A hardware security module (HSM) is a physical computing device that safeguards and manages cryptographic keys and performs cryptographic operations. It is designed to protect keys while they are used for tasks such as encryption, authentication, and digital signatures.
What does “hardware security module” mean?
NIST defines an HSM as “a physical computing device that safeguards and manages cryptographic keys and provides cryptographic processing.” The term describes a device with a focused cryptographic and key-protection role; it is not a general name for every chip or device that includes security features.
As an Amazon Associate I earn from qualifying purchases.
How is an HSM different from a cryptographic module?
A cryptographic module is the set of hardware, software, and/or firmware that implements approved cryptographic functions within a defined cryptographic boundary. As NIST’s glossary explains, that boundary determines which components make up the module. An HSM is or contains such a module, but a cryptographic module does not have to consist exclusively of hardware.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThis distinction also matters when assessing security or validation claims: they apply to the defined module and its approved configuration, not automatically to every application, device, or system connected to it.
#1 Best Overall
What does an HSM do with cryptographic keys?
An HSM provides a protected environment to safeguard and manage keys while carrying out cryptographic processing. Depending on the system using it, those operations can support encryption, authentication, or digital signatures.
Keys may exist in plaintext inside a cryptographic module for some period. NIST’s SP 800-152 discusses the need for physical security measures to guard against unauthorized disclosure, modification, and substitution of keys. Protecting the module is therefore part of protecting the keys it handles.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
An HSM is one component of a broader key-management system. Secure configuration, authorization, procedures, backups, availability planning, and sound key lifecycle management remain responsibilities of the surrounding system and its operators.
What does FIPS 140-3 have to do with HSMs?
FIPS 140-3, Security Requirements for Cryptographic Modules, sets requirements for cryptographic modules implemented in hardware, software, firmware, or combinations of those. Its requirements address areas including module interfaces, roles and authentication, physical security, sensitive security parameter management, self-tests, lifecycle assurance, and attack mitigation. It is a standard, not a product brand or a blanket guarantee about an entire system.
Rank #4
In federal contexts, FIPS 140-3 applies to agencies using cryptography to protect sensitive information. Private and commercial organizations may also adopt it, but whether a particular deployment must meet it depends on the contract, regulation, or policy that governs that deployment. It is not accurate to say that every organization or every HSM is legally required to be FIPS validated.
For a particular product, check the exact cryptographic module, certificate status, operational environment, and security policy in the current NIST Cryptographic Module Validation Program records. A reference to FIPS 140-3 alone does not establish that a particular module has a current validation.
Best Value
- ADD WI-FI TO YOUR YALE ASSURE LOCK OR LEVER: No hub or Connect needed. Note: This product only works on 2.4 GHz Wi-Fi in the U.S. and Canada.
- SIMPLE TO ADD: Simply insert the Yale Wi-Fi Smart Module in the slot above the batteries. Add the module as an accessory in the Yale Access app.
- UPGRADE YALE ASSURE LOCKS: Add Wi-Fi to your Yale Assure Lock or Lever with no hub or Connect needed.
- ACCESS FROM ANYWHERE: Lock, unlock, share access and see who comes and goes from anywhere using the Yale Access app.
- AUTO-UNLOCK: Your Assure Lock/Lever will automatically unlock as you get home and relock for you.
Is an HSM the same as a security chip or hardware security key?
No. Those terms are not interchangeable. An HSM, as defined by NIST, is a physical computing device whose role is to safeguard and manage cryptographic keys and provide cryptographic processing. A generic security chip or consumer hardware security key should not be called an HSM solely because it performs a security-related function; the HSM definition is about the device’s key-management and cryptographic-processing role.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
