What is a Hardware Security Module (HSM)?

HSM stands for hardware security module. HSMs are cryptographic devices that serve as physically secure processing environments. Within these physically secure environments, you are able to perform cryptographic operations with the lowest risk possible for cyberattacks or data breaches. The types of cryptographic operations an HSM can perform are generally determined by the manufacturer. Operations can range from encrypting data to managing the overall health of your cryptographic infrastructure. If there are any cryptographic operations you need to perform, an HSM is the most secure way to do it.

Does my organization need to use an HSM?

The primary users of HSMs are organizations that need to protect sensitive data. This could include a software developer that wants to encrypt files and applications, a bank that needs to secure mobile payments, or a government organization that must protect personally identifiable information (PII) for private citizens. So, if your organization needs to protect sensitive data, then it may be a good idea to consider using a hardware security module.

What is the purpose of Hardware Security Modules?

Simply put, HSMs are the cornerstone of enterprise data security. The tamper resistance of hardware security modules helps keep IT infrastructure safe from cyberattacks and breaches, while mitigating the tremendous costs those disasters could potentially entail for business organizations.

What do Hardware Security Modules (HSMs) do?

A hardware security module (HSM) performs encryption. But encryption is only the tip of the iceberg in terms of capability. In reality, HSMs are capable of performing nearly any cryptographic operation an organization would ever need. Some common functions that HSMs do include: - Encrypt data for payments, applications, databases, etc. - Manage infrastructure with load balancing, monitoring, alerting, and device clustering - Create and manage encryption keys for hundreds of applications - Generate digital signatures to validate messages, software, and financial transactions - Sign digital certificates to authenticate devices, users, websites, and more - Among many other practical uses

In terms of encryption uses, HSMs encompass two main categories: payments and general-purpose. HSMs are used to process payment transaction data and manage the encryption keys involved. They can also be used to issue card and mobile EMV credentials. Hardware security modules also specialize in key management. That is to say, logically managing the encryption keys used to encrypt and decrypt data. This process involves the use of algorithms to create encryption keys, distribute those keys to different applications, and then set policies that determine when keys should be retired from use, and ultimately deleted. Additionally, users can also configure HSMs to generate asymmetric key pairs. This means that a public key is used to encrypt data and a private key is used to decrypt it. Users can also secure the private key and establish a certificate authority (CA) in the process. Put plainly, hardware security modules are used to establish complete and total network security for organizations of all sizes.

Many organizations deploy physical hardware security modules on-premises, but it is becoming more common to deploy HSMs through a cloud service. Cloud HSMs are based on their physical counterparts, and offer the same levels of functionality and compliance. Cloud HSMs are often deployed and managed from a single web interface, which helps reduce the costs associated with deploying HSMs. They also help streamline cryptographic infrastructure overall. Cloud HSMs are ideal for large enterprise needing to streamline and centralize infrastructure, as well as small-to-medium organizations that want to deploy cryptography for the first time.

What Makes Futurex the Best HSM Vendor?

For over 40 years, Futurex has been a trusted provider of hardened, enterprise data security solutions for more than 15,000 organizations worldwide. Customers choose Futurex for our best-in-class technology solutions and our exceptional customer support. Futurex hardware security modules protect your organization’s most sensitive data with strong encryption, tamper resistance, and logical security. All Futurex HSMs are FIPS 140-2 Level 3 and PCI HSM-validated, support vendor-neutral APIs, and include the RESTful web API. This is why Futurex has led innovation among HSM providers for 40+ years.

Do you offer a free demo of your HSMs?

Yes, absolutely. You can request a free demo for yourself or your organization here.

Hardware Security Modules (HSMs)

Up to 75 isolated virtual HSMs for multitenancy and workload isolation

Compliant with PCI HSM v4 and FIPS 140-3 Level 3 standards

Native support for Post-Quantum Cryptography (PQC)

Deployable as a 1U appliance, PCIe card, or cloud instance through VirtuCrypt

What is a hardware security module?

A hardware security module (HSM) is a hardened, tamper-resistant device that generates, stores, manages, and uses cryptographic keys inside a protected boundary. It keeps sensitive key material isolated from host applications, operating systems, and general-purpose infrastructure.

Futurex has built HSMs since 1981 and cloud HSMs services since 2014. More than 15,000 organizations worldwide trust Futurex HSM, key management, and cloud cryptographic solutions.

The right HSM strategy depends on two separate decisions: the workload the HSM must support and its deployment and operating model. Payment HSM and General Purpose HSM describe workload configurations. VirtuCrypt Cloud HSM is the hosted deployment model. Crypto Orchestration and Management is the administrative capability within the broader CryptoHub platform.

Choose the Futurex HSM solution that fits the requirement

Solution	Best fit	Primary focus
Payment HSM	Issuers, acquirers, processors, payment service providers, and payment infrastructure teams	Certified payment cryptography for EMV, PIN, P2PE, tokenization, card issuance, mobile payments, mPOS, remote key loading, and transaction processing.
General Purpose HSM	Enterprise security, data protection, infrastructure, PKI, application, and cryptography teams	A hardware root of trust for PKI, certificate authorities, code and firmware signing, application and database encryption, enterprise key management, IoT identity, 5G authentication, and digital asset custody.
VirtuCrypt Cloud HSM	Teams that need HSM-grade assurance without owning and maintaining appliances	A hosted deployment model for payment or general-purpose HSM workloads, with regional capacity, customer-controlled key options, disaster recovery, and access to CryptoHub capabilities.
Crypto Orchestration and Management	Organizations operating distributed physical, virtual, cloud-hosted, or mixed-vendor HSM estates	Centralized provisioning, configuration, monitoring, alerting, backup, failover, load balancing, discovery, SIEM integration, and remote key loading.

