Hardware Security Module
A hardware security module (HSM) is a server-grade device that generates and uses cryptographic keys without exporting them, used by banks, exchanges and custodians.
What Is a Hardware Security Module?
A hardware security module (HSM) is a tamper-resistant appliance or plug-in card that stores keys and performs signing inside its boundary. Applications send it data to sign; the keys never leave. HSMs are typically certified under FIPS 140-2 or 140-3 and run in data centres.
Exchanges, custodians and wallet vendors' backend services use HSMs to protect keys at scale, often with key ceremonies and access split among several staff. A secure element is the small, low-power relative found inside hardware wallets and bank cards.
For an individual, an HSM at a custodian is not self-custody: the custodian controls the device and the policy around it.
A crypto exchange is a company that lets users buy, sell and trade crypto and, by default, holds the keys to their coins.
Read full definitionA secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Read full definitionA hardware wallet is a dedicated device that keeps private keys offline and signs transactions internally, so the keys never reach an internet-connected computer or phone.
Read full definitionSelf-custody means users control their own private keys to manage cryptocurrency assets directly, without third-party custodians. It embodies 'not your keys, not your coins.'
Read full definitionReal-World Examples
Example 1: A custodian's withdrawal system sends each transaction to an HSM, which signs only if several staff approvals are present.
Example 2: A wallet vendor's server key for a 2-of-3 setup is generated and stored in an HSM.
Ready to Choose a Secure Wallet?
Use our tools to find the right hardware wallet for your needs.