How Computers Work · Starting Up · Lesson 3 of 5

TPM and Windows 11

The tiny security chip that guards your keys, and why Windows 11 needs it.

A small safe inside your PC

Your computer keeps some secrets that must never leak. These include the keys that unlock an encrypted drive and the keys behind your sign-in. A key here means a long secret code used to lock and unlock data.

The TPM, short for Trusted Platform Module, is a small security chip built to guard these keys. On many newer PCs it is built into the processor instead of being a separate chip. Either way, it does the same job.

A TPM does three main things:

• Stores keys safely. Keys kept inside the TPM are very hard to copy out, even for malware.
• Checks startup. It records what ran during startup. If the startup code was changed, it can refuse to release its keys.
• Resists guessing. If someone keeps guessing a PIN, it slows them down and then locks them out.

Two Windows features lean on it:

• BitLocker encrypts your whole drive. Encrypt means scramble data so only someone with the key can read it. The TPM holds that key and only hands it over when startup looks normal. If a thief pulls the drive out, the data stays scrambled.
• Windows Hello lets you sign in with a PIN, your face or your fingerprint. The TPM protects the keys behind it. That is why a Hello PIN only works on that one computer.

Phones have the same idea. An iPhone has the Secure Enclave, and Android phones have similar chips.

Macs use the Secure Enclave as well, so they don't use a TPM.

Why Windows 11 asks for TPM 2.0

When Windows 11 came out, many people learned the word TPM for the first time. Microsoft made TPM 2.0 a requirement. Version 2.0 is the newer, stronger standard. Older TPM 1.2 chips are not enough.

Why require it? Microsoft wanted every Windows 11 PC to have the same basic protection. With a TPM, features like BitLocker, Windows Hello and startup checks can rely on hardware, not just software. Windows 11 also requires UEFI firmware that can use Secure Boot. Together they make attacks on startup and stolen keys much harder.

How do you know if a PC qualifies? Use the free PC Health Check app from Microsoft. It runs on Windows 10 and checks the PC against the Windows 11 rules. It tells you which part passes and which part doesn't.

You can also check the TPM yourself on Windows 11:

1. Open Windows Security from the Start menu.
2. Select Device security.
3. Look for Security processor, then open Security processor details to see the version.

A common surprise: many PCs that fail the check do have a TPM, but it is turned off in the firmware. It may be listed under a name like fTPM or Intel PTT. If you see that, ask the PC maker's support pages how to turn it on.

Be careful of guides that bypass the TPM requirement. A PC without it misses real protection, and Microsoft may not support it.