A cryptographic module for limiting exposure of cryptographic keys protected by a trusted platform module (TPM) is provided. The cryptographic module includes logic for establishing a session with the TPM on behalf of a cryptographic client and logic for sending a request from the cryptographic client to the TPM to retrieve in plaintext a cryptographic key of the cryptographic client. Logic for receiving the cryptographic key in plaintext from the TPM are also included in cryptographic module. Further, cryptographic module includes logic for performing a cryptographic operation requested by the cryptographic client using the cryptographic key, and logic for sending the results of the cryptographic operation to the cryptographic client. A hardware-based method and system for limiting exposure of cryptographic keys also are described.