Glossary
TPM (Trusted Platform Module)
A standardized security processor that stores keys, records boot measurements in PCRs, seals secrets to platform state and signs attestation quotes.
A Trusted Platform Module is a cryptoprocessor specified by the Trusted Computing Group. Version 2.0 is required by Windows 11 and present in most business PCs and servers, as a discrete chip, as firmware inside the CPU's security processor (fTPM), or as a virtual TPM in a hypervisor.
A TPM protects keys, records what booted in Platform Configuration Registers, seals secrets such as disk-encryption keys so they are released only if the boot chain matches, and signs quotes for remote attestation. It does not perform bulk encryption and does not protect a running operating system from malware.
See TPM 2.0 explained.