UK What a TPM does
A Trusted Platform Module (TPM) is a small, tamper-resistant security processor that protects cryptographic keys and records the state of a computer as it starts. It is defined by the Trusted Computing Group, and TPM 2.0 is also published as the international standard ISO/IEC 11889. Software can ask the TPM to create, store and use keys, but the private part of a key never leaves the chip, so malware cannot simply copy it out.
The TPM also keeps a set of platform configuration registers. As the computer boots, each stage, from the UEFI firmware to the bootloader and the operating system, is measured and the result is recorded in those registers. A key can be sealed so that the TPM releases it only if the measurements match a known-good state. That is how BitLocker unlocks a drive automatically on a normal start, and refuses to if the firmware or boot files have been altered.
What a TPM is used for
On its own, the TPM does nothing visible. Operating systems and security software use it as a hardware root of trust, a component whose keys and measurements the rest of the system can rely on.
-
//
Disk encryption. BitLocker on Windows and LUKS with systemd-cryptenroll on Linux store the volume key in the TPM, sealed to the boot state.
-
//
Measured boot. Each boot stage is recorded, so tampering with firmware or the bootloader can be detected and reported.
-
//
Device identity. A unique key in the TPM proves which device is connecting, for VPNs, cloud enrolment and certificate-based Wi-Fi.
-
//
Credential protection. Windows Hello and other sign-in methods keep keys in the TPM rather than on disk.
-
//
Remote attestation. A management server can ask a device to prove, with signed TPM measurements, that it booted a trusted software stack.
Types of TPM
TPM 2.0 can be delivered in several ways. All of them meet the same specification and work with the same software, but they differ in where the TPM lives and how it is certified.
| Type | Where it lives | Examples | Typical use |
|---|---|---|---|
| Discrete TPM (dTPM) | Separate chip on the motherboard or a plug-in header module | Infineon, Nuvoton and STMicroelectronics TPM chips | Where a certification or customer specification asks for a separate, evaluated chip |
| Firmware TPM (fTPM) | Runs in a secure area of the processor | Intel Platform Trust Technology (PTT), AMD fTPM | Most current Intel and AMD PCs, with no extra chip |
| Integrated security processor | Dedicated security core inside the processor | Microsoft Pluton on recent AMD, Intel and Qualcomm processors | Newer Windows 11 devices |
| TPM 1.2 (legacy) | Older discrete chips | Pre-2016 business PCs | Not accepted by Windows 11 |
The TPM setting is usually found in the UEFI setup under security or advanced options, labelled TPM, PTT or fTPM. Our FAQ on what UEFI is explains where those settings live.
TPM 1.2 vs TPM 2.0
TPM 2.0 replaced TPM 1.2 in 2014. The older version supported only the SHA-1 hash and RSA keys, both now considered weak for new designs. TPM 2.0 adds SHA-256, elliptic-curve cryptography and support for more than one algorithm at a time, so the cryptography can be updated as standards move on. It also gives the platform owner more flexible control through separate hierarchies for the platform firmware, storage keys and endorsement identity. Windows 11 and most current Linux tooling, such as tpm2-tools and systemd, are built for TPM 2.0, so a TPM 1.2 system is best treated as legacy hardware.
TPM 2.0 and Windows 11
Windows 11 Home, Pro and Enterprise require TPM 2.0, together with UEFI and Secure Boot capability. Windows 11 IoT Enterprise LTSC, the long-term edition used on many industrial and embedded systems, relaxes some of those hardware checks, and Microsoft recommends rather than requires TPM 2.0 there. In practice most new industrial builds include TPM 2.0 anyway, because BitLocker, device identity and many security policies depend on it. Our white paper on upgrading to Windows 11 IoT Enterprise and Pro covers the hardware requirements in full.
Why industrial PCs need a TPM
Industrial PCs often sit unattended in public places, roadside cabinets, vehicles and factories, where someone could remove the drive or tamper with the system. A TPM means a stolen SSD stays encrypted, a modified bootloader is detected and each device can prove its identity to the network. Security standards for operational technology, such as IEC 62443, and many customer specifications now expect a hardware root of trust. Many of our industrial PCs include TPM 2.0, through Intel PTT, AMD fTPM or a discrete chip, and recent Jetson Linux releases add a firmware TPM on Orin modules.
Quick answers on TPM
TPM: common questions
What does TPM stand for?
Trusted Platform Module. In manufacturing, TPM can also mean total productive maintenance, an unrelated maintenance method.
How do I check if TPM 2.0 is enabled?
On Windows, run tpm.msc. The TPM Management console shows whether a TPM is present and its specification version. On Linux, the device appears as /dev/tpm0 and /dev/tpmrm0.
How do I enable TPM 2.0 in the BIOS?
Turn on the firmware TPM in UEFI setup. Look for Intel PTT, AMD fTPM or a TPM device option under security or advanced settings, enable it, save and restart.
What is fTPM?
A firmware TPM. It runs inside a protected area of the processor instead of on a separate chip, and meets the TPM 2.0 specification for Windows 11 and BitLocker.
Can a TPM be added to an older PC?
Sometimes. Boards with a TPM header can take a plug-in module. Otherwise the processor must support a firmware TPM, which most Intel processors from around 2017 and AMD Ryzen processors do.
We enable and configure TPM 2.0, Secure Boot and disk encryption on industrial PCs as part of the build, matched to your operating system image and security policy, and verify them before each system ships.