What is a secure element, and where does it sit?
A secure element is a small hardened chip designed so that the keys inside it never leave, even under physical attack. It holds payment and identity credentials on phones and cards. Ordinary applications cannot reach it, and that inaccessibility is the feature rather than a limitation.
What it is
A processor with its own memory, built to resist attacks that would defeat ordinary hardware: reading the chip under a microscope, disturbing it with voltage glitches, watching its power consumption for hints about the keys.
It performs operations with a key rather than handing the key out. Ask it to sign something and it returns a signature. Ask it for the key and it declines, and there is no mode in which it does otherwise.
Where it lives
Three homes, historically. Embedded in the phone, soldered to the board and controlled by the manufacturer. In the SIM card, controlled by the mobile operator. Or on a separate card, which is what a chip bank card is.
The SIM route mattered a great deal when operators hoped to control mobile payment, and it faded as the industry moved to embedded elements and software approaches. The embedded element is what a modern phone wallet uses.
Why you cannot reach it
Because anything you could reach, malware could reach. A secure element that accepted arbitrary applications would be an ordinary chip with a marketing name.
Access is therefore granted through the platform owner, under agreements with issuers, and that is exactly the bottleneck host card emulation was created to bypass. The two are not competing technologies so much as two answers to the question of who decides what a phone may present.
The practical consequence
An application cannot store a credential in the secure element, and cannot read what is in there. Any product design assuming otherwise is unbuildable, and it is better to discover that at the whiteboard than after a prototype.
Why it still matters
Because it defines what "the phone is safer than the card" actually means, and the answer is more precise than the slogan.
A plastic card responds to any terminal it is held against. A phone credential in a secure element is released only after the device has satisfied the user check the platform requires. The secure element holds the secret, and the operating system controls when it is used.
That combination is the substantive advantage, and neither half delivers it alone. A secure element with no user verification would be a card in a more expensive package.
Frequently asked questions
Does every phone have a secure element?
Most phones supporting payment do, in embedded form. Some devices rely on other approaches, and since applications cannot query or use it directly, its presence is rarely something a developer needs to determine.
Is the secure element the same as the trusted execution environment?
No, though they are often confused. A trusted execution environment is an isolated mode of the main processor, while a secure element is separate hardware. The second is harder to attack physically, the first is more flexible.
Can an NFC tag contain a secure element?
Cards can, and a chip bank card is exactly that. Ordinary tags do not, which is why a plain tag can never prove it is genuine and why authentication capable chips cost more.
Why can my banking app not put my card in another app?
Because provisioning a credential into the secure element goes through the platform owner and the card scheme. The bank does not control that path either, which is why phone payment is arranged through the platform wallet.