What does HSM stand for?
HSM stands for Hardware Security Module. A tamper-resistant hardware device that generates, stores and uses cryptographic keys so they never leave it in plain form. Enterprises use HSMs for certificate authorities, code signing and payment systems; a TPM is the smaller, built-in equivalent for a single PC.
An HSM is a dedicated, tamper-resistant device that generates cryptographic keys, stores them and performs operations with them inside its own protected hardware. Applications send it data to sign or decrypt and receive the result; the keys themselves cannot be exported in clear form. HSMs are used where a key is extremely valuable: certificate authorities, payment systems, code signing. They come as network appliances, plug-in cards, USB devices and cloud services, and are commonly validated against FIPS 140.
HSM in practice: an example
A company runs its own certificate authority. The authority's private key was generated inside an HSM and has never existed anywhere else. When a certificate must be signed, the server sends the request to the HSM and gets the signature back. An attacker who takes over the server can ask for signatures while he is there, but cannot copy the key and leave with it.
What HSM is confused with
HSM vs TPM: what is the difference?
A TPM is a chip built into one computer that protects that computer's own keys and records its boot state. An HSM is a separate, more capable device that serves keys and high volumes of operations to many systems. What TPM stands for
Which exams cover HSM?
HSM is on the official CompTIA acronym list for one of the four exams covered here.
- A+ 220-1201 and 220-1202: 220-1201 3.0 (Hardware).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Where should the private key of a certificate authority be kept?
- In a text file on the administrator's desktop
- In an HSM
- In the public certificate
- In the DNS zone
Show the answer
B. In an HSM. The authority's key signs every certificate it issues, so it is kept in hardware that never releases it.
2. What is the main security property of keys held in an HSM?
- They are shorter than normal keys
- They can be used but not extracted in clear form
- They change every minute
- They are stored in the browser
Show the answer
B. They can be used but not extracted in clear form. The device performs the cryptographic operation internally and returns only the result, so compromise of the server does not hand over the key.
Sources: NIST FIPS 140-3, Security Requirements for Cryptographic Modules; NIST glossary: hardware security module; NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.