SciPHRWhat is a hardware security module (HSM)?
A hardware security module, or HSM, is built to store private keys and keep them from ever leaving the device. Your Mac and iPhone use one for Touch ID and Face ID, which is why biometric data never leaves the phone. The HSM can use a key, but it will not hand the key over.
It holds the key and uses it in place.
An HSM generates keys inside itself and keeps them there. When something needs a signature or a decryption, it asks the HSM to perform the operation, and the HSM returns the result without ever releasing the key. The secret stays sealed in hardware, even from the software that depends on it.
Two ways to run one, same tradeoff.
Accessing the keys once they are stored safely is often the real issue. An on-prem HSM is hardware you run yourself, and it carries the usual on-premise constraints around cost, maintenance, and physical access.
Cloud HSMs reduce that friction by hosting the hardware for you. The cost shows up elsewhere: added latency, ongoing fees, and reliance on the vendor's software to broker every request.
Storage is solved. Access is not.
The takeaway
In both cases, the hardware secures where a key lives, but not how or when it is used. An HSM with weak controls around who can request a signature is a strong safe with a careless guard. The hard part of key security is the operational layer around the key, not the box it sits in.
Related: what is a private key, what is self-custody, what is a seed phrase.
Common questions.
What is a hardware security module (HSM)?
A dedicated chip or device built to generate and store private keys and keep them from ever leaving. It signs or decrypts on request, but the key stays inside. The Secure Enclave in your phone is a consumer HSM.
What is the difference between an on-prem HSM and a cloud HSM?
On-prem is hardware you run yourself, with the usual cost and maintenance constraints. Cloud removes that friction but adds latency, ongoing fees, and reliance on the vendor's software.
Does an HSM make a key impossible to misuse?
No. It secures where a key lives, not how or when it is used. If the surrounding system can request a signature, protection is only as good as the controls on that request.
Do phones have an HSM?
Yes. iPhones and Macs include a Secure Enclave, and many Android devices include a secure element. They keep key and biometric material inside the chip, the same principle a standalone HSM uses.