BitLocker Explained: Recovery Key, Turning It On or Off
Short answer: BitLocker locks your drive’s contents so that a lost or stolen computer can’t be read by someone else. If Windows asks for a 48-digit recovery key, don’t panic, and don’t reset or reinstall Windows yet. First look for your key: sign in to your Microsoft account from another device at aka.ms/myrecoverykey.
This is a stressful screen when it appears out of nowhere. Here’s what it means, where to find the key, and how to decide whether BitLocker should stay on.
What BitLocker is, in plain English
BitLocker is a Windows feature that encrypts your drive, scrambling everything on it so it can only be read with the right key. Normally Windows unlocks it for you automatically when you sign in, and you never notice it. If someone removes the drive and plugs it into another computer, or the laptop is stolen, the files are unreadable without the key.
Why it matters
- A lost or stolen laptop. Without encryption, anyone can read the files from the drive. With it, they can’t.
- Personal and business data. Photos, tax records, passwords, medical information and client files are exactly the kind of thing worth protecting.
- Peace of mind. It works in the background, without you doing anything.
“Device encryption” or “BitLocker”? It depends on your Windows
Microsoft uses two names, and which one you have depends on your edition of Windows:
- Windows Home has Device encryption, a simpler version that is switched on automatically when you first sign in or set up the PC with a Microsoft account (or a work or school account). The recovery key is saved to that account. With a local account it isn’t turned on automatically.
- Windows Pro, Enterprise or Education has full BitLocker Drive Encryption, where you can manage individual drives yourself.
Both rely on BitLocker technology and both use a recovery key.
Why does Windows ask for the recovery key?
BitLocker checks that the computer starts up the way it did when encryption was turned on. If something changes, it asks for the key to make sure it’s really you. The most common triggers are:
- A BIOS or firmware update
- A hardware change, such as a new drive, motherboard or other component
- A change to Secure Boot settings
- Repairs or upgrades that touch the drive or startup settings
It’s a security check, not a virus. That’s also why we check whether BitLocker is on before we upgrade, clone or repair a drive. In one recent drive-cloning job, confirming that BitLocker was off let us rule it out as a cause quickly. (See why cloning a drive isn’t as simple as the videos make it look.)
How to find your BitLocker recovery key
Microsoft’s guide to finding your BitLocker recovery key lists where it can be:
- Your Microsoft account. From another device, go to aka.ms/myrecoverykey, sign in with the same account you use on that PC, and match the key ID shown on the locked screen.
- A work or school account. Go to aka.ms/aadrecoverykey, or ask your IT department.
- A printout. Check where you keep important papers. It may have been printed when BitLocker was turned on.
- A USB flash drive. Plug it into the locked computer and follow the prompts. If the key is saved as a text file, open it on a different device.
If you can’t find it, Microsoft says it can’t retrieve or recreate a lost key. The usual last resort is resetting the device, which erases your files. So before you reset or reinstall Windows, stop, look again, and ask for help.
The pros and cons
Pros
- Protects your data if the computer is lost or stolen.
- Works automatically on most modern computers.
- Usually has little effect on speed on modern hardware.
Cons
- If you lose the recovery key, your files can be lost with it.
- A BIOS update, hardware change or repair can trigger the recovery screen.
- It makes some repairs and data recovery harder, so you need to plan for it.
- On very old, slow computers it can be more noticeable.
Should you keep it on?
For most people, yes: keep it on, and make sure you know where your recovery key is. It matters most for laptops and for any computer holding personal or business information. People turn it off for specific reasons, such as a very old computer that feels slow or a repair that needs it disabled, and that’s reasonable if you’ve backed up first. If you do turn it off, remember that the drive is no longer protected.
How to check if it’s on, and turn it on or off
On Windows Home (Device encryption): open Settings, then Privacy & security, then Device encryption, and use the toggle. You need to be signed in as an administrator. If you don’t see Device encryption, your device may not support it.
On Windows Pro, Enterprise or Education: search for Manage BitLocker in the Start menu, then choose Turn on BitLocker or Turn off BitLocker for each drive.
Before you change either one:
- Back up your files to another drive or the cloud.
- Make sure your recovery key is saved where you can find it.
- Don’t interrupt it. Encrypting or decrypting a drive can take a while.
If you’re not sure, ask us first. It’s easier to check than to fix.
Before a BIOS update, upgrade or repair
Tell whoever is working on your computer that BitLocker is on. A careful technician checks, makes sure the key is saved, and may pause BitLocker for the job. Back up first, and see our post on cloning drives for why that matters.
A word of caution about “locked drive” scams
A real BitLocker recovery screen is a Windows startup screen that asks for a 48-digit key. It never gives you a phone number to call. If a pop-up or message says your drive is locked and tells you to call someone or pay, it’s a scam. See the fake “call now” pop-up.
Locked out, or not sure about your setup?
If you’re stuck on the recovery screen, don’t reset or reinstall Windows yet. Get in touch and we’ll help you look for the key and find the safest next step. Our data backup and transfer and hardware upgrades services can help you plan around encryption, and our data recovery evaluation is free. We help customers in Marlboro, Morganville, Manalapan, Freehold, Holmdel, Colts Neck, Aberdeen, Matawan and Old Bridge.
Information current as of October 2026. Windows menus and Microsoft’s guidance can change, so we’ll update this post when they do.
Frequently asked questions
What is a BitLocker recovery key?
It's a 48-digit code that unlocks a drive protected by BitLocker. Windows saves it when encryption is turned on, usually in your Microsoft account. You normally never see it, until Windows can't confirm that the computer hasn't been tampered with and asks for it.
Where do I find my BitLocker recovery key?
From another device, sign in to the Microsoft account you use on that PC at aka.ms/myrecoverykey and match the key ID shown on the locked screen. For a work or school computer, the key may be in your organization's account (aka.ms/aadrecoverykey) or with your IT department. It may also be on a printout or a USB flash drive you saved when BitLocker was turned on.
What if I can't find my recovery key?
Microsoft Support can't retrieve or recreate a lost recovery key. If the key isn't in any of those places, the usual outcome is resetting or reinstalling Windows, which erases the encrypted files. Before you do that, stop and look for the key again, think about old backups, and get help.
Why is Windows suddenly asking for the key?
BitLocker asks for the key when something about the computer's startup changes. The most common triggers are a BIOS or firmware update, a hardware change, or a change to Secure Boot settings. It's a security check, not a sign of a virus.
Should I turn BitLocker off?
For most laptops and anything with personal or business data, we'd generally keep it on, as long as you know where your recovery key is. If you turn it off, your drive's contents are no longer protected if the computer is lost or stolen. Back up your files and your key before changing anything.
Does BitLocker slow my computer down?
On modern computers the effect is usually small. On very old or slow machines it can be more noticeable. If a computer feels slow, there are usually bigger causes to check first.