US How fTPM works
fTPM, or firmware TPM, is a Trusted Platform Module implemented in firmware instead of in a dedicated security chip. It meets the TPM 2.0 specification published by the Trusted Computing Group, so Windows and Linux see an ordinary TPM 2.0 device and use it exactly as they would a discrete one.
The name is most closely tied to AMD. On AMD Ryzen, Ryzen Embedded and EPYC processors, the TPM runs on the AMD Secure Processor, also called the Platform Security Processor (PSP): a small Arm core with its own memory, isolated from the main x86 cores. The TPM’s state is stored, encrypted, in the motherboard’s SPI flash, next to the BIOS.
Intel’s version of the same idea is Intel Platform Trust Technology (PTT), which runs in the chipset’s security engine. Some board makers label PTT as “fTPM” in their menus too, so in practice fTPM can mean any firmware TPM.
What fTPM is used for
A TPM gives the operating system a hardware root of trust: somewhere to keep keys that cannot be copied off the disk, and a record of what code ran during start-up.
-
//
Windows 11 requirement. Windows 11 needs TPM 2.0. On most AMD systems, enabling fTPM in the BIOS is what passes that check.
-
//
Drive encryption. BitLocker and Linux LUKS seal the disk key to the TPM, so a drive removed from the system cannot be read elsewhere.
-
//
Measured boot. Hashes of the firmware and bootloader are recorded in the TPM’s registers, so a management server can check that a system started untampered code.
-
//
Credentials and identity. Windows Hello, virtual smart cards and device certificates keep their private keys behind the TPM, giving each system an identity that cannot be cloned.
fTPM vs dTPM vs PTT
All the options below meet TPM 2.0 and run the same software. They differ in where the TPM lives, how it is exposed to physical attack and how it is certified.
| Type | Where it runs | Physical exposure | Certification | Typical systems |
|---|---|---|---|---|
| AMD fTPM | AMD Secure Processor inside the CPU | No external bus to probe | Depends on processor and firmware | Ryzen, Ryzen Embedded and EPYC systems |
| Intel PTT | Security engine in the chipset or SoC | No external bus to probe | Depends on processor and firmware | Intel Core, Core Ultra and Atom systems |
| Discrete TPM (dTPM) | Separate chip on the board or a header module | Bus between CPU and chip can be sniffed | Usually Common Criteria and FIPS 140 | Servers, defense and government builds |
| Microsoft Pluton | Security processor on the CPU die | No external bus to probe | Depends on processor | Recent Ryzen, some Core Ultra and Snapdragon X |
For most industrial deployments a firmware TPM is enough, and it avoids the exposed bus that published attacks have used to read BitLocker keys from a discrete chip. A discrete TPM is the better choice where a contract or security policy names a certified module, as US federal work often does with FIPS 140 and some USA government and defense buyers do with Common Criteria.
The fTPM reset prompt and other known issues
The most searched fTPM question is not what it is but why the screen says “fTPM/PSP NV corrupted” or “New CPU installed”. The message appears on many AMD boards after the processor has been changed, or after a firmware update that resets the TPM’s stored state. The board asks whether to reset the fTPM.
Pressing Y creates a fresh TPM and deletes the old keys. If BitLocker or another TPM-based encryption is in use, the next boot will ask for the recovery key, so have it ready first. Pressing N keeps the previous record but leaves the fTPM disabled for that boot. If the drive is not encrypted with the TPM, resetting is usually harmless.
AMD also confirmed in 2022 that some Ryzen systems with fTPM enabled showed brief stutters, caused by TPM memory transactions to the SPI flash. Firmware based on later AGESA releases fixed it, so the answer is a BIOS update rather than turning the TPM off. On newer AMD boards the menu may also offer a choice between the AMD fTPM and Microsoft Pluton as the TPM source.
fTPM on industrial and embedded systems
Unattended systems in cabinets, kiosks and vehicles are easier to steal or tamper with than office PCs, so drive encryption and attested boot matter more, not less. A firmware TPM brings that to compact fanless systems without adding a chip. Our AMD industrial PCs and AMD embedded motherboards mostly list TPM 2.0, and several of the PCs name fTPM in their specifications.
Some systems give both. The Core Ultra builds of the Premio BCO-500 list a discrete TPM 2.0 and a firmware TPM, so the TPM source can be chosen in the BIOS to suit the project’s security policy. Only one can be active at a time.
For Windows builds, our guide to upgrading to Windows 11 IoT Enterprise covers the TPM and Secure Boot checks alongside the other hardware requirements.
Quick answers on fTPM
fTPM: common questions
What does fTPM mean?
Firmware Trusted Platform Module. It is a TPM 2.0 implemented in processor firmware rather than on a separate chip.
Should I press Y to reset fTPM?
Only once you know your recovery key. Y clears the old TPM keys. With BitLocker on, the next boot needs the recovery key; without TPM-based encryption, resetting is usually safe.
Is fTPM the same as TPM 2.0?
It is one way of providing TPM 2.0. fTPM implements the TPM 2.0 specification, so it meets the Windows 11 requirement in the same way as a discrete chip.
Should AMD fTPM be on or off?
On, for nearly every system. Leave it on unless a discrete TPM is fitted and selected instead. With no active TPM, BitLocker and the Windows 11 checks will not work.
Is fTPM safe?
Yes, for most uses. It is isolated inside the processor and has no exposed bus. Keep the BIOS up to date, because firmware TPM fixes arrive through BIOS releases.
We enable and check the TPM, Secure Boot and BIOS security settings as part of our standard build, so encryption and the Windows 11 checks work from the first boot.