Troubleshooting
Windows 11 BitLocker Recovery: Find Your Key and Unlock
Written by Windows 11 Field Guide Editorial Team · Updated
Windows 11 BitLocker recovery screens tend to appear at the worst moment: after a firmware update, a repair, or for no reason you can see. The blue screen asks for a 48-digit recovery key and Windows will not start until you enter it. Do not panic and do not reinstall. In most cases the key is already saved somewhere you can reach from your phone, and this guide shows where to look and how to pick the right one.
Everything here applies to Windows 11 version 24H2 and 25H2, on both Home (Device encryption) and Pro (BitLocker).
What the recovery screen is asking for
BitLocker encrypts your drive. Normally the PC’s TPM security chip unlocks it automatically at startup, so you never notice. When BitLocker detects something that could indicate tampering, it refuses to unlock automatically and asks for the recovery key instead.
The screen shows two things you need:
- A Key ID, a long identifier for the key that unlocks this drive.
- A box for the recovery key, a 48-digit number split into eight groups of six digits.
Write down the first 8 characters of the Key ID before you go looking. If you find more than one key, the Key ID tells you which one is right.
Where to find your recovery key
Work through these places in order. You will need another device, such as a phone or second PC.
| Where | How to check | Typical for |
|---|---|---|
| Microsoft account | Go to aka.ms/myrecoverykey and sign in | Home PCs set up with a Microsoft account |
| Work or school account | Go to aka.ms/aadrecoverykey, open Devices, expand the PC and select View BitLocker Keys | Company or school laptops |
| Your IT department | Ask your helpdesk | Managed devices |
| A printout | Look for a page made when BitLocker was turned on | PCs where you chose Print |
| A USB flash drive | Plug it into the locked PC and follow the prompts | PCs where you saved to USB |
| A text file | Open it on another device | Keys saved to a file or cloud folder |
Microsoft account. On most personal Windows 11 PCs, the key was saved automatically to the Microsoft account used to set up the device. The link aka.ms/myrecoverykey takes you to the recovery keys page of your Microsoft account. If someone else set up the PC, for example a family member or the shop you bought it from, the key may be in their account. If you have several Microsoft accounts, check each one.
Work or school account. If you sign in to Windows with an organisation account, the key is usually stored by that organisation. You can often retrieve it yourself at aka.ms/aadrecoverykey; otherwise your IT department can.
Microsoft Support cannot retrieve, provide or recreate a lost recovery key, and neither can anyone else. If none of these places has it, see the last section.
Match the Key ID and enter the key
- In the list of keys, find the entry whose Key ID starts with the same 8 characters as the ID on your screen.
- Type the 48-digit recovery key on the locked PC, group by group.
- Press Enter. Windows unlocks the drive and starts normally.
If the key is rejected, check you have the right Key ID and re-type it carefully. A key saved for a different PC, or from before Windows was reinstalled, will not match.
Why the recovery screen appears
Microsoft lists many triggers in its BitLocker documentation. The ones home users run into most often are:
- BIOS or UEFI firmware updates, including updates installed by the PC maker’s own utility.
- Changing firmware settings such as Secure Boot, the boot order, or turning the TPM off, clearing it or resetting it.
- Motherboard replacement, which brings a new TPM that does not hold your key.
- Moving the drive to another PC.
- Changes to the boot manager or partitions, for example after installing another operating system alongside Windows.
- Docking or undocking some laptops, and entering a wrong PIN too many times where a PIN is used.
After a one-off change, entering the key once is often all that is needed. If the screen appears on every boot, check whether a firmware setting such as Secure Boot or the boot order was changed and set it back. Suspending and then resuming BitLocker from inside Windows also reseals the key to the current configuration.
Avoid it next time
For planned changes, suspend BitLocker first. On Windows 11 Pro, open Control Panel > System and Security > BitLocker Drive Encryption and select Suspend protection. Suspending leaves the drive encrypted but lets it unlock without the key while you update firmware or change hardware; protection resumes automatically after a restart. Many firmware updaters do this for you, but not all.
Also confirm your key is backed up. On the same BitLocker page, Back up your recovery key lets you save it to your Microsoft account, a file or a printout. Our BitLocker guide covers setup and backup in more detail.
Device encryption on Windows 11 Home
Windows 11 Home does not include full BitLocker management, but many PCs running Home use Device encryption, a simpler form of the same technology. When you sign in with a Microsoft account or a work or school account on supported hardware, Device encryption can turn on automatically and its recovery key is attached to that account. With a local account it is not turned on automatically.
To check, open Settings > Privacy & security > Device encryption. If the page is missing, your hardware does not support it or you are not signed in as an administrator. Device encryption shows exactly the same recovery screen as BitLocker, and the key is found the same way, at aka.ms/myrecoverykey. If you are deciding between editions, our Pro vs Home comparison explains the differences.
If you cannot find the key
Without the recovery key, the data on the encrypted drive cannot be decrypted. Before giving up, check every Microsoft account you or anyone in your household might have used, look through old emails, paperwork from the shop, and any USB drives. If the key is truly lost, the only way to use the PC again is to erase the drive and reinstall Windows, for example with a clean install, which removes all data on it. Files backed up to OneDrive or another backup are not affected. For other startup problems, see the Windows 11 troubleshooting hub.
Frequently asked questions
Where do I find my BitLocker recovery key?
On another device, go to aka.ms/myrecoverykey and sign in with the Microsoft account used on the locked PC. Other places are a work or school account, a printout, a USB flash drive or a saved text file.
Can Microsoft give me my BitLocker recovery key?
No. Microsoft Support cannot retrieve, provide or recreate a lost recovery key. If the key is not in any account, printout or file, the encrypted data cannot be unlocked.
Why did BitLocker ask for a recovery key after a BIOS update?
BitLocker checks that early startup components have not changed. A BIOS or UEFI firmware update, a TPM reset or a boot order change can look like tampering, so it asks for the key to be safe.
Does Windows 11 Home have BitLocker?
Windows 11 Home has Device encryption, a simplified form of BitLocker, on supported hardware. Full BitLocker management is in Pro, Enterprise and Education. Both can show the same recovery screen.
Which key do I use if I have several in my account?
Use the one whose Key ID matches the ID shown on the recovery screen. Compare the first 8 characters.
Sources
Windows 11 Field Guide Editorial Team
Editorial team
The Windows 11 Field Guide team writes and updates independent Windows 11 guides and checks each step against Microsoft's documentation and the current Settings app.
