What Is Secure Boot and TPM? Why Windows 11 Needs Them
Secure Boot and TPM 2.0 guard your PC from startup to sign-in, and Windows 11 will not run properly without them.
Your PC probably passed the Windows 11 compatibility check without you noticing, or it failed with a blunt message: this PC can’t run Windows 11 because Secure Boot or TPM 2.0 is missing. The two names sound like obscure BIOS settings, but they are the foundation of Windows 11 security. One makes sure your PC only starts with trusted software. The other is a dedicated security chip that guards your encryption keys, passwords and sign-in data. This guide explains what Secure Boot and TPM actually do, how they work together, and how to check that both are switched on.
Secure Boot is a UEFI firmware feature that only allows trusted, digitally signed software to load when your PC starts, blocking rootkits and bootloaders planted by malware. TPM (Trusted Platform Module) is a tamper-resistant chip that stores encryption keys and credentials. Windows 11 requires TPM 2.0 and Secure Boot-capable hardware because together they protect the boot process, disk encryption and sign-in data from the moment you press the power button.
What is Secure Boot?
Secure Boot is a security standard built into UEFI firmware, the modern replacement for the old BIOS. When your PC powers on, Secure Boot checks the digital signature of each piece of boot software, the bootloader, the operating system kernel and key drivers, against a database of trusted signatures stored in the firmware. If anything fails the check, the PC refuses to start. That single rule blocks an entire class of malware that tries to load before Windows does.
The signatures come from a chain of trust. Microsoft signs the Windows bootloader, and hardware makers include Microsoft’s keys in the firmware signature database. Your PC also keeps a revocation list, called dbx, of signatures known to be compromised, so even a previously valid signature can be rejected once it has been abused. According to Microsoft, the original Secure Boot certificates issued in 2011 expire in June 2026, which is why updated certificates have been rolling out to Windows PCs through Windows Update since 2024.
What Secure Boot stops
The classic example is a bootkit: malware that infects the boot partition so it loads before the operating system and hides from antivirus software. With Secure Boot on, an unsigned or tampered bootloader simply will not run. If you ever need to remove malware from Windows 11, Secure Boot is part of the reason the infection could not dig in below the operating system in the first place. It also blocks tampered Windows bootloaders and drivers that lack a valid signature at startup.
What is TPM (Trusted Platform Module)?
A TPM is a dedicated security chip soldered onto your motherboard, or built into modern processors as firmware TPM (fTPM on AMD systems, Intel PTT on Intel systems). Its job is to generate, store and protect cryptographic keys in hardware that software cannot easily reach. Unlike a password file sitting on your disk, keys inside a TPM never leave the chip in usable form.
The TPM also measures your boot process. Each stage of startup records a cryptographic hash into the TPM’s Platform Configuration Registers, or PCRs. BitLocker, Windows drive encryption, can seal its keys to those measurements: if the boot measurements change, which suggests tampering, the TPM refuses to release the key and your drive stays locked. Learn more in our guide to the Trusted Platform Module on Wikipedia.
TPM 1.2 vs TPM 2.0
Windows 11 specifically demands TPM 2.0. The older 1.2 version lacks the algorithms and flexibility that Microsoft now relies on, so a PC with only TPM 1.2 fails the Windows 11 compatibility check.
| Feature | TPM 1.2 | TPM 2.0 |
|---|---|---|
| Cryptographic algorithms | Fixed set: RSA and SHA-1 | Flexible: RSA, ECC, SHA-256 and more |
| Key hierarchies | Single storage hierarchy | Multiple hierarchies for different uses |
| Meets Windows 11 requirement | No | Yes |
| Common on PCs sold | Roughly 2006 to 2016 | 2016 onward |
How Secure Boot and TPM work together
Think of Secure Boot as the bouncer and the TPM as the vault. Secure Boot decides which software is allowed to run at startup. The TPM watches and records exactly what ran, then guards the keys that software needs. Neither one is complete on its own: enforcement without secure storage can be worked around, and secure storage without enforcement can be tricked into releasing keys to the wrong software.
This partnership enables features you may already use every day. Windows Hello stores your PIN and biometric templates backed by TPM keys, so a stolen password database is useless without the physical chip. BitLocker uses the TPM to unlock your drive seamlessly at startup while keeping it encrypted against anyone who removes the disk. Virtualisation-based security features such as Credential Guard and memory integrity (HVCI) require both Secure Boot and TPM 2.0 to be active, and they isolate sensitive processes from the rest of the system.
According to Microsoft’s Windows 11 system requirements, every supported Windows 11 PC ships with TPM 2.0 and Secure Boot-capable firmware, which is why these protections are on by default on new machines rather than being expert-only settings you must hunt down.
Why Windows 11 requires them
Microsoft made TPM 2.0 and Secure Boot mandatory hardware requirements for Windows 11, a first for a mainstream Windows release. The reasoning is straightforward: operating system security has improved so much that attackers moved down the stack, targeting firmware and the boot process where antivirus software cannot see. A hardware root of trust closes that gap.
The timing matters too. According to Microsoft, support for Windows 10 ended on 14 October 2025, which pushed millions of remaining PCs toward Windows 11 and its hardware security baseline. PCs that cannot meet the requirements are left on an unsupported operating system that receives no security updates, which is a far bigger risk than any single missing feature.
Unofficial bypasses exist that install Windows 11 on hardware without TPM 2.0, but Microsoft warns these installations may stop receiving updates and are unsupported. For a daily-use machine, that trade is not worth it: you would give up the very protections that make Windows 11 safer. If you are building good habits, start with the cybersecurity basics and treat hardware security as their foundation.
What this protection looks like day to day
You will rarely notice Secure Boot or the TPM working, which is the point. When you type your Windows Hello PIN, the TPM verifies it against a key that never leaves the chip. When BitLocker encrypts your drive on a Windows 11 Pro machine, the TPM holds the key and releases it only if the boot measurements match what it recorded. If someone steals your laptop and pulls out the SSD, the data on it is unreadable without the original TPM.
Pair this hardware baseline with strong account security. Hardware-backed sign-in plus reputable 2FA apps on your important accounts covers both the device in your hands and the cloud services you use every day.
How to check Secure Boot and TPM on your PC
Two built-in Windows tools report the status in under a minute, with no downloads needed.
- Press the Windows key + R, type msinfo32 and press Enter. In System Information, find “Secure Boot State”. It should read On. If it reads Off, your firmware may need a settings change (see step 4).
- Press the Windows key + R, type tpm.msc and press Enter. The TPM Management console shows the TPM status and specification version. You want TPM 2.0 with a status of ready for use.
- For a command-line check, open PowerShell and run Get-Tpm. The TpmPresent and TpmReady values should both read True.
- If Secure Boot is off but your PC supports it, restart into the UEFI firmware settings (usually Del or F2 during boot), find the Secure Boot option under the Boot or Security tab, set it to Enabled, then save and restart. On AMD systems enable fTPM, and on Intel systems enable Intel PTT, usually under advanced CPU or security settings.
One caution: switching a drive between UEFI and legacy BIOS modes after Windows is installed can cause boot failures, so if your system was installed in legacy mode, back up your data first before changing firmware settings.
Frequently Asked Questions
Can I install Windows 11 without TPM 2.0 or Secure Boot?
Unofficial workarounds exist, but Microsoft does not support them and warns that such PCs may stop receiving updates, including security updates. You also lose BitLocker, Credential Guard and other hardware-backed protections. For any PC you rely on daily, meeting the official requirements is the only sensible option.
Does Secure Boot slow down my PC?
No. The signature checks happen once during startup and add only a fraction of a second to boot time. There is no ongoing performance cost while Windows runs, so gaming, creative work and everyday tasks are unaffected. If your PC feels slow, the cause lies elsewhere, such as a nearly full drive or heavy background software.
What is the difference between TPM and Secure Boot?
Secure Boot is a firmware policy that controls which software may start your PC. A TPM is a hardware chip that stores keys and records what actually started. Secure Boot enforces the rules at boot time, while the TPM provides the secure storage and measurement that features like BitLocker and Windows Hello build upon.
Is TPM the same thing as BitLocker?
No. BitLocker is Windows drive encryption software, while the TPM is the chip that protects BitLocker’s keys. BitLocker can work with a USB key or password instead, but the TPM mode is the most convenient and secure option because the key is sealed to your PC’s measured boot state.
Can malware bypass Secure Boot and TPM?
No defence is absolute. Researchers have demonstrated firmware attacks, such as the BlackLotus bootkit disclosed in 2023, which abused a legitimate bootloader that Microsoft then blocked through its dbx revocation list. Keeping Windows Update enabled is essential, because it delivers the revoked-signature lists and certificate updates that keep Secure Boot effective.
Conclusion
Secure Boot and TPM 2.0 are the quiet reason Windows 11 is harder to compromise than its predecessors. One verifies every piece of software that starts your PC, while the other locks your keys inside hardware that malware cannot reach. Together they underpin BitLocker, Windows Hello and the virtualisation-based protections running silently in the background. Check both are enabled with msinfo32 and tpm.msc, keep Windows Update switched on so revocation lists stay current, and you will have a hardware security baseline that most attacks simply cannot get past.
