What Is HSM (Hardware Security Module)?

HSMs have long been used in banking, payment systems, and digital certificate infrastructures. The core idea is that the private key never lands in the memory of a general-purpose computer: the application sends the data to be signed to the HSM and gets back only the signature. The devices contain mechanisms that can erase keys in response to being opened or physically tampered with, and they are generally certified under international security standards such as FIPS 140.

In the crypto space, HSMs are used by organizations that protect large amounts of assets, chiefly institutions providing custody services and crypto exchanges. HSMs are used in cold wallet infrastructures, in protecting validator signing keys, and in corporate approval processes. Hardware wallets work on a similar logic, but they are simpler devices designed for individual users.

An HSM alone does not provide complete security. Who can send signing requests to the device and under what conditions, backup procedures, and internal controls are critically important; someone who gains unauthorized access to the system can use the HSM to produce signatures that look legitimate. For this reason, institutions can use HSMs together with methods such as multisig or multi-party computation (MPC).