What Is a TPM and Why Does Windows 11 Require It?

TPM is often described as a tiny chip on the motherboard, but that is only one implementation. Modern PCs may use a discrete TPM chip, an integrated TPM, or a firmware-based implementation such as AMD fTPM or Intel Platform Trust Technology, better known as Intel PTT.

While software security remains essential, a TPM gives the operating system a hardware-backed foundation for protecting secrets and checking whether the system started in a trusted state.

Think of it as the difference between keeping your valuables in a desk drawer and putting them inside a dedicated safe. The TPM does not replace other security measures, but it makes some of the most sensitive information considerably harder for ordinary software to access or manipulate.

How TPM Protects Your Data and Software

One of the main jobs of a TPM is protecting cryptographic keys, the secret values used to encrypt data, prove the identity of a device, and authenticate users and software.

Instead of leaving sensitive keys exposed to normal software, TPM-backed security can generate or protect keys in an isolated environment. Depending on how a key is configured, operations involving it can be tied to the TPM rather than simply allowing the private key to be copied elsewhere.

These capabilities play a role in everything from disk encryption to authentication. Windows can also seal protected information to specific system conditions, allowing it to be used only when expected security requirements are met.

That is an important distinction: a TPM is not simply a storage locker containing passwords. It is a specialized security component capable of performing cryptographic operations while helping keep sensitive key material protected.

Ensuring System Integrity with TPM

Another important TPM feature is its role in checking and recording the state of the computer during startup.

Windows uses a technology called Measured Boot to record measurements of important startup components and security configuration in the TPM. This can include information about the Windows kernel, boot drivers, early-launch anti-malware software, and security-related configuration.

These measurements can then be used to determine whether the PC started in an expected state. This is particularly useful in managed business environments, where device health attestation can help an organization decide whether a computer should be trusted before granting it access to sensitive resources.

The TPM itself does not simply detect an unwanted program and block it from executing. Instead, it provides trustworthy measurements and protected data that Windows and security policies can use when making those decisions.

The Power of Hardware-Based Security

Because TPM functionality is separated from normal application software, it provides an important foundation for what is commonly called a hardware root of trust.

That makes it considerably more difficult for malware running inside the operating system to simply steal or modify protected cryptographic material.

Modern TPM functionality does not always come from a separate removable chip. Microsoft recognizes discrete, integrated, and firmware TPM implementations. AMD systems commonly expose TPM functionality as AMD fTPM, while many Intel systems use Intel PTT.

From the Windows user’s perspective, the important part is that the implementation complies with the appropriate TPM requirements and that TPM 2.0 is enabled and ready for use.

What’s New with TPM 2.0?

TPM 2.0 remains the modern TPM standard used by Windows 11. It offers significant improvements over TPM 1.2, including support for newer cryptographic algorithms, more flexible authorization, better application support, and improved TPM management.

The standard itself also continues to receive specification updates. The Trusted Computing Group lists TPM 2.0 Library Specification Version 185, published in March 2026, as the latest version of the TPM 2.0 Library specification. That does not mean PCs suddenly require a new “TPM 2.1” chip. TPM 2.0 remains the relevant platform generation.

TPM also works alongside other security technologies, but it is worth separating their roles. Secure Boot is a UEFI firmware security feature, not a function performed by the TPM. Secure Boot checks that trusted, properly signed software is allowed into the boot process, while Measured Boot records information about the startup state in the TPM.

Together, these technologies provide stronger protection than either would offer alone.

TPM 2.0 is also closely associated with BitLocker and Windows Device Encryption. BitLocker can operate in certain configurations without a TPM, so saying that BitLocker always requires one would be inaccurate. However, Microsoft recommends TPM 2.0, and TPM-backed BitLocker can automatically protect encryption keys while tying access to the expected state of the computer.

Windows Hello can also take advantage of TPM-protected key storage. Instead of relying solely on a reusable password, Windows Hello can use device-bound credentials protected by the hardware security architecture, with a PIN, fingerprint, or facial recognition used to unlock the credential.

Keeping Your System Safe with TPM 2.0

A TPM does more than protect encryption keys. Combined with Windows security features, it helps create a chain of trust extending from the firmware and startup process into the operating system.

Measured Boot can record whether important boot components and security settings changed, while technologies such as BitLocker, Device Encryption, Windows Hello, Credential Guard, System Guard, and device health attestation can use TPM capabilities in different ways.

For businesses, this makes TPM particularly useful for authentication and determining whether managed computers have booted into a trustworthy state. For home users, much of that work happens quietly in the background.

