HSM

Hardware Security Module

In plain language

A tamper-resistant box that stores secret keys and does the signing or locking for you without letting the keys out.

The metaphor

Like a bank vault with a teller who does the work through a slot and never hands over the keys.

Going deeper

How it works

Keys are created inside the device and never leave it.
It performs encryption and signing when asked.
Attempts to break into it can wipe the keys.
Large organisations and certificate authorities use them; cloud providers rent them out.

What can go wrong (example scenario)

A company kept its code-signing key on a developer's laptop. When the laptop was stolen, the company had to recall and re-sign every product it had released.

In practice

A certificate authority keeps its main key inside one.
A payment processor uses one to protect card data keys.
A cloud provider offers a managed version for customers who need one.

A question owners ask

Does a small business need one?

Rarely. It matters for businesses that sign software or handle payment keys. Everyone else relies on keys that their cloud services manage.

Related terms

Something here sounds like your problem?

Every WILDCARD card exists to solve one named problem. Find yours.

Pick your problem →