Hardware Security Module (HSM)
Definition
A hardware security module is specially protected hardware for cryptographic keys and operations.
HSMs generate, store, and use keys within a controlled hardware environment. Certifications such as FIPS 140-3 can verify security requirements for cryptographic modules but are not synonymous with the term HSM itself.
Simply explained
Like a highly secured safe where keys not only reside but can also be used without leaving it.
Why it matters in practice
Relevant for especially sensitive keys, signatures, certificates, and central cryptography in enterprise systems.
Example from business
A company keeps the key for signing business-critical documents in an HSM instead of as an exportable file on a server.
Limits and pitfalls
- Equating an HSM with a complete security architecture; forgetting backup and recovery processes; poorly separating access roles; assuming certification status without verification.
Origin & history
HSMs serve protected key management and cryptographic processing. FIPS 140-3 defines security requirements for cryptographic modules.
Use in mid-sized companies
- Possible application: central key management for signatures, PKI, or especially sensitive encryption processes.
Frequently asked questions
Is every HSM FIPS certified?
No. Can an HSM compensate for poor authorization processes? No.
Sources
- NIST FIPS 140-3 · NIST FIPS 140-3
- Introduction · AWS CloudHSM, Introduction
Source verification: 10./11.10.2026.
Editorially reviewed on: