You turn on your PC and instead of the login screen you get a blue page that says “BitLocker recovery – Enter the recovery key for this drive.” Nothing is broken and it is not malware. BitLocker noticed that the boot environment changed and locked the drive to protect it. Here is why it happens, where to find the 48-digit key, and how to stop it from coming back.
One thing that surprises a lot of people: on Windows 11, even the Home edition, signing in with a Microsoft account often turns on Device Encryption automatically. It uses the same BitLocker mechanism, which is why you can see this screen without ever having turned BitLocker on yourself.
Why the recovery screen shows up
At every boot, the TPM measures the firmware and boot configuration and only releases the encryption key if those measurements match what was recorded when the drive was encrypted. When they don’t match, BitLocker asks for the recovery key instead. Common triggers:
| Trigger | Examples |
|---|---|
| BIOS/UEFI firmware update | Vendor update utility, firmware delivered through Windows Update |
| Firmware setting changes | Secure Boot toggled, TPM cleared, boot order changed, CSM/legacy switched |
| Different boot device | Booting from USB, installing a dual-boot loader, starting up while docked |
| Hardware changes | Motherboard replaced or repaired, SSD moved to another PC |
| Too many wrong PINs | Systems that use a pre-boot PIN |
Usually it appears once right after one of these changes, and entering the key fixes it. If it keeps coming back on every boot, jump to step 4.
1. Note the Key ID on the screen
The recovery screen shows a Recovery key ID (usually the first 8 characters). That is how you match the right key when your account holds keys for several PCs or drives. Snap a photo of the screen with your phone.
2. Where to find the 48-digit recovery key
The key is 48 digits in eight groups of six. Check these places from another device:
- Personal Microsoft account: go to
https://aka.ms/myrecoverykey, sign in with the account used on that PC, and find the entry whose Key ID matches. Most home PCs back up here automatically. - Work or school account (Microsoft Entra ID): try
https://aka.ms/aadrecoverykey, or give the Key ID to your IT team. Domain-joined PCs can be looked up in Active Directory by an admin. - Your own backups: a
BitLocker Recovery Key XXXXXXXX-....txtfile saved to a USB stick, another PC or cloud storage, or a printout. - Other accounts: if someone else set up the PC, or you used a different Microsoft account in the past, check that account too.
Type just the digits into the recovery screen (the dashes are added for you) and press Enter. Windows should boot normally.
3. Once you’re in: check your key backup
If finding the key was a scramble, fix that now. Open an elevated Command Prompt and run:
manage-bde -status C:
manage-bde -protectors -get C:Under Numerical Password you’ll see the ID and the 48-digit key. Store it in a password manager or somewhere offline. You can also use Control Panel → BitLocker Drive Encryption → Back up your recovery key to save it to a file or your account again.
4. If it asks for the key on every boot
A repeat prompt means the TPM hasn’t re-sealed the key to the new boot state yet. Suspending and resuming protection makes it record the current state as the good one:
manage-bde -protectors -disable C:
manage-bde -protectors -enable C:If it still repeats, something keeps changing between boots. Make sure USB or network boot isn’t first in the boot order, nothing bootable is plugged into your dock, and Secure Boot isn’t being flipped. On dual-boot machines where the boot loader changed, the boot layout explained in our grub rescue guide may help.
5. Prevent it next time: suspend before firmware changes
Before a BIOS update or a Secure Boot change, suspend BitLocker for one reboot from an elevated PowerShell:
Suspend-BitLocker -MountPoint "C:" -RebootCount 1Protection turns itself back on after that many restarts. The Suspend protection button in Control Panel does the same thing.
FAQ
- What if I can’t find the key at all? There is no bypass. Data on an encrypted drive can’t be recovered without the key; you’ll have to reinstall Windows. That’s why step 3 matters.
- What does Esc do on the recovery screen? It shows more recovery options. Skipping the drive gets you to advanced options like Command Prompt or System Restore, but the locked drive itself still needs the key.
- Can I just turn BitLocker off? Yes, once booted:
manage-bde -off C:decrypts the drive. On a laptop you lose theft protection though, so keeping a safe copy of the key is usually the better choice.