Windows 11 BitLocker: Turn On Encryption and Save the Key

If your laptop is lost or stolen, a Windows password alone does not protect the files: someone can take the drive out and read it in another computer. Encryption fixes that. Windows 11 BitLocker encrypts whole drives so the data is unreadable without your sign-in or a recovery key. This guide explains the two forms you will meet, device encryption on Home and full BitLocker on Pro, how to check whether your drive is already encrypted, how to turn it on, and the one habit that prevents a lockout: knowing where your recovery key is.

The steps apply to Windows 11 version 24H2, 25H2 and 26H2.

Device encryption vs BitLocker

Microsoft describes BitLocker as a Windows security feature that encrypts entire volumes to protect against data theft from lost, stolen or decommissioned devices. There are two ways you get it:

	Device encryption	BitLocker Drive Encryption
Editions	All editions, including Home, on supported hardware	Pro, Enterprise, Education
Drives	System drive and fixed drives	System, fixed and removable drives (BitLocker To Go)
Turned on	Automatically in many cases, or one switch in Settings	Manage BitLocker wizard
Options	On or off	Startup PIN, startup key, choice of drives, suspend and more

Microsoft’s Learn documentation notes that, starting with Windows 11 version 24H2, some older hardware prerequisites for device encryption were removed, so more PCs are eligible for automatic and manual device encryption than before.

Check whether your drive is already encrypted

Many people are surprised to find encryption already on. Microsoft explains that device encryption turns on and attaches a recovery key to your account when you first sign in or set up the PC with a Microsoft account or a work or school account. With only a local account, it is not turned on automatically.

• Home: open Settings > Privacy & security > Device encryption. If the switch is on, the drive is encrypted.
• Pro: search Start for Manage BitLocker. Each drive shows BitLocker on or BitLocker off.
• Any edition: in File Explorer, an encrypted drive shows a padlock on its icon.

Turn on device encryption (Home and Pro)

1. Sign in with an administrator account.
2. Open Settings > Privacy & security > Device encryption.
3. Switch Device encryption on.

If you do not see Device encryption, Microsoft says the feature is either unavailable on the device or you are signed in as a standard user. To find out why:

1. Search Start for System Information, right-click it and select Run as administrator.
2. In System Summary, look at Automatic Device Encryption Support or Device Encryption Support.

Microsoft lists these values: Meets prerequisites (available), TPM is not usable (no TPM or it is off in firmware), WinRE is not configured (the recovery environment is not set up) and PCR7 binding is not supported (Secure Boot is off, or devices such as docks or external graphics are connected during boot). Our guides to enable TPM 2.0 and enable Secure Boot cover the firmware side.

Turn on BitLocker (Pro)

1. Search Start for Manage BitLocker and open it.
2. Next to the system drive, select Turn on BitLocker.
3. Choose how to back up the recovery key (see below).
4. Choose whether to encrypt used space only (faster, fine for a new PC) or the entire drive (better for a PC that has been in use).
5. Choose the encryption mode the wizard recommends for fixed drives.
6. Start encryption. You can keep working while it runs.

For USB drives, the same page lists removable drives under BitLocker To Go; our BitLocker To Go checklist covers them. If you are on Home and need these controls, see Windows 11 Pro vs Home before paying for an upgrade; device encryption is enough for most home users.

The recovery key: do this first

The recovery key is a 48-digit number that unlocks the drive when Windows cannot confirm the PC is safe, for example after a firmware update, a TPM reset, a motherboard repair or too many wrong PINs. Without it, the data is gone.

Good places for the key:

• Your Microsoft account, which happens automatically with device encryption when you sign in with one. You can view saved keys from another device by signing in to your account.
• A printout kept with important papers.
• A file on a USB drive that is stored separately from the PC.
• Your work or school account, on managed PCs.

Never keep the only copy on the encrypted drive itself. Microsoft’s Find your BitLocker recovery key page explains where to look if you are already at the blue recovery screen, and our BitLocker recovery key guide walks through it.

Before changing firmware or hardware

Encryption is tied to the TPM and the boot configuration. Before you update the BIOS, clear the TPM, change Secure Boot or boot mode, or swap the motherboard:

1. Make sure you can see the recovery key.
2. On Pro, consider Suspend protection in Manage BitLocker for the change, then resume afterwards.
3. Back up important files anyway.

Common questions and problems

• Yellow warning on the drive icon: Microsoft’s documentation explains that a newly set-up PC can show a warning until the recovery key is backed up and the TPM protector is created. Signing in with a Microsoft account as administrator completes this.
• Local account only: Microsoft notes that a device using only local accounts can remain unprotected even if data is encrypted. Use a Microsoft account at least once to back up the key, or use Pro’s BitLocker wizard and save the key yourself.
• Turning it off: Settings > Privacy & security > Device encryption > Off, or Turn off BitLocker on Pro. Decryption takes time; leave the PC plugged in.

For the bigger security picture, see our Windows 11 security hub and Windows 11 Pro guide.