The result is not an invulnerable computer, and a TPM should never be treated as a replacement for updates, Secure Boot, antivirus protection, strong account security, and backups. It is one important part of a layered security model.

How to Turn on TPM 2.0 on Your Device

On many PCs, TPM 2.0 is already available and may simply need to be enabled. Before changing firmware settings, check whether Windows can already see it.

1. Check TPM from Windows. Press Windows key + R, type tpm.msc, and press Enter. If the TPM Management window says the TPM is ready for use, check Specification Version under TPM Manufacturer Information. For Windows 11 compatibility, it should show 2.0.
2. If no compatible TPM is detected, enter the UEFI firmware settings. In Windows 11, you can usually go to Settings > System > Recovery > Advanced startup > Restart now, then choose Troubleshoot > Advanced options > UEFI Firmware Settings. You can also enter the firmware during startup using a manufacturer-specific key such as F2, F10, F12, Esc, or Delete.
3. Find the TPM option. Depending on the motherboard or PC manufacturer, it may be called Security Device, Security Device Support, TPM State, Trusted Computing, AMD fTPM, AMD PSP fTPM, Intel PTT, or Intel Platform Trust Technology.
4. Enable it and save your settings. Restart Windows and check tpm.msc again to make sure Specification Version 2.0 is reported.

Microsoft also notes that TPM 2.0 systems should use native UEFI mode rather than Legacy or Compatibility Support Module modes. Changing an existing Windows installation from Legacy BIOS to UEFI without preparing the drive correctly can prevent Windows from booting, so that change should be treated separately from simply switching TPM on.

Why TPM 2.0 is Essential for Security on Windows 11

TPM 2.0 remains part of Microsoft’s minimum hardware requirements for Windows 11 in 2026. Windows 11 also requires UEFI firmware with Secure Boot capability.

Microsoft uses TPM 2.0 as a common security foundation so that compatible Windows 11 PCs can support stronger encryption, identity protection, credential security, device health checks, and startup integrity features.

This has become even more relevant since standard Windows 10 support ended on October 14, 2025. PCs moving from Windows 10 to a supported Windows 11 installation must meet Microsoft’s Windows 11 compatibility requirements, including TPM 2.0.

If Microsoft’s compatibility checker says your otherwise modern PC does not have TPM 2.0, it is worth checking the firmware before assuming the machine lacks the necessary hardware. Many systems already include firmware TPM functionality that simply needs to be enabled.

TPM 2.0 is therefore more than an arbitrary Windows 11 checkbox. It gives Windows a consistent hardware-backed security foundation that applications and system protections can build upon.

Windows 11 Options on G2A.COM

If you have confirmed that your PC meets the Windows 11 requirements and you are looking for a Windows 11 license, several Global key options are currently available on G2A Marketplace.

Always check the activation method, edition, regional restrictions, and license conditions on the individual offer page before buying. OEM licenses in particular can have different transfer conditions than other Windows licenses.

TPM 2.0 FAQ

Does every Windows 11 PC need TPM 2.0?

TPM 2.0 remains part of Microsoft’s official minimum system requirements for Windows 11. A PC may implement it through a discrete TPM, integrated hardware, or a firmware TPM such as AMD fTPM or Intel PTT.

Is TPM 2.0 the same thing as Secure Boot?

No. They are separate security technologies. Secure Boot uses UEFI firmware to help prevent untrusted boot software from loading. TPM can securely record measurements of the startup process and protect cryptographic material. Windows 11 requires TPM 2.0 and requires the PC to be Secure Boot capable.

Does BitLocker require TPM 2.0?

Not in every possible BitLocker configuration. Microsoft supports BitLocker without a TPM in certain setups, but TPM 2.0 is recommended and enables a more convenient hardware-backed configuration. Windows Device Encryption has stricter hardware requirements that include TPM 2.0.

How do I know whether I already have TPM 2.0?

Press Windows key + R, type tpm.msc, and press Enter. If the TPM is available, look for Specification Version: 2.0. If Windows cannot find a compatible TPM, check your UEFI settings for AMD fTPM, Intel PTT, Security Device Support, or a similarly named option.

Is there a TPM 3.0 or TPM 2.1 requirement for Windows 11?

No. TPM 2.0 remains the relevant standard for Windows 11. The TPM 2.0 specification itself continues to receive revisions, including the Trusted Computing Group’s Version 185 update from March 2026, but that does not create a new TPM generation that Windows 11 users need to buy.