Your BitLocker recovery key is a 48-digit number. On a personal Windows 11 PC it's usually saved in the Microsoft account that first set the PC up. Sign in at aka.ms/myrecoverykey from any phone or computer and pick the key whose ID matches the first eight characters shown on the recovery screen. Work PCs store it with your organisation (aka.ms/aadrecoverykey or your IT team). Printouts, USB drives and saved text files are the other places to check.
Written by the Softkeyworld technical team · Updated October 2026
A blue "BitLocker recovery" screen at start-up is alarming, especially when you don't remember turning encryption on. Since Windows 11 version 24H2, many more PCs are encrypted automatically after a clean install, including Home editions. Plenty of people meet BitLocker for the first time on that recovery screen, often after a BIOS update or a hardware change.
The good news is that in most cases the key exists and can be found in a few minutes from another device. This guide covers where to look, in order of likelihood, and how to back up the key properly once you're back in.
Key takeaways
- Note the Recovery key ID on the blue screen first. It tells you which saved key to use.
- Personal PCs: check every Microsoft account that might have been used during setup, not just your own.
- Work or school PCs: the key is held in Microsoft Entra ID or Active Directory. Ask IT.
- Microsoft Support can't recreate a lost key. Without it, the only option is a reset that erases the drive.
- Suspend BitLocker before BIOS/UEFI updates to avoid the recovery prompt altogether.
Why Windows 11 is asking for a recovery key
BitLocker normally unlocks silently using the PC's TPM (Trusted Platform Module). The TPM releases the key only if the boot environment looks the same as last time. When something in that chain changes, BitLocker can't confirm the PC hasn't been tampered with and falls back to the recovery key. Common triggers:
- A BIOS/UEFI firmware update, or a reset of firmware settings to defaults
- Turning Secure Boot off or on, or clearing the TPM (see our guide to enabling TPM 2.0 in the BIOS for where these settings live)
- Changing the boot order, or booting from a USB stick or docking station on some models
- Replacing the motherboard, or moving the drive to another PC
- Too many incorrect PIN attempts where a start-up PIN is configured
Microsoft's BitLocker overview confirms that from Windows 11 version 24H2 the older hardware prerequisites for device encryption (Modern Standby/HSTI and DMA requirements) were removed, so more devices qualify for automatic encryption. That's why people who've never opened a BitLocker setting can still end up at the recovery screen.
Step 1: Read the recovery key ID on the blue screen
Before you go looking, write down what the recovery screen tells you. It shows a line similar to "Recovery key ID (to identify your key): 1A2B3C4D", often followed by a hint such as "Here's how to find your key: aka.ms/myrecoverykey". The ID matters because accounts often hold several keys: one per drive, one per PC, and new ones each time encryption was re-enabled. Microsoft advises matching the first eight characters of the ID to choose the right key.
If the ID isn't visible straight away, look for an option on the screen for more recovery options. The layout varies slightly between Windows versions. Keep the PC switched on at this screen. You'll enter the key there once you've found it, using the number keys or F1–F10 (F10 types 0) if the keyboard layout isn't loaded.
Step 2: Check your Microsoft account (personal PCs)
When device encryption or BitLocker is set up on a PC signed in with a Microsoft account, Windows uploads the recovery key to that account. To retrieve it:
- On a phone, tablet or another computer, go to aka.ms/myrecoverykey. It redirects to the recovery keys page of your Microsoft account.
- Sign in with the Microsoft account that was used on the locked PC. Complete any two-step verification.
- Find the entry whose Key ID starts with the same eight characters as the blue screen. The device name and upload date help confirm it.
- Type the 48-digit Recovery key (eight groups of six digits) into the locked PC and press Enter.
"There are no BitLocker recovery keys in your account"
This is the message that sends people into a panic. Before you give up, work through the accounts that could have been used:
- Whoever set the PC up. If a partner, parent or the shop that prepared the laptop signed in first, the key went to their account.
- Old or secondary addresses. Outlook.com, Hotmail, Live and Xbox accounts are all Microsoft accounts.
- Any administrator on the PC. Microsoft's documentation says the key is uploaded when an administrator signs in with a Microsoft account. On a shared family PC, check every adult's account.
Step 3: Work or school PCs (Entra ID and Active Directory)
On a device joined to Microsoft Entra ID (formerly Azure AD), the key is backed up to the organisation's directory. You may be able to see it yourself at aka.ms/aadrecoverykey: sign in with your work account, open the device and choose View BitLocker Keys. Some organisations block self-service, and then the helpdesk retrieves it from the Entra or Intune admin centre.
On traditional Active Directory domains, the recovery password is stored on the computer object in AD and is visible to administrators with the right delegated permissions. Either way, give IT the recovery key ID from the blue screen and they can find the right key quickly. If a personal Microsoft account was ever added to a work PC, check that account too.
Step 4: Printouts, USB drives and saved files
When BitLocker is turned on manually in Windows 11 Pro, the wizard insists on a backup. It offers your Microsoft account, a USB flash drive, a file or a printout. Look for:
- A text file named like
BitLocker Recovery Key 1A2B3C4D-....TXTon another drive, a NAS or in cloud storage. Search your other devices for "BitLocker Recovery Key". - A USB stick used during setup. Plug it into the locked PC, and the recovery screen can read the key from it directly.
- A printed page or a PDF saved through "Microsoft Print to PDF", often in the Documents folder of another computer.
- Password managers. Some people paste the key in as a secure note.
