BitLocker Recovery Key Screen? How to Find Your Key

Updated October 2026. Steps checked against Microsoft Support and Microsoft Learn documentation on 22 October 2026, for Windows 11 and Windows 10.

Short answer: your BitLocker recovery key is a 48-digit number, and on most home PCs it's saved in the Microsoft account that was used to set the PC up. Grab your phone or another computer, go to aka.ms/myrecoverykey, sign in, and match the Key ID shown on the blue screen. Type that key in and Windows boots normally.

If it isn't there, don't panic yet and definitely don't reset the PC. There are three or four other places it could be, and I've listed them below in the order I'd check them.

Jump to:

• Why the recovery screen appears
• Step 1: Write down the Key ID
• Step 2: Check your Microsoft account
• Other places the key could be
• If you can't find it at all
• Stopping it happening again
• FAQ

Why am I seeing the BitLocker recovery screen?

A lot of people hit this screen without ever knowingly turning BitLocker on. That's because Windows has a feature called Device Encryption, which encrypts the system drive automatically the first time you sign in with a Microsoft account, or a work or school account. It works on Windows 11 Home too, not just Pro. Since Windows 11 version 24H2, Microsoft lowered the hardware requirements, so far more laptops and desktops get encrypted on a fresh install or a new PC out of the box.

Normally you never notice. The TPM chip on your motherboard unlocks the drive silently at every boot. The recovery screen shows up when the TPM sees something it doesn't trust and refuses to hand over the key. According to Microsoft's own list, the usual triggers are:

• A BIOS or UEFI firmware update
• Turning off, clearing or resetting the TPM, or changing Secure Boot settings
• Changing the boot order, or booting from a USB stick or a network (PXE)
• Changes to the boot manager or the disk's partition table
• A new motherboard, or moving the drive into a different computer
• Typing the wrong BitLocker PIN too many times

So a recovery prompt after a BIOS update or a trip into the firmware settings is normal behaviour, not a virus. It's BitLocker doing its job a bit too enthusiastically.

If the key screen appeared right after the October 2026 Windows update and the PC goes into recovery even after you enter it, see how to fix the KB5127648 boot loop.

Step 1: Write down the Key ID

Before you go hunting, look at the recovery screen and note the Key ID (sometimes called the recovery key ID). You only need the first 8 characters. If you have more than one PC, or you've reinstalled Windows a few times, your account may hold several keys, and the Key ID is how you tell them apart.

On Windows 11 24H2 and later, the screen also shows a hint of the Microsoft account the key was saved to. That hint alone saves a lot of guessing, so read the whole screen before doing anything else.

Step 2: Check your Microsoft account

This is where the key is for most home users.

1. On a phone or another computer, open aka.ms/myrecoverykey.
2. Sign in with the Microsoft account you use on the locked PC.
3. Find the entry whose Key ID matches the first 8 characters on screen.
4. Type the 48-digit recovery key into the PC. The dashes are added for you.

If the list is empty, think about who set the PC up. A key goes into the account of whoever turned encryption on. If a family member, the shop or a previous owner signed in with their account during setup, the key is sitting in their account, not yours. I'd ask them to check the same link before trying anything drastic.

Step 3: Check your work or school account

If the PC was ever signed in to a work or school account, even briefly to check email, the key may have been backed up to that organization. Go to aka.ms/aadrecoverykey, sign in with that account, open Devices, expand your device and choose View BitLocker Keys. Some organizations block this, in which case their IT team can pull the key for you. On a company laptop, that's the first call to make anyway.

Step 4: Look for a printout, a USB drive or a text file

When BitLocker is turned on manually, Windows asks where to back up the key. Besides the Microsoft account, the options are printing it, saving it to a file, or saving it to a USB flash drive. So check:

• Paper: wherever you keep warranty cards and receipts. The printout shows the Key ID and the key together.
• USB flash drive: plug it into the locked PC and the recovery screen can read it. If it's a text file, open it on another device instead.
• A text file on another computer or in cloud storage: search for "BitLocker Recovery Key", which is how the default file name starts.

