BitLocker recovery key: where to find it and what to do

You switch on your laptop and, instead of the usual sign-in screen, you see a blue screen asking for your BitLocker recovery key. Many people do not even realise at this point that their drive is encrypted. The key is a 48-digit number, and without it Windows will not start. You can usually find it yourself at no cost – most often it is in your Microsoft account. A new Windows licence does not replace it. Below you will find out why this screen appears, where the key usually is, what can realistically be done if you cannot find it, and how to prepare before it ever comes to that.

Why the recovery screen appears

BitLocker keeps the key that unlocks the drive in the computer's TPM chip. Every time the PC starts, the TPM checks whether the firmware and the boot process are the same as before. If it detects a change that could be an attempt at unauthorised access, it does not release the key and Windows asks you to prove the drive is yours. According to Microsoft's documentation, the typical causes are:

• a BIOS or UEFI firmware update – the most common case on laptops;
• changes to the TPM – turning off or clearing the TPM in the BIOS settings, replacing the motherboard;
• changes to the boot process – a different boot device order, booting from USB or the network, changes to the boot manager or to Secure Boot;
• moving the encrypted drive to another computer;
• entering the wrong PIN too many times, if a startup PIN is set for BitLocker.

If you know exactly what you changed, it is sometimes enough to undo it – for example, turn the TPM or Secure Boot back on in the BIOS – and the computer will start normally. There is more on both technologies in our article on Windows 11 requirements for TPM and Secure Boot.

First step: note down the key ID

The blue screen itself shows a Recovery key ID line. Write down the first 8 characters. If your account holds several keys, for example from an old laptop or an external drive, this identifier tells you which one is correct. Starting with Windows 11, version 24H2, the screen also shows a hint about the Microsoft account in which the key is stored.

Where to look for the key

In your Microsoft account

This is the most common place on home computers. From a phone or another computer, go to aka.ms/myrecoverykey, sign in with the Microsoft account you use on the locked PC and find the entry with the same ID. Type the 48 digits on the blue screen and press Enter.

If the list is empty, think about whether you might have used a different account – an old email address, a family member's account or the account of whoever set up the computer for you. Microsoft states explicitly that if someone else set up the device, the key may be in their account.

In a work or school account

If the computer was registered with a company or school through Microsoft Entra ID, go to aka.ms/aadrecoverykey, sign in with the work account, select Devices, expand your device and select View BitLocker Keys. On centrally managed company computers, the key is usually stored in Entra ID or Active Directory, and your IT administrator can give it to you.

On paper, in a file or on a USB flash drive

When BitLocker is turned on manually, Windows offers to print the key, save it to a file or save it to a USB flash drive. Look in the folder where you keep documents for the computer, in your cloud storage or on another PC for a text file with "BitLocker" in its name. If the key is on a flash drive, plug it into the locked computer and follow the on-screen instructions.

If the key cannot be found

We need to be honest here: without the key, the data on the encrypted drive cannot be recovered. That is exactly the point of encryption. Microsoft Support cannot recover, provide or recreate a lost key, and there is no "repair shop" way around it. A new Windows licence does not solve the problem either. The realistic options are:

• if the device belongs to your organisation, contact the IT department;
• undo the change that triggered the screen and restart;
• check every Microsoft account you have ever used once more;
• if nothing helps, reset the device using the Windows recovery options. The computer will work again, but the files on the encrypted drive will be erased.

That is why a backup of your important files in OneDrive or on an external drive matters just as much as the key itself. If it comes to a clean installation, see how to reinstall Windows 11 without losing activation.

How to back up the key in advance

Set aside a few minutes while the computer is working normally.

• Windows 11 Pro and higher editions: type BitLocker in the Start menu and open Manage BitLocker. Select Back up your recovery key and choose where: Save to your Microsoft account, Save to a USB flash drive, Save to a file or Print the recovery key. It is wise to choose at least two places.
• Windows 11 Home with Device encryption: the key is automatically attached to the Microsoft account you signed in with. Go to aka.ms/myrecoverykey, make sure the key is there and write it down on paper as well.

Do not keep the flash drive or the printout in the laptop bag – if someone steals it, they will have both the computer and the key. The key file cannot be saved to the encrypted drive itself.

Before a BIOS update or a hardware change on a Pro machine, you can temporarily suspend protection: Manage BitLocker has a Suspend protection option, and from PowerShell as an administrator you can run Suspend-BitLocker -MountPoint "C:" -RebootCount 0. After the update, turn protection back on with Resume-BitLocker -MountPoint "C:". While protection is suspended your data is more exposed, so do not leave it that way.

BitLocker and Device encryption: what is the difference

Full BitLocker Drive Encryption is available in Windows Pro, Enterprise and Education. There you decide which drives to encrypt, you can also protect external drives and flash drives, and you can manage the keys in several ways.

Windows 11 Home has a simplified feature – Device encryption. It uses BitLocker, but it turns on automatically the first time you sign in with a Microsoft account or a work account, and only if the hardware meets the requirements: a working TPM, Secure Boot enabled and a configured Windows Recovery Environment. With a local account it does not turn on automatically. That is why many owners of new laptops running Home have an encrypted drive without knowing it. A detailed comparison of the two editions is in our article Windows 11 Pro or Home.

How to check whether your drive is encrypted

• Settings → Privacy & security → Device encryption shows whether the feature is on. If this entry is missing, the device does not support it or you are signed in with a standard user account.
• On Pro, open Manage BitLocker – it shows the status of every drive.
• In a Command Prompt run as administrator, type manage-bde -status.
• To find out why Device encryption is not available, open System Information as administrator and look at the Device Encryption Support entry.

When you really need Windows 11 Pro

You do not need a new licence to find a lost key – that is sorted out with your account or your administrator. Pro makes sense if you want full control over encryption: BitLocker for all internal and external drives, a choice of where the key is kept and the option to suspend protection before service work. On top of that come features such as Remote Desktop. How to move from Home to Pro without reinstalling is covered in our article on upgrading Windows 11 Home to Pro, and general rules for protecting your system are in our piece on Windows security and your licence.

If you decide to upgrade, the Windows 11 Pro key from Litsenzi.bg arrives in your inbox within 15 minutes during working hours (09:00–20:00), together with an invoice. Activation goes through Microsoft's official servers, if there is an activation problem we replace the key free of charge, and you get a 2-year statutory guarantee and support in Bulgarian every day.