Jitsumi
Find us on Steam
Back to the blog

Find your BitLocker recovery key before you need it

Find your Windows recovery key, match the correct ID and keep an accessible backup outside your PC, with guidance for personal and work accounts.

Jitsumi

9 min read

A paper envelope and USB drive in a document box, stored separately from a laptop across the room.
Author
  • Jitsumi
Published
Reading time
9 min

Your laptop can ask for a BitLocker recovery key before it will let you reach the Windows sign-in screen. Knowing your usual PIN is no help if the screen is asking for a different, 48-digit number.

The useful preparation is to find your recovery key, identify the drive it belongs to, and keep a way to retrieve it without using that PC.

For a personal PC, start with Microsoft's recovery-key page . For a work or school device, check your organisation's recovery route or contact IT. If the recovery screen is already showing, note its key ID before choosing a saved key.

This guide covers Windows 10 and Windows 11. The available controls depend on your Windows edition and how the device is managed.

What the recovery key does

BitLocker encrypts a drive to help protect its data if someone gains physical access to the computer. On a suitably configured PC, unlocking normally happens without you typing a recovery key. Microsoft's Windows 11 Security Book explains the distinction between drive encryption and everyday sign-in.

The recovery key provides another way to unlock the drive when the usual process cannot complete. In consumer guidance, Microsoft uses “recovery key” for the 48-digit recovery password. That is the number this article means.

Three pieces of information are easy to confuse:

What you see

What it is for

Windows sign-in password or PIN

Signing in to your Windows account. It does not replace a requested BitLocker recovery key.

Recovery key ID

Identifying which saved recovery record matches the prompt. It is a label, not the unlocking number.

48-digit recovery key

Unlocking the drive when the matching recovery key is requested. Keep this number private.

Microsoft's BitLocker recovery guide documents both the 48-digit password and the identifying ID used to locate it.

A recovery prompt does not automatically mean an attack

Changes to hardware or startup configuration can trigger recovery. Software problems can do so too.

For example, Microsoft's July 2024 Windows 11 update notes documented unexpected recovery prompts on some devices. Microsoft addressed that issue in its 13 August 2024 update .

That example gives a reason to prepare, rather than a reason to assume every recovery screen means the same fault. If prompts keep returning after you unlock the PC, ask your device manufacturer or IT team to investigate the cause.

Where to find your BitLocker recovery key

The right place depends on how encryption was set up. A key might be in an account, a printed backup or a saved file.

A personal Microsoft account

On another trusted device, open aka.ms/myrecoverykey and sign in with the Microsoft account used when the PC was set up or encryption was enabled.

If there are several entries, use the key ID to identify the relevant one. Do not assume the first entry, the newest entry or the most familiar device name is the right choice.

If somebody else set up the computer, ask which account they used. Microsoft's recovery-key instructions explain that the backup may be in that person's account.

An empty list means this account does not provide the key you need. It is a reason to check the setup history and other saved copies, not proof that the drive is unencrypted.

A work or school account

For an organisation-managed PC, use the recovery service your IT team provides. Microsoft's work or school recovery link is one possible route: sign in, open the device list, select the affected PC and look for View BitLocker Keys. This route appears in Microsoft's July 2024 recovery instructions .

Some organisations also offer recovery through the Intune Company Portal website. Microsoft's May 2024 announcement describes Devices → your device → Get recovery key. It requires an enrolled device, a stored key and permission to view it.

If the key is missing or access is restricted, contact IT. Signing in with a work account does not guarantee that every device's recovery information is stored there. Follow the organisation's rules for handling its keys rather than copying them into a personal account.

A printout or a saved text file

Check the paperwork and storage you used when encryption was enabled. A recovery-key backup may be a printed sheet or a text file saved on a USB drive.

If it is a text file, read it on another working device. Simply plugging a USB drive containing a text document into the locked PC is not the same as entering its recovery key.

Keep the identifier with the full number. A note containing only the key ID will help you search, but cannot unlock the drive.

Match the key ID before entering the number

Suppose you find three saved records. One has a familiar computer name, and another was saved more recently. Neither detail answers the important question: which record matches the ID on the recovery screen?

In this illustrative example, the recovery screen's ID begins 7F3A2C91. Find the saved record with the same prefix, then use the 48-digit recovery key from that record.