Why Futurex uses a converged HSM platform

HSM estates often expand one project at a time. Payment cryptography lands on one appliance family. PKI and code signing use another. Cloud capacity introduces a third operating model. Each addition creates another management interface, integration pattern, support path, audit trail, and upgrade cycle.

Futurex converges payment and general-purpose HSM functionality onto the Excrypt HSM platform. One appliance, one management model, and one firmware lineage can support payment transaction processing, card issuance, mobile payments, PKI certificate issuance, code signing, application encryption, cloud HSM deployment, and centralized key management with each workload separately configured and governed.

Standard cryptographic APIs and libraries help teams connect existing applications. The Excrypt Universal Interface adds compatibility with legacy HSM command sets, allowing many workloads to move to Excrypt without application rewrites. This supports staged migration rather than forcing a single, high-risk cutover.

Isolate workloads without duplicating hardware

A single physical Excrypt HSM can host up to 75 isolated virtual HSMs and 250 application partitions. Each virtual HSM can have its own firmware, configuration, key material, security policies, and network settings. Applications, tenants, departments, regions, and business units can share hardware without sharing trust boundaries.

Manage cryptography through enterprise infrastructure workflows

Administrators can use a web interface, APIs, and CLI automation tools for provisioning, policy changes, configuration review, and reporting. CryptoHub adds centralized orchestration, monitoring, reporting, discovery, backup, and failover across physical, virtual, and cloud-hosted HSMs.

Deploy where the workload needs to run

Excrypt HSMs are available as 1U rack appliances, PCIe cards, and cloud instances through VirtuCrypt. The deployment model can change without requiring a separate cryptographic platform or a different workload strategy.

Connect through established interfaces

Futurex supports PKCS #11, Java JCA/JCE, Microsoft CNG/CAPI/EKM, OpenSSL, RESTful APIs, the Excrypt native interface, and the Excrypt Universal Interface. These interfaces connect payment systems, PKI platforms, databases, applications, and cloud services to HSM-backed cryptographic operations.

Compliance and assurance support

Futurex HSMs support the certification and assurance requirements across payment, enterprise security, data protection, government, and cloud cryptography programs.

FIPS 140-3 Level 3 for hardware-backed key protection
PCI PTS HSM v4 for payment HSM requirements
Support for PCI cardholder data protection controls and regional payment standards, including Cartes Bancaires, Bancontact, GBIC, and AusPayNet AS 2805
Support for HIPAA-relevant key protection controls when CryptoHub Cloud HSM is used to protect regulated health data

What is the difference between a payment HSM and a general-purpose HSM?

Payment HSMs support payment-specific algorithms, key formats, and workflows such as EMV validation, PIN processing, P2PE, and tokenization. General-purpose HSMs support broader enterprise use cases, including PKI, code signing, application encryption, database encryption, and device identity. The Excrypt HSM platform supports both workload types.

Can payment and general-purpose HSM infrastructure be consolidated?

Yes. Excrypt HSM supports payment and general-purpose cryptography on the same hardware foundation, with standard APIs and interfaces for application integration and isolation through virtual HSMs and application partitions.

How is Futurex HSM management different from legacy HSM administration?

Futurex supports web-based administration, API and CLI-based automation, centralized orchestration, reporting, discovery, and cloud deployment options. Teams can manage HSM infrastructure through workflows that align with enterprise IT operations.

How many virtual HSMs can run on one physical device?

A single physical Excrypt HSM can support up to 75 isolated virtual HSMs and 250 application partitions.

Is the Excrypt HSM platform ready for post-quantum cryptography?

Yes. The Excrypt HSM platform natively supports ML-KEM (FIPS 203) and ML-DSA (FIPS 204) alongside classical algorithms, with an onboard quantum random number generator (QRNG) for hardware-based entropy.

What deployment models are available?

The Excrypt HSM platform is available as a 1U rack appliance, PCIe card, or cloud instance through VirtuCrypt.

Futurex Hardware Security Modules

At a Glance

What is a hardware security module?

Choose the Futurex HSM solution that fits the requirement

Why Futurex uses a converged HSM platform

How the Excrypt HSM platform operates

Isolate workloads without duplicating hardware

Manage cryptography through enterprise infrastructure workflows

Deploy where the workload needs to run

Connect through established interfaces

Plan for algorithm change without waiting for a hardware refresh

Extend the hardware root of trust with CryptoHub

Compliance and assurance support

Frequently Asked Questions

What is the difference between a payment HSM and a general-purpose HSM?

Can payment and general-purpose HSM infrastructure be consolidated?

How is Futurex HSM management different from legacy HSM administration?

How many virtual HSMs can run on one physical device?

Is the Excrypt HSM platform ready for post-quantum cryptography?

What deployment models are available?

Featured Resources

Find the right Futurex HSM path

Connect With Us