BitLocker Recovery Key in Windows
Find · Use · Back Up

What Is a BitLocker Recovery Key in Windows?

A BitLocker recovery key is a unique 48-digit numerical password used to unlock an encrypted Windows drive when normal unlocking is not possible. BitLocker usually unlocks the system drive automatically by using the Trusted Platform Module (TPM), your PIN, or another configured protector. If Windows cannot confirm that the boot environment is safe, it may stop at a blue BitLocker recovery screen and ask for this key.

The recovery key is not the same as your Windows password, Microsoft account password, PIN, BIOS password, or product key. It is a separate emergency credential created when BitLocker or Device Encryption is enabled.

123456-123456-123456-123456-123456-123456-123456-123456

Example: A1B2C3D4

Why Windows Asks for a BitLocker Recovery Key

Windows asks for the BitLocker recovery key when it detects a change that could affect the integrity of the encrypted drive or the boot chain. This does not always mean someone tried to attack the computer. It often happens after legitimate hardware, firmware, or software changes.

Common reasons for the BitLocker recovery screen

• BIOS or UEFI update changed the boot environment.
• TPM settings were reset, cleared, disabled, or changed.
• Secure Boot settings were modified.
• Boot order changed, for example after using a USB flash drive.
• Windows entered Automatic Repair after failed startup attempts.
• Major Windows update changed boot-related files.
• Disk, motherboard, or storage controller changes affected the system configuration.
• BitLocker detected a possible unauthorized access attempt.

If the prompt appeared after a firmware update or BIOS configuration change, entering the correct recovery key once may be enough. If the recovery screen returns on every boot, you should check TPM, Secure Boot, boot order, and BitLocker protector status.

How to Use the BitLocker Recovery Key ID

When the recovery screen appears, Windows displays a Recovery Key ID. Write down the first eight characters exactly as shown. This ID helps you choose the correct recovery key if your Microsoft account, work account, or administrator portal contains several keys.

1. On the BitLocker recovery screen, find the Recovery Key ID.
2. Write down the first eight characters.
3. Open your saved recovery keys on another phone, tablet, or PC.
4. Compare the Key ID on the screen with the Key ID shown next to each saved key.
5. Enter the matching 48-digit recovery key.

How to Find the BitLocker Recovery Key in a Microsoft Account

On personal Windows devices, the recovery key is often backed up to the Microsoft account that was used when Device Encryption or BitLocker was enabled. This is common on many modern Windows 11 laptops and some Windows 10 devices.

Microsoft’s recovery key page is usually available through this short address:

https://aka.ms/myrecoverykey

If someone else set up the computer, the key may be stored in that person’s Microsoft account rather than yours.

How to Find a BitLocker Recovery Key in a Work or School Account

If the PC was connected to an organization, domain, Microsoft Entra ID tenant, school account, or company management system, the recovery key may be stored by the organization. In that case, you may be able to view it yourself, or you may need to contact the IT department.

1. Open a browser on another device.
2. Go to the work or school recovery key page.
3. Sign in with your organization account.
4. Open the device list.
5. Select the locked device.
6. Choose the BitLocker keys option.
7. Match the Key ID and enter the corresponding 48-digit key.

https://aka.ms/aadrecoverykey

Other Places Where a BitLocker Recovery Key May Be Saved

If the key is not in your Microsoft account, check every place where it could have been saved when BitLocker was enabled. The available locations depend on how encryption was turned on.

Search for these phrases on backup disks and cloud storage:

BitLocker Recovery Key
Recovery Key ID
Numerical Password
BitLocker Drive Encryption recovery key

How to Enter the BitLocker Recovery Key Correctly

After you find the matching key, enter the 48 digits on the BitLocker recovery screen. On many recovery screens, hyphens are optional. You can type only the digits in sequence.

1. Confirm that the Key ID on the screen matches the saved key.
2. Type the 48-digit recovery key carefully.
3. Use the number row or numeric keypad; avoid copying from memory.
4. Press Enter.
5. If Windows starts, immediately back up the key again and check why recovery was triggered.

If the key is rejected

• Check that you selected the key with the matching Key ID.
• Make sure you are not using a key from another device or another drive.
• Check for typing errors: 0 and 8, 1 and 7, repeated groups, or missing digits.
• If several recovery keys are listed, compare the date, device name, and Key ID.

How to Back Up the BitLocker Recovery Key When Windows Still Starts

If Windows still starts normally, back up the recovery key before changing BIOS settings, updating firmware, reinstalling Windows, replacing hardware, or resizing partitions. A verified backup is much safer than trying to recover the key after the device is already locked.

Method 1: Use Control Panel

1. Open Start and search for Manage BitLocker.
2. Open BitLocker Drive Encryption.
3. Next to the encrypted drive, select Back up your recovery key.
4. Choose a safe backup method, such as saving to your Microsoft account, saving to a file, or printing the key.

Method 2: Use PowerShell or Command Prompt

Open Windows Terminal, PowerShell, or Command Prompt as administrator and run:

manage-bde -protectors -get C:

This command shows the protectors configured for drive C:. Look for the Numerical Password protector. If you need to save output to a file on another drive, use:

manage-bde -protectors -get C: > D:\BitLocker-Recovery-Key.txt

How to Prevent Unnecessary BitLocker Recovery Key Prompts

Some BitLocker recovery prompts can be avoided by suspending BitLocker before planned firmware, boot, or hardware changes. Suspending protection temporarily disables BitLocker checks while keeping the drive encrypted.

Before BIOS, UEFI, TPM, or boot changes

1. Open Manage BitLocker.
2. Next to the system drive, choose Suspend protection.
3. Perform the BIOS update, firmware update, or hardware change.
4. Restart Windows successfully.
5. Resume BitLocker protection.

Command-line method

manage-bde -protectors -disable C:
manage-bde -protectors -enable C:

Always re-enable protection after the maintenance task is complete. Leaving BitLocker suspended weakens boot-time protection.

What to Do If the BitLocker Recovery Key Is Lost

If the recovery key is lost and the encrypted drive cannot be unlocked by any configured protector, the data on the drive is effectively inaccessible. This is the purpose of strong disk encryption: without the key, the encrypted data cannot be recovered by guessing a password or bypassing Windows.

Try these checks before giving up

• Sign in to every Microsoft account that may have been used on the PC.
• Check whether another family member, administrator, or previous owner set up the computer.
• Check work or school portals if the device was ever connected to an organization.
• Search printed documents, USB drives, external disks, cloud storage, password managers, and backup folders.
• For business PCs, contact IT support and provide the Key ID shown on the recovery screen.

Useful BitLocker Administrator Commands in Windows

These commands are useful when Windows still starts or when you are working in a recovery environment with administrative access.

Check BitLocker status

manage-bde -status

Show protectors for the system drive

manage-bde -protectors -get C:

Suspend protection before maintenance

manage-bde -protectors -disable C:

Resume protection

manage-bde -protectors -enable C:

Unlock a data drive from Command Prompt

manage-bde -unlock D: -RecoveryPassword 123456-123456-123456-123456-123456-123456-123456-123456

Replace drive letters and recovery key values with your actual drive and key. Do not publish screenshots or logs that expose a real recovery key.

BitLocker Recovery Key FAQ