If Windows 11 is asking for a BitLocker recovery key, do not change firmware settings or reinstall Windows yet. First record the recovery key ID shown on the screen, then use another trusted device to locate the matching 48-digit recovery key. Match the key by its ID, not only by the PC name. BitLocker is protecting encrypted data, so clearing the Trusted Platform Module (TPM), resetting the BIOS or UEFI settings, or changing your Windows password will not unlock the drive.
Record the recovery screen details first
The BitLocker recovery screen appears when Windows cannot verify the startup environment it previously trusted. It can follow a firmware update, a Secure Boot or boot-order change, a motherboard repair, a connected bootable USB device, or an unexpected startup problem. It does not automatically mean that the computer has been attacked or that the drive has failed.
Before restarting, record these details exactly:
- Recovery key ID: Copy at least the first eight characters shown. This identifies the required key; it is not the 48-digit recovery key itself.
- Account hint: On Windows 11 version 24H2 and later, the screen can show a hint for the Microsoft account associated with the saved key.
- Computer or drive name: Note it if it appears, but do not treat it as the deciding match when several keys are listed.
- Error category or code: On supported newer recovery screens, pressing Alt can display additional recovery information.
- Recent changes: Write down any Windows update, firmware update, repair, new internal component, docking station, external drive, or bootable USB device used immediately before the prompt.
A recovery key can unlock the encrypted drive, so treat it like a password. Do not post a photograph of it, send it to an unknown caller, or type it into a website reached through an advertisement. View it only through an account or backup location you trust, then enter it only on the BitLocker recovery screen.
If a bootable USB drive, recovery drive, or external disk was connected when the problem began, remove it and try one normal restart. Otherwise, leave the boot mode, Secure Boot, TPM, and BIOS or UEFI settings unchanged until you have the key. Randomly changing those settings can trigger further recovery checks.
Identify who may hold the recovery key
| PC situation | Where to look first | Likely key owner |
|---|---|---|
| Personally owned Windows PC | Microsoft account used during setup or when encryption was enabled | You or the person who originally set up Windows |
| Work-managed PC | Work account device page or company help desk | Employer or information technology administrator |
| School-managed PC | School account device page or campus support | School administrator |
| Family-configured PC | Account used by the family member who set it up | The original administrator |
| Secondhand PC | Previous owner or seller | The account or organization linked to the old installation |
| Offline backup | Printed records, USB flash drives, or saved text files | The person who enabled BitLocker |
Windows Device Encryption uses BitLocker technology and is available on many Windows Home computers as well as on Pro, Enterprise, and Education editions. On an eligible computer, it can turn on automatically when Windows is set up with a Microsoft account or a work or school account, and the recovery key is backed up to that account. Windows 11 version 24H2 removed some earlier hardware prerequisites, so more eligible PCs can use Device Encryption.
This is why a person may encounter a BitLocker recovery screen despite never choosing a visible “Turn on BitLocker” option. A local account does not normally turn on Device Encryption automatically, but encryption may have been enabled by another administrator, a previous account, or an organization.
Find the key for a personal Windows PC
- On another trusted phone, tablet, or computer, open Microsoft’s instructions for finding a BitLocker recovery key.
- Sign in with the Microsoft account suggested by the hint on the locked PC. If there is no hint, begin with the account used when Windows was first set up.
- Review the listed recovery keys and compare each recovery key ID with the ID displayed on the locked computer.
- Enter the associated 48-digit recovery key only when the IDs match.
If several Microsoft accounts have been used in the household, check each one separately. Possibilities include an older Outlook or Hotmail address, a parent’s account used during setup, or an account used by someone who repaired, upgraded, or reconfigured the PC.
Hypothetical example one: A laptop requests recovery after a BIOS update and shows a key ID beginning A1B2C3D4. The owner finds three saved keys in their Microsoft account. Only one key has an ID beginning A1B2C3D4, so that is the key to enter, even if another entry has a more recognisable device name.
If the key is not online, check printed records, USB flash drives, and saved text files. When BitLocker was enabled manually, Windows may have offered to print the key or save it in a text file. If the key is stored as a text file on a USB flash drive, use another device to read the file unless the recovery screen specifically offers to use that USB drive. Search personal storage for “BitLocker Recovery Key,” but do not upload possible key files to third-party “key finder” services.
Use the right route for work school family and used PCs
For a work or school computer, use the organization’s account on another device and look for the device record and its BitLocker keys. Some organizations permit self-service recovery, while others require an administrator to release the key. Give support the computer name, serial number or asset number, and the first eight characters of the recovery key ID.
Do not spend hours trying personal Microsoft accounts if the recovery screen shows an organization name, work-email hint, support number, or custom company message. The key may be stored in Microsoft Entra ID, Active Directory, or another organization-managed system instead of a personal account.
Hypothetical example two: An employee enters the correct key and reaches Windows, but recovery returns after every restart. Because the device is managed, the employee should not change Group Policy, Secure Boot, or BitLocker protectors. The organization’s information technology team needs to check the firmware state, boot configuration, and BitLocker policy before restoring normal protection.
For a family computer, ask who completed the original Windows setup or enabled encryption. The account hint may identify that person. For a secondhand computer, contact the seller: if the previous Windows installation was not properly erased, its recovery key may still be tied to the former owner or a former employer. Proof of purchase does not decrypt BitLocker-protected files, and Microsoft Support cannot retrieve or recreate a recovery key that was not backed up where you can access it.
