The security of encrypted systems rests on keeping certain keys secret, yet keys stored in ordinary memory can be stolen if a system is compromised. A hardware security module is a dedicated, tamper-resistant device that stores keys and performs operations with them without ever exposing the keys themselves.
An application asks the module to sign or decrypt something; the module does the work internally and returns only the result. Even an attacker who takes over the surrounding system cannot extract the keys, which is why such modules protect the most sensitive operations.