If Windows is asking for a 48-digit BitLocker recovery key, the good news is that you haven’t lost it: BitLocker stores a copy of the recovery key the moment it is switched on. Below are the six places it could be stored, how to match it using the Key ID shown on screen, and what your options are should the drive itself fail.
When BitLocker is switched on, it creates a 48-digit recovery key and automatically files a copy somewhere so that you can retrieve it later: in your Microsoft account, on a USB stick, on paper or with your IT department. Finding the recovery key nearly always comes down to recalling where it was placed.
An automatic 48-digit safety net, created the day BitLocker was switched on.
BitLocker is the drive encryption built into Windows 10 and 11 Pro, and it is enabled by default on many newer laptops and Microsoft accounts. It normally works invisibly behind the scenes, unlocking the drive using the TPM chip on the motherboard, and on some occasions a PIN or password is required on top. The recovery key is the fallback for when the normal unlock process cannot run: a single 48-digit number, broken into eight blocks of six digits, that can unlock the drive on its own.
You see the blue recovery screen when something about the machine changes and the TPM can no longer trust the boot: a motherboard or firmware/BIOS update, moving the drive from one computer to another, a hardware change, a change to a Secure Boot setting or simply a forgotten PIN. There is nothing wrong with your data: BitLocker is doing its job properly by asking you to prove that the drive is yours.
Each key is associated with a Key ID: a short code whose first eight characters are displayed on the recovery screen, for example A1B2C3D4. If a machine has had more than one key during its lifetime, the Key ID is the way you can identify which saved key is correct.
Begin working through the list: on a home PC, the top item is almost always going to be the correct one.
1. Your Microsoft account. By far the most common. Sign in at account.microsoft.com/devices/recoverykey (or use Microsoft’s short link, aka.ms/myrecoverykey) with the same Microsoft account the PC was set up with, and all keys saved to that account will be displayed next to their respective Key IDs. Try any personal accounts you or a family member may have used to set up the computer.
2. A work or school (Azure AD) account. If the computer belongs to an employer or was enrolled in Intune, the key is recorded against the organisation’s directory rather than your own personal account. Your IT department can retrieve it, and on many company computers only the IT department can do so.
3. A printout. At setup, BitLocker offers you the option to print the recovery key, so a paper copy may have been filed along with your other important documents.
4. A USB stick. The key will save as a single file called BitLocker Recovery Key <ID>.txt that you can open up on another machine. In this file there will be a 48 digit key.
5. A saved file. The same text file containing the recovery key may also have been saved elsewhere, such as another drive, a network share or OneDrive. Searching through your files for BitLocker Recovery Key will often turn it up.
6. On-premises Active Directory. On business PCs joined to a domain, recovery keys are frequently escrowed to Active Directory (AD), so an administrator can search for them by either the computer name or the Key ID.
Did you find multiple keys? Read the eight characters that appear after Key ID: on the recovery screen and match them to the entry with the same ID: that is the key that will work.
Enter the 48-digit key at the recovery screen (there is no need to type spaces), and Windows will boot straight into your desktop with everything intact. However, if it keeps looping back to the recovery screen after each restart, the underlying trigger has not been resolved, and it is typically a firmware setting. To resolve this, first start Windows using the key. Then you can either suspend BitLocker before you apply a BIOS or firmware update (it resumes automatically afterwards), or, if you no longer need encryption, turn BitLocker off to fully decrypt the drive.
Once you have located your recovery key, save it somewhere safe (saving it back to your Microsoft account is the simplest way), so that you avoid being locked out again the next time you change your hardware.
Although there is no backdoor, there are still places you should check.
If your recovery key is not in the Microsoft account you expected, it was almost certainly saved to one of the other five places listed above, most commonly a different Microsoft account. Check any email addresses that you or whoever set up your PC may have used, including a Hotmail, Outlook or Xbox login, and also check other family members’ accounts.
If your computer was set up by an employer, a school or a repair shop, the key may only exist in their directory, so ask them directly. Also be clear about one thing: there is no legitimate software that will “remove” or “bypass” a BitLocker key. All software claiming to crack a BitLocker key is, without exception, malware or a scam. Therefore, if every avenue is genuinely exhausted and you do not have the key or the password, it is impossible for anyone to recover your encrypted data.
A locked drive and a failing encrypted drive are very different problems.
Sometimes the problem is not the key at all: you have it, but the drive is failing, corrupt or no longer showing up, and it drops out before it allows a successful unlock. In this situation a BitLocker drive becomes a data recovery job instead of a password one. We create a sector-by-sector image of the failing drive read-only, so nothing degrades further, and then use your password or recovery key to unlock and mount the copy, recovering the files even if the encryption metadata is damaged or the volume would not mount normally.
You should know that we do not attempt to crack the encryption. If you cannot provide us with the key, the password or the credentials, we will tell you straight rather than take the job. Where you can, our BitLocker & encrypted drive recovery service handles your case in-house for a fixed £800 +VAT, with a free diagnostic and a written quote before any chargeable work, and your data never leaves the UK. If your failing drive is also clicking, overheating or not showing up at all, power it off right away and send it in. Every additional hour that it stays powered increases the risk of turning a recoverable drive into a lost one.
It is a 48-digit numeric password that BitLocker auto-generates when drive encryption is switched on. When the normal method (the TPM chip, or your PIN or password) cannot run, typically after a hardware or firmware change, this password will unlock the drive. Each key is identified by a short Key ID.
Check these in order: your Microsoft account at aka.ms/myrecoverykey; a work or school (Azure AD) account, via your IT team; printouts made during setup; a “BitLocker Recovery Key” text file stored on a USB stick; that same file saved to another drive or OneDrive; and, on domain PCs, on-premises Active Directory. On a personal machine, it is nearly always the Microsoft account.
It was saved somewhere else during setup: a printed copy, a USB text file, a file on another drive, or your organisation’s directory if the PC was set up by your employer or school. You can also check any other Microsoft account (Outlook, Hotmail or Xbox) that you or a family member may have used. There are no tools that will bypass the key, and anything claiming this capability is malware.
It is a short reference that links a recovery screen with the proper key. The recovery screen displays the first eight characters of the Key ID. When you have more than one saved key, you match those eight characters to the correct entry, so that you enter the key that actually unlocks that drive.
Not possible. BitLocker uses strong encryption, and without the recovery key, your password or the credentials, your files cannot be decrypted by anyone, including us. If you do have the recovery key or password but the drive has physically failed or won’t mount, then we can help: we create a read-only image of the drive and unlock the copy using your credentials.
Our fixed price for BitLocker and encrypted-drive recovery is £800 +VAT, handled in-house with a free 48-hour diagnostic and a written quote before any chargeable work. This covers recovering your data from a failing or corrupt BitLocker drive where you can provide your recovery key or password; we don’t offer a service to break encryption that you cannot unlock.
If you have your recovery key but the drive has failed, or you’re unsure what you’re looking at, please let us know what has happened. You’ll receive an honest, free answer before any money changes hands.