Illustrative key ID 7F3A2C91 on a recovery screen matches the middle saved record; use that record's 48-digit recovery key.

*Illustrative records; recovery-key values are omitted. Match the ID before entering the key.*

Microsoft documents using the first eight characters to locate the matching recovery password.

The eight characters in the example are not what you type into the recovery-key field. Enter the complete 48-digit number associated with the matching record.

If it is rejected, recheck the ID and the number you entered. If no saved record matches, return to the account and backup locations above. Trying unrelated keys does not establish which account holds the right one.

Back up the key while Windows still opens

If you can use the PC normally, take the opportunity to create or confirm a usable backup.

On a personal PC with the BitLocker management interface:

  1. Open Start, search for BitLocker, and select Manage BitLocker.
  2. Locate the encrypted drive you want to protect against a lockout.
  3. Select Back up your recovery key.
  4. Choose an available destination. Options can include your Microsoft account, a file or a printout.
  5. Check the resulting backup before putting it away. For a file or printout, retain both its identifier and its complete recovery number.

These steps follow Microsoft's backup instructions . The Control Panel backup action is also documented in Microsoft's August 2024 BitLocker guidance .

Store a file somewhere you can reach when the protected PC is unavailable. A copy saved only on that PC will not help if you cannot open it. Keep a USB copy or printout securely and separately from the laptop; putting both in the same laptop bag exposes both to the same theft.

For a managed device, ask IT which backup method is permitted. Microsoft's Intune recovery guidance explains that policy can restrict backup choices. It also describes configured key rotation, so an old saved copy is not a substitute for checking the currently requested ID.

What if Manage BitLocker is missing?

A supported Windows Home PC can still use Device Encryption, even though it does not provide the full BitLocker management interface. Microsoft describes the edition distinction in its Device Encryption guidance . Consumer Device Encryption also predates Windows 11, as documented in the Microsoft Press Windows 10 overview .

Use the account-retrieval route to check for its key. The absence of a particular Control Panel option is not a reliable encryption check by itself.

If Windows still opens but you cannot locate a recovery backup, back up your important files while you have access. Then use Microsoft's or your manufacturer's support guidance to establish the correct recovery arrangement for that device.

Try retrieving it with the laptop set aside

A saved key is useful only if you can reach it.

Consider a simple dependency: your recovery key is in your Microsoft account, but the only copy of that account's password is saved on the laptop you are trying to unlock. Knowing the key is “online” has not yet solved the access problem.

You can check the retrieval route without deliberately triggering a BitLocker recovery screen:

  1. Leave the PC's settings alone. Use your own phone or another trusted device for the check.
  2. Open the account or saved backup. For an online copy, confirm you can complete sign-in and any verification without relying on the laptop.
  3. Identify the correct record. If you have just exported a recovery backup, compare its identifier with the account entry. Confirm you have the full recovery number, not just a screenshot of the ID or a bookmark to the website.
  4. Make the route findable. Keep a private note of the relevant account or secure storage location. Keep the recovery number out of public screenshots, forum posts and ordinary shared notes.

This is a retrieval rehearsal. It does not require changing firmware settings, clearing the TPM or forcing the computer into recovery.

Revisit the check when you change accounts, hand a PC to another family member or replace a recovery backup. If the arrangement depends on somebody else's account, resolve that dependency while both of you can still access it.

If you cannot find a matching key

Before choosing a destructive recovery option, check the other likely account, ask the person who set up the PC, inspect existing backups and contact IT where applicable.

Microsoft states that its support staff cannot recreate a lost BitLocker recovery key . The key ID does not provide a password-reset shortcut.

If normal unlocking cannot be restored and no valid recovery method is available, Microsoft's consumer guidance points to resetting the device. The reset described for this situation removes your files. It is not a way to recover the encrypted contents.

Also separate two outcomes: unlocking the drive and fixing the fault that interrupted startup. A correct key can get you past the encryption check while another Windows problem still needs attention.

The useful result of preparing now is concrete: you know which recovery record belongs to your drive, and you can retrieve it without that computer. Keep a separate backup of important files as well. A recovery key helps unlock a drive; it is not another copy of the files on it.

Sources and further reading

Continue reading

The blog