Every time your computer powers on, a quiet check decides whether the software loading is the real thing or an impostor. That check is Secure Boot, and it guards the most vulnerable moment of all — the instant before your operating system even starts. Our GetMyPassword team explains what Secure Boot is and why it matters for your security.
What Secure Boot is
Secure Boot is a security feature that checks the software loading during startup is trusted and unaltered before letting it run. When you turn the computer on, it verifies that the early boot code and operating system loader carry a valid digital signature. If something has been tampered with or swapped for malicious code, Secure Boot refuses to load it. In short, it makes sure your computer starts up with software it can trust.
The threat it blocks
The startup sequence is a prized target because code that runs there loads before your operating system and security tools. Malicious software that sneaks in this early — sometimes called a bootkit — can hide beneath everything else and survive reinstalls. Secure Boot shuts that door by allowing only signed, trusted boot software to run, so an attacker cannot quietly replace the very foundation your system is built on.
How it works with the rest of your defenses
- It pairs with the TPM — Secure Boot verifies the startup, while the chip guards keys and secrets.
- It supports disk encryption by helping ensure the system booted in a trusted state.
- It is part of why Windows 11 asks for modern firmware — a stronger baseline for everyone.
- It runs automatically in the background, with no day-to-day effort from you.
Secure Boot guards the foundation: the code that runs before anything else. Block tampering there, and an attacker loses the deepest, hardest-to-find place to hide.
What it does not do
Secure Boot protects how your computer starts; it does not stop everyday threats once the system is running, like phishing, a weak password, or an account breached from across the world. It is one strong layer at the base, not the whole wall. Keep it enabled, let it work alongside the TPM and disk encryption, and protect the account side too — a unique password from our password generator for every login, with two-factor authentication.
Frequently asked questions
What is Secure Boot?
It is a security feature that checks the software loading at startup is trusted and unaltered before running it. It verifies a valid digital signature on early boot code, refusing to load anything tampered with or malicious.
What does Secure Boot protect against?
It blocks malicious software that tries to load during startup, before your operating system and security tools — such as a bootkit that hides beneath everything else and survives reinstalls. Only signed, trusted boot software is allowed to run.
Does Secure Boot protect my accounts?
No. Secure Boot protects how your computer starts, not your online accounts. It will not stop phishing or a leaked password, so you still need a unique password per account and two-factor authentication.