HSM
also: Hardware Security Module
A Hardware Security Module (HSM) is a dedicated physical device that generates, stores, and manages cryptographic keys while performing encryption and decryption operations to keep sensitive material isolated from the main system.
An HSM is a tamper-resistant hardware appliance designed to protect cryptographic keys and perform cryptographic operations in a secure, isolated environment. Instead of storing keys in software on a vulnerable system, an HSM keeps keys locked away in protected hardware that never exposes them in plaintext.
HSMs are commonly used in high-security environments like banks, certificate authorities, and cloud providers. For example, a bank might use an HSM to securely store the master keys used to encrypt customer data, ensuring that even if a server is compromised, the keys remain protected within the hardware device.
Common operations include key generation, digital signing, and encryption/decryption. Most HSMs support standard interfaces like PKCS#11 so applications can request cryptographic operations without ever handling the raw keys themselves.