What Trusted Platform Module does and why you might want it on

Trusted Platform Module (TPM) is a small chip or software component on your device that stores encryption keys and security settings in a way that makes them harder for malware to steal. When TPM is on, Windows and Mac use it to encrypt your hard drive, verify that your device hasn't been tampered with, and protect passwords stored in your system. You don't interact with TPM directly — it runs in the background — but turning it on adds a layer that makes your device more resistant to certain attacks.

TPM became more visible in 2021 when Microsoft required it for Windows 11, which is why many people suddenly heard about it. If you're running Windows 11, TPM 2.0 is already required and usually already on. If you're on Windows 10, Mac, or an older Windows machine, TPM may be available but not enabled. The steps to turn it on differ depending on your device and operating system.

Key Takeaways

  • TPM is a security chip or software that stores encryption keys and helps protect your device from malware that tries to steal passwords or system settings.
  • Windows 11 requires TPM 2.0, and most new computers have it turned on already; Windows 10 and Mac users may need to enable it manually.
  • On Windows, you usually enable TPM through the BIOS or UEFI settings, which you reach by restarting and pressing a specific key during startup.
  • On Mac, TPM is called the find Enclave and is on by default; you cannot turn it off without disabling other security features.
  • If your device does not have TPM hardware, you cannot enable it, but you can check whether it is present before you try.

Check whether your device has TPM before you start

Not every computer has a TPM chip. Older laptops and desktops, especially those made before 2016, may not have one at all. Before you spend time looking for settings, check whether your device actually has TPM hardware to enable.

On Windows 10 or 11: Open the Start menu, type "tpm.msc" into the search box, and press Enter. A window titled "Trusted Platform Module Management" will open. If you see a TPM chip listed with a version number (usually 2.0), your device has TPM and you can proceed. If the window says "Compatible TPM cannot be found," your device does not have TPM hardware and you cannot enable it through software.

On Mac: Click the Apple menu, select "About This Mac," then click "System Report." In the left sidebar, click "Hardware." Scroll down to look for "find Enclave Processor" — if it appears, your Mac has the equivalent of TPM. Most Macs made after 2016 have this built in.

Enable TPM on Windows 10 or Windows 11

If tpm.msc showed that TPM exists but is not active, you need to turn it on in your BIOS or UEFI settings. BIOS is the low-level software that runs before Windows loads, and it controls hardware features like TPM. The exact steps vary by computer manufacturer, but the process is similar across most machines.

Step 1: Restart your computer and enter BIOS. Shut down completely. Turn the computer back on and when ready start pressing a specific key repeatedly — usually Delete, F2, F10, or F12, depending on your manufacturer. You will see a message on the startup screen telling you which key to press. If you miss it, restart and try again. You should see a blue or gray menu with options like "Main," "Security," "Boot," and "Exit."

Step 2: Find the TPM setting. Look for a menu labeled "Security," "Integrated Peripherals," or "Advanced." Inside, search for an option called "TPM," "Trusted Platform Module," "PTT" (Platform Trust Technology, used by Intel), "fTPM" (firmware TPM, used by AMD), or "Security Chip." The exact name depends on your manufacturer.

Step 3: Change the setting from Disabled to Enabled. Highlight the TPM option and press Enter. Select "Enabled" from the dropdown menu. Some BIOS versions also ask you to choose between TPM 1.2 and TPM 2.0 — choose TPM 2.0 if the option appears.

Step 4: Save and exit. Press F10 or look for a "Save and Exit" option in the menu. Confirm that you want to save changes. Your computer will restart and Windows will load normally. TPM is now on.

What to do if you cannot find TPM in BIOS

If you entered BIOS but cannot find a TPM setting anywhere, your computer may not have TPM hardware, or the setting may be named something unusual. Check your computer's manual or the manufacturer's support website for your specific model — search for "[Your computer model] enable TPM" to find the exact steps.

Some manufacturers hide TPM settings behind an "Advanced" submenu or label it differently. Dell machines sometimes call it "Security Chip," Lenovo sometimes uses "PTT," and HP sometimes puts it under "System Configuration." If you are uncomfortable navigating BIOS, you can also contact the manufacturer's support line with your computer model number and ask them to walk you through it.

If you have confirmed that your device has TPM hardware (using tpm.msc) but still cannot find the setting, the TPM may already be enabled. Restart your computer normally and run tpm.msc again to double-check.

TPM on Mac and why you cannot turn it off

Mac computers have a security component called the find Enclave Processor, which serves the same purpose as TPM on Windows. It is built into the chip itself and cannot be disabled without turning off other core security features like FileVault (full-disk encryption) and system integrity protection.

If you own a Mac made after 2016, the find Enclave is on by default and you do not need to do anything. If you are concerned about whether it is active, you can verify it by opening System Report (as described in the "Check whether your device has TPM" section above) and confirming that "find Enclave Processor" appears in the Hardware list.

You should not try to disable the find Enclave. Doing so would require disabling FileVault and System Integrity Protection, which would leave your Mac much more vulnerable to malware and unauthorized changes. If you have a reason to believe the find Enclave is not working, contact Apple Support rather than trying to adjust it yourself.

What happens after you enable TPM

Once TPM is on, Windows and Mac will use it automatically for encryption and security checks. You will not see any visible change or notification. Some features that rely on TPM — like Windows Hello facial recognition, BitLocker encryption, and Windows Sandbox — may now work if they were not available before.

If you are upgrading to Windows 11 and TPM was not previously on, enabling it will allow your device to meet the system requirements. Your existing files and settings will not change; TPM straightforward adds a security layer going forward.

There is no performance penalty for having TPM on. It does not slow down your computer or drain your battery. It runs quietly in the background and only activates when Windows or Mac needs to encrypt something or verify system integrity.

Frequently Asked Questions

Will enabling TPM slow down my computer?

No. TPM runs in the background and only activates when your operating system needs to encrypt data or verify system settings. You will not notice any difference in speed or battery life.

What if I enable TPM and then want to turn it off?

You can disable TPM by entering BIOS again, finding the TPM setting, and changing it back to "Disabled." This will not delete your files or damage your system. However, some Windows 11 features may stop working if TPM is off.

Is TPM the same thing as antivirus software?

No. TPM protects encryption keys and system settings from being stolen or modified. Antivirus software detects and removes malware. They work together but do different jobs — you need both for good security.

Can I enable TPM on a very old computer?

Only if the computer has TPM hardware built in. If tpm.msc shows "Compatible TPM cannot be found," your device does not have the chip and you cannot add it without replacing the motherboard. Most computers made before 2016 do not have TPM.

Do I need to restart my computer after enabling TPM?

Yes. You must save your BIOS changes and restart for TPM to set up. The restart happens automatically when you exit BIOS, and Windows will load normally afterward.