Where else the BitLocker recovery key could be

A few less common spots:

• Your PC maker's support portal or setup records: some business laptops are set up by the reseller. Ask them.
• Active Directory: on a domain-joined office PC, the key is usually stored there, and only IT can read it.
• An old phone or password manager: people often photograph the printout or paste the key into a notes app. Worth a quick search for "recovery key".

One warning: Microsoft Support can't retrieve, provide or recreate a lost recovery key. Anyone who calls you, or pops up online, offering to "unlock BitLocker" for a fee is running a scam.

What if you can't find the key at all?

This is the bad case, and I'm not going to pretend there's a trick. BitLocker is real encryption. Without the key, the data on that drive can't be read.

Before giving up, try undoing whatever triggered the prompt. If you just changed a BIOS setting such as Secure Boot, the TPM, or the boot order, change it back and restart. Sometimes that's enough for the TPM to trust the boot again and unlock the drive on its own.

If that doesn't work, the only way to get the PC usable again is to reset or reinstall Windows, which erases everything on the drive. Microsoft's recovery screen has options for this, or you can clean install from a USB stick made with the Media Creation Tool. Anything that was backed up to OneDrive or another cloud service will still be there afterwards. Anything that only lived on that drive is gone.

How to stop it happening again

Once you're back into Windows, take two minutes to make sure you're never stuck like this again.

First, check the key really is in your account. Open aka.ms/myrecoverykey on your phone and confirm the current Key ID is listed. If not, open Control Panel > BitLocker Drive Encryption > Back up your recovery key and save it to your Microsoft account. I'd also save a second copy somewhere that isn't the same PC.

Second, you can see the key on a working PC from an elevated Command Prompt:

manage-bde -protectors -get C:

Look under "Numerical Password". The ID is the Key ID, and the 48-digit "Password" is the recovery key. To check whether a drive is encrypted at all, run manage-bde -status.

Third, before a BIOS update or a TPM change, suspend BitLocker so it doesn't panic afterwards. In the BitLocker control panel, choose Suspend protection, or run this from an elevated prompt:

manage-bde -protectors -disable C: -RebootCount 1

The drive stays encrypted while protection is suspended, and it resumes after the next restart. Microsoft recommends exactly this for planned firmware and hardware changes.

Big Windows updates are another moment when a missing key bites, so check it before upgrading. My take on whether to install Windows 11 26H2 covers the upgrade itself, and if you're still on Windows 10, my Windows 10 extended updates guide covers your options.

Got a recovery screen with a message I haven't covered? Leave the exact wording in the comments and I'll add it here.

FAQ

What does a BitLocker recovery key look like?

It's 48 digits, split into eight groups of six digits. It's different from the Key ID, which is a shorter string of letters and numbers used to identify which key you need.

Why did BitLocker turn on when I never enabled it?

Device Encryption turns BitLocker on automatically when you sign in with a Microsoft account, or a work or school account, on supported hardware. It's on by default on many new Windows 11 PCs, including Home edition.

Can Microsoft give me my BitLocker key?

No. Microsoft Support can't retrieve or recreate a lost key. If the key was backed up to your Microsoft account, you can see it yourself at aka.ms/myrecoverykey.

Will resetting the PC remove BitLocker?

A "Remove everything" reset or a clean install wipes the old encryption along with all your files. Windows may then turn Device Encryption back on with a brand-new key, so check your account for that new key afterwards.

How do I turn off BitLocker on Windows 11?

Honestly, I'd leave it on and just keep the key safe. If you really want it off, Home users can flip the switch under Settings > Privacy & security > Device encryption. On Pro it's Control Panel > BitLocker Drive Encryption > Turn off BitLocker. Decrypting takes a while, but you can keep using the PC.