Where to find a BitLocker recovery key

Places to check, in order

1. Note the key ID

   The blue BitLocker recovery screen, or the unlock dialog in Windows, usually shows a key ID made of letters and digits. Write down at least the first eight characters. Every saved recovery key is stored with its ID, so this is how you tell several keys apart.

2. Check your Microsoft account

   On another device, sign in at aka.ms/myrecoverykey, which leads to the recovery key page of your Microsoft account. Use the same account that was used to sign in on the encrypted PC. On many Windows 11 laptops, device encryption backs the key up there automatically when you sign in with a Microsoft account.

3. Check a work or school account

   If the PC was joined to an organisation, the key is often stored in its directory, such as Microsoft Entra ID or an on-premises Active Directory. Some organisations let users view their own device keys in the account portal; otherwise the IT department can look it up.

4. Look for printouts and files

   When BitLocker is turned on, Windows offers to print the key or save it to a file. Search USB sticks, other drives and cloud folders for a text file whose name starts with BitLocker Recovery Key, and check paper files where important documents are kept.

5. Back it up from a PC that still opens

   If the encrypted drive still unlocks on some PC, open an administrator command prompt there and run manage-bde -protectors -get followed by the drive letter, for example C:. The numerical password shown is the recovery key. Save a copy somewhere other than the encrypted drive.

6. Enter the key in FileFix Ultimate

   Once you have the key, select the drive in Deleted file recovery. On the Drive locked with BitLocker card, type the 48-digit recovery key and click Unlock, then scan the unlocked drive and save files to another disk.

What the 48 digits are

The recovery key, which Windows calls a numerical password, is written as eight groups of six digits separated by hyphens. It is one of several ways to unlock the same volume: the TPM chip unlocks the system drive automatically at startup, a password unlocks removable drives, and the recovery key is the backup when those fail. Each encrypted volume has its own key, so a PC with two encrypted drives has two different keys.

Each group follows an internal checking rule, so a typo in one group is usually caught before Windows even tries the key. FileFix Ultimate checks the same thing and tells you which group to look at again. Type the digits exactly as stored; letters, an eight-character key ID or a PIN are not the recovery key.

Why the recovery screen appears

BitLocker asks for the recovery key when something it measures at startup has changed. Common triggers include a firmware or BIOS update, changing Secure Boot settings, moving the disk to another PC, replacing the motherboard or clearing the TPM. The data itself is usually untouched; the key is needed only because the automatic unlock no longer matches.

This is why you should not reinstall Windows or format the drive at that screen. Doing so does not remove the need for a key; it replaces the encrypted volume with a new one, and the files on the old volume are then lost for good.

Why nobody can recreate a lost key

BitLocker uses strong encryption, and the recovery key is generated randomly on the PC. If it was never uploaded to an account or directory, no copy exists anywhere else. Microsoft support, a repair shop and data recovery software, including FileFix Ultimate, cannot calculate it or bypass it. Offers that claim to crack BitLocker should be treated with great caution.

If the key is truly lost, the drive can still be reused by formatting it, but the encrypted data is gone. The best moment to prevent this is now: on any PC that still opens normally, back up the key to your account, a printout and a file stored on a separate drive.

When the key cannot help

• If no copy of the recovery key or password exists, the data cannot be decrypted by any tool.
• A key from a different drive or an earlier encryption of the same drive will not unlock the current volume.
• If the volume was formatted or Windows was reinstalled over it, even the correct key may no longer reach the old files.
• Physical damage, such as a clicking disk, needs a professional lab even when you have the key.

How FileFix Ultimate helps once you have the key

• Shows a Drive locked with BitLocker card with an unlock form instead of a pointless scan.
• Checks the 48-digit format and points out a mistyped group of six digits.
• Unlocks without changing the drive and works fully offline, so the key is not sent anywhere.
• Can decrypt a damaged volume to an image on another drive with repair-bde, then scan the image read-only.

Frequently asked questions