The TPM is basically another processor with a small amount of on-chip storage.  It exposes two fundamental operations: seal(plaintext) returns a secret, and and unseal(secret) returns the original plaintext.  If you tamper with the device, the internal storage (i.e. the keys it uses to seal and unseal) is wiped. Unseal attempts are rate limited (at the hardware level) to prevent brute force attacks.<p>You can <i>also</i> seal against some other value. So you&#x27;d have seal(plaintext, pin) and unseal(secret, pin). Unseal only returns the plaintext if the PIN is the same that was used to seal.<p>This is where it gets really fancy. The TPM has a bunch of built-in registers called PCRs (Platform Configuration Registers). You set a PCR by calling extend(newmeasurement). At boot, the firmware hashes the bootloader and sticks the hash in the first PCR by calling extend(hash). Then the bootloader measures the next boot component (probably a second stage bootloader, or perhaps the BIOS settings), and stores that hash in a PCR, and so forth.  The resulting value of each PCR is based on both the measurement passed to extend() <i>and</i> the previous measurements, so the whole chain is verified. The cool thing is that seal() and unseal() can use these PCRs the the same way as, and in addition to, a PIN.  Now your disk will only be decrypted if you boot the OS that you used to encrypt it. If you&#x27;re willing to trust the firmware and OS makers, you don&#x27;t even need a PIN anymore. The OS&#x27;s built-in authentication could be enough.<p>Windows PCs tend to have TPMs, but iOS devices have their own hardware encryption solution.<p>I&#x27;ve glossed over and simplified away important details, but that&#x27;s the gist of it.