Where the key may be: quick reference
| How the PC was set up | Most likely location | Who can retrieve it |
|---|---|---|
| Home or Pro, signed in with a Microsoft account (automatic device encryption) | Microsoft account recovery keys page | The account owner, from any device |
| Pro, BitLocker turned on manually | Whichever backup you chose: account, USB, file or print | You |
| Work PC joined to Microsoft Entra ID | Organisation's Entra ID tenant | You (if self-service is allowed) or IT |
| Domain-joined PC (Active Directory) | Computer object in AD DS | Domain administrators |
| Local account only, never linked | Only where you manually saved it | You. If it was never saved, it can't be recovered |
Back up your key now, while Windows is working
Once you're back in, or if you're reading this before trouble strikes, take two minutes to confirm the key is stored somewhere you control.
Show the key with manage-bde
- Right-click Start and choose Terminal (Admin).
- Run
manage-bde -statusto see which drives are encrypted and their protection status. - Run
manage-bde -protectors -get C:. Under Numerical Password you'll see the ID (in braces) and the 48-digit password, which is your recovery key. - Repeat for other fixed drives (D:, E:) if they're encrypted.
The PowerShell equivalent is (Get-BitLockerVolume -MountPoint "C:").KeyProtector, which lists each protector with its KeyProtectorId and RecoveryPassword.
Use the graphical tools
- Windows 11 Pro, Enterprise, Education: Control Panel > System and Security > BitLocker Drive Encryption > Back up your recovery key. Save to your Microsoft account and to a file or printout kept off the PC.
-
Windows 11 Home: Settings > Privacy & security > Device encryption shows whether encryption is on. Home relies on your Microsoft account for the backup, so confirm the key appears at aka.ms/myrecoverykey, and note it down with
manage-bdeas above.
Never save the only copy of the key on the encrypted drive itself. It's the one place you can't reach when you need it.
How to avoid the recovery screen next time
Most recovery prompts we hear about follow planned maintenance, and they're avoidable. Before a BIOS update, a Secure Boot change or a hardware swap, suspend protection for one restart:
- Open Terminal (Admin).
- Run
Suspend-BitLocker -MountPoint "C:" -RebootCount 1(ormanage-bde -protectors -disable C: -RebootCount 1). - Carry out the update and restart. Protection resumes automatically after the set number of restarts.
Suspending doesn't decrypt the drive. It temporarily stores the key unprotected so the next boot doesn't need the TPM check. Pro users can do the same from Control Panel with Suspend protection. Most manufacturer update tools (Dell, HP, Lenovo) suspend BitLocker on their own, but don't rely on it.
If you're about to replace a motherboard, plan for activation as well as encryption. Our guide on Windows activation after a hardware change covers the licensing side, and it's worth recording your licence details first using the methods in how to find your Windows product key.
If you really can't find the key
Microsoft is explicit in its recovery key support article: Microsoft Support can't retrieve, provide or recreate a lost BitLocker recovery key. Encryption that could be bypassed wouldn't protect anyone. If every location above comes up empty, the remaining route is to reset or reinstall Windows, which erases the encrypted data.
- Ignore websites and tools that promise to "crack" or "bypass" BitLocker. Against a properly configured drive they don't work, and many are scams or malware.
- Be wary of unsolicited calls or pop-ups claiming to be Microsoft and offering to unlock the drive. Microsoft doesn't do this.
- After reinstalling, Windows will reactivate automatically on the same hardware if it had a digital licence or an OEM firmware key.
Home vs Pro: what you can control
Windows 11 Home offers device encryption, a simplified form of BitLocker with few settings. Pro adds full BitLocker management.
| Capability | Windows 11 Home | Windows 11 Pro |
|---|---|---|
| Encrypt the system drive | Yes, via device encryption on supported hardware | Yes |
| Choose where the recovery key is saved | Microsoft account only (manual copy via manage-bde) | Account, file, USB or print |
| Start-up PIN, BitLocker To Go for USB drives | No | Yes |
| Group Policy control and domain/Entra backup | No | Yes |
For a broader look at what else changes between the two editions, see our Windows 11 Home vs Pro guide.
Frequently asked questions
How do I find my BitLocker recovery key with my Microsoft account?
Go to aka.ms/myrecoverykey on any device, sign in with the account used on the locked PC, and match the Key ID to the first eight characters shown on the recovery screen.
How long is a BitLocker recovery key?
48 digits, shown as eight groups of six. Don't confuse it with the shorter recovery key ID, which only identifies the key.
Why did BitLocker turn on when I never enabled it?
Windows 11 turns on device encryption automatically on eligible hardware after setup, and from version 24H2 far more PCs qualify. The key is uploaded when an administrator signs in with a Microsoft account.
Can I find the key using Command Prompt?
Only while Windows is unlocked. Run manage-bde -protectors -get C: as administrator and read the Numerical Password. It can't be read from a locked drive.
Can Microsoft unlock my drive?
No. Microsoft can't retrieve or recreate a lost key. If it isn't stored anywhere, the drive has to be reset, and its data is lost.
Should I turn BitLocker off to avoid this?
For most laptops, no. Encryption protects your data if the device is lost or stolen. Back the key up in two places and suspend protection before firmware changes instead.
Our recommendation
Treat the recovery key like the deeds to your data. Keep one copy in your Microsoft account and one offline, and suspend BitLocker before any firmware work. If you want full control over encryption, such as choosing backup locations, adding a start-up PIN and encrypting USB drives with BitLocker To Go, Windows 11 Pro provides it, and an upgrade from Home keeps your apps and files in place.
Upgrade Windows 11 Home to Pro
Related reading
| Resource | Why read it |
|---|---|
| How to find your Windows product key | Record your licence before hardware work |
| Windows activation after a hardware change | Reactivate after a motherboard swap |
| Windows 11 Home vs Pro | Decide whether full BitLocker is worth the upgrade |