Hardware Security Module
also called HSM
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
The guarantee is that private key material cannot leave the device. Operations are performed inside it: you send data to be signed or decrypted and receive the result. There is no API that returns the key, and physical tampering triggers destruction of the contents.
Where it is genuinely required: root certificate authority keys, payment processing under PCI requirements, code and document signing keys, and any key whose compromise would be organisation-ending. Regulation mandates it in several sectors.
The practical form for most organisations is a cloud HSM service or a managed KMS backed by FIPS-validated hardware, rather than a physical appliance — which removes the substantial operational burden of running one.
Two design considerations. Throughput is limited — an HSM performs a bounded number of operations per second, which is fine for wrapping data keys and inadequate for encrypting bulk data directly. This is another reason envelope encryption exists. And backup and recovery is deliberately hard: keys that cannot be extracted also cannot be casually copied, so HSM key backup uses specific procedures involving quorum and key custodians, and losing them means losing the keys permanently.