A BitLocker recovery key is a unique 48-digit number used to unlock an encrypted Windows drive when Windows cannot verify that the startup environment is trusted. Write down the first eight digits of the recovery-key ID on the blue screen, then use that ID to find the matching key.
Why Windows is asking for the key
BitLocker encrypts a drive so its data cannot be read offline without the decryption key. A hardware, firmware, boot, or security change can make Windows request recovery even when the owner is legitimate. The prompt does not automatically mean the laptop was hacked.
Do not repeatedly change BIOS, TPM, or Secure Boot settings at random. Photograph the recovery-key ID if workplace policy allows, but do not post the 48-digit recovery key itself in a forum, chat, or support screenshot.
Check your personal Microsoft account
Use another phone or computer and go to Microsoft’s official recovery-key page from the source section below. Sign in with the Microsoft account associated with the locked PC. Compare the key ID shown online with the first eight digits displayed by BitLocker, especially if the account lists several devices or keys.
Starting with Windows 11 version 24H2, Microsoft says the recovery screen may show a hint for the Microsoft account that holds the key. The key could instead belong to the person who originally set up the computer, so consider whether a family member or technician completed the initial setup.
Check a work or school account
If the PC was signed into an organisation, its recovery key may be stored in the work or school account. Sign in to the organisation’s device portal from another device and look for the matching BitLocker key. If you cannot access it, contact the authorised IT administrator and provide the device name and recovery-key ID.
Do not ask a former colleague to send every key they can see. The administrator should verify ownership and share only the matching key through an approved channel. A company-managed device may also have policies that prevent personal recovery steps.
Look for an offline copy
When BitLocker was enabled, the person setting it up may have printed the recovery key or saved it as a text file on a USB flash drive. Check labelled USB drives and the secure place where important device paperwork is kept. Read a text file on a different device if the locked PC cannot open it.
A recovery key is not the Windows sign-in PIN, Microsoft account password, or the short key ID. Only the matching 48-digit value unlocks that BitLocker prompt.
What if no recovery key can be found?
Microsoft states that its support team cannot retrieve, provide, or recreate a lost BitLocker recovery key. There is no legitimate bypass that preserves encrypted data. If the correct key cannot be found and the triggering hardware change cannot safely be reversed, the remaining Windows recovery option may reset the device and remove its files.
Before accepting a reset, check every plausible authorised account and ask the organisation that managed the PC. If the data is important, stop experimenting and consult the device maker or qualified support service. Be sceptical of paid unlock tools: encryption is designed specifically to resist that kind of access.
Prevent the next lockout
Once access is restored, confirm that the current key is backed up to an account you control and keep a second protected offline copy. Do not store the only copy on the encrypted drive. Review how to back up your computer so a future drive or recovery problem does not become a data-loss emergency.
Checked against Microsoft Support on August 29, 2026. These instructions apply to Windows 10 and Windows 11; organisation-managed devices can use different recovery processes.