Enter the matching key and assess the result
Enter the full 48-digit recovery key for the matching ID. The recovery key ID will not unlock the drive. Check every group before continuing. If the built-in keyboard does not work, try a basic wired USB keyboard. When recovery is being shown inside the Windows Recovery Environment, selecting a text-entry field may also provide an on-screen keyboard; that option is not available on every preboot recovery screen.
- Windows starts and the next restart is normal: The prompt may have been a one-time verification after an expected change. Back up the recovery key and complete any pending Windows or manufacturer updates.
- The screen says the key is incorrect: Check the recovery key ID again. A valid key for another encrypted drive, another PC, or an older protector will not unlock this request.
- The key unlocks the drive but Windows still will not start: BitLocker has unlocked the storage; a separate Windows startup, update, driver, or disk problem remains.
- The same recovery request returns after every restart: The TPM may still detect an unexpected boot configuration, or BitLocker protection may need to be resumed after a legitimate firmware or boot change.
Repair Windows only after the drive is unlocked
If the correct key unlocks the drive but Windows fails to start, use the least destructive Windows Recovery Environment option first. Startup Repair can address some boot-file and startup problems. If the failure began just after a Windows update, select Troubleshoot > Advanced options > Uninstall Updates. System Restore is another option when a suitable restore point exists; it restores system files and settings without intentionally removing personal files.
Windows 11 version 24H2 and later can also offer Point-in-time restore in the Recovery Environment. Unlike System Restore, it rolls the system drive back more broadly, including files, applications, and settings, so use it only when its restore point and consequences are acceptable. Most Recovery Environment tools require the BitLocker recovery key before they can access an encrypted Windows installation.
Review Choosing Between Windows 11 Restore Options before selecting a disruptive repair. Microsoft’s current Windows recovery options explain which methods preserve files, remove applications, or reinstall Windows.
A severely damaged encrypted volume can sometimes require professional data recovery with the correct recovery password and, in certain managed environments, a BitLocker key package. This is not a BitLocker bypass, and successful recovery is not guaranteed. Avoid unverified command sequences that remove protectors, repartition the disk, or write repaired data back to the only copy of the drive.
When no matching recovery key can be found
First confirm that the ID was copied from the current recovery screen. A PC with multiple encrypted drives can request different keys. Then check every relevant personal Microsoft account, work account, school account, family administrator, printout, USB flash drive, and saved text file.
If the expected account has no key, the PC may have been set up by someone else, joined to an organization, or encrypted manually with an offline backup. The account hint and any organization message on the screen are useful clues. If you cannot find the key and cannot safely reverse the startup change that caused recovery, there is no legitimate way to decrypt the existing data.
Password-reset tools, Windows sign-in password changes, boot disks, and clearing the TPM do not bypass BitLocker encryption. The remaining way to return the PC to use is to reset or reinstall Windows, which can erase inaccessible local files. “Keep my files” is not a workaround for a locked encrypted drive, and some reset paths still require the recovery key. Before choosing that route, check cloud storage, external backups, and every likely key owner.
Stop recovery from returning after every reboot
If the recovery key starts Windows but the prompt returns, install current Windows updates and the correct firmware update for the exact PC model. Confirm that the internal Windows drive is first in the firmware boot order and remove unnecessary bootable USB devices. Restore a Secure Boot, TPM, or boot setting only if you know it was changed; do not guess at firmware settings.
On a personally owned, unmanaged PC, suspending and then resuming BitLocker protection can update its trust relationship with a stable boot configuration. Confirm that the recovery key is backed up before doing this. Do not use this procedure on a work- or school-managed PC without the organization’s instructions.
- On Windows Pro, Enterprise, or Education, open Control Panel > System and Security > BitLocker Drive Encryption.
- Select Suspend protection for the operating-system drive, confirm the choice, and restart once.
- After Windows starts, return to BitLocker Drive Encryption and make sure protection is on. Select Resume protection if it remains suspended.
If the Control Panel option is unavailable, open Terminal as an administrator and run manage-bde -protectors -disable C:, then restart once. Protection normally resumes automatically at the next Windows startup. Run manage-bde -status C: afterward; if the status still shows protection suspended, run manage-bde -protectors -enable C:. Use C: only when it is the Windows system drive on that PC.
Suspending protection does not decrypt the drive, but it temporarily reduces preboot protection. If recovery continues after the settings are stable and protection has resumed, contact the PC manufacturer or the organization’s information technology team with the recovery error code and details of the preceding repair or firmware change.
Prepare before the next firmware or hardware change
While Windows is working, verify that a usable recovery key exists before changing the BIOS or UEFI, TPM, Secure Boot, motherboard, or major hardware. On Pro, Enterprise, and Education editions, the BitLocker Drive Encryption page can back up the recovery key. For Device Encryption, confirm that the key is visible in the account that owns the PC.
Follow the manufacturer’s instructions for the exact PC model. Some firmware-update tools handle BitLocker correctly, while others require BitLocker protection to be suspended before the change. Resume protection as soon as the work is complete, and keep another copy of the recovery information somewhere other than the encrypted PC.
Label an offline backup with the computer name and recovery key ID, but keep the full key private. That small preparation makes a future BitLocker screen an identity check rather than a potential data-loss event.
