BitLocker Drive Encryption on Windows 11: Setup Guide 2026

This became very visible in April 2026: the cumulative update KB5083769 for Windows 11 24H2/25H2 pushed some PCs straight into the BitLocker recovery screen, demanding that 48-digit code. Microsoft fixed the underlying issue in KB5089549, but anyone who didn't know a recovery key existed — or couldn't find it — risked losing access to their own data. It's a good reason to check your encryption status now, rather than scrambling for a key the moment a recovery screen appears.

What BitLocker Is and What It Protects Against

BitLocker is Windows' full-disk encryption technology: it encrypts an entire volume, not individual files — system files, temporary data, and even disk space the OS doesn't mark as 'used.' The core threat BitLocker defends against is an offline attack: someone physically removes the drive, or boots from external media, to read the data directly without going through the Windows sign-in. Without the encryption key, that drive is just a block of unreadable data.

A TPM (Trusted Platform Module) version 1.2 or later verifies the integrity of the boot process and holds the encryption key in a way that's hard to extract without going through sign-in. You can also configure BitLocker to require a PIN or a USB startup key before Windows even loads — multi-factor pre-boot authentication. If there's no TPM, BitLocker can still be enabled with a USB startup key; a password-only option exists but Microsoft doesn't recommend it, and it's disabled by default.

It's worth being clear about what BitLocker doesn't do. It isn't antivirus software: if an infostealer or other malware is running on a powered-on, unlocked PC, BitLocker does nothing to stop it — see infostealer malware and password/cookie theft for that threat. BitLocker also doesn't touch your network traffic: it won't protect you from interception on an untrusted network or from ISP-level tracking — that's a VPN's job, and public Wi-Fi security and VPNs covers that layer in detail.

BitLocker vs. 'Device Encryption': Which One Do You Have

Full BitLocker is available on Windows 11 Pro, Enterprise, Education, and Pro Education/SE — on those editions you can encrypt any drive, including external ones, set a startup PIN, and choose the encryption algorithm. Windows 11 Home doesn't include full BitLocker. Instead it ships with a lighter feature called Device Encryption, which is available on every edition including Home, but only encrypts the system drive and built-in storage — external USB drives and flash drives are untouched.

Starting with Windows 11 24H2, Microsoft dropped the Modern Standby and HSTI requirements, along with the DMA support requirement, for automatic device encryption to turn on. As a result, far more laptops and desktops now get encrypted automatically than before — and many people only find out when their system suddenly asks for a recovery key.

There's an important nuance: if a device is set up with only a local account (no Microsoft account sign-in), the drive is technically encrypted but the key is stored unprotected — the same state as a suspended BitLocker protector, flagged with a yellow warning icon on the drive in File Explorer. Full protection kicks in when an administrator signs in with a Microsoft account: the recovery key is then uploaded to that cloud account and a TPM protector is created.

To check whether a device is ready for automatic encryption, run msinfo32 and look for the 'Device Encryption Support' line — it should read 'Meets prerequisites.' One more detail worth knowing: if you turn device encryption off manually, it won't turn itself back on automatically.

How to Check Whether Your Drive Is Already Encrypted

The simplest path is Settings → Privacy & security → Device encryption. If that option isn't there at all, your device likely doesn't support automatic device encryption (though it may still support full BitLocker if you're on Pro). On Pro/Enterprise systems, check Control Panel → 'BitLocker Drive Encryption' instead, which shows the status for every drive.

For a more precise answer, open an administrator command prompt and run:

manage-bde -status

This shows, per volume, the Conversion Status (encryption in progress or complete), Protection Status (protection on or suspended), and Encryption Method (which algorithm is in use). If Protection Status reads 'Protection Off' on a fully encrypted volume, that's the 'encrypted but not protected' local-account state described above.

To check whether your device meets the requirements for automatic encryption, open msinfo32 and look for 'Device Encryption Support.' One more visual cue: in File Explorer, a drive with an unprotected key shows a yellow warning icon on its drive icon.

How to Turn On BitLocker in Windows 11 Pro: Step by Step

1. Confirm TPM is active: type tpm.msc in the search bar and check the module's status; also make sure Secure Boot is enabled in UEFI.
2. Open Control Panel → 'BitLocker Drive Encryption' → pick the drive you want → 'Turn on BitLocker.'
3. Choose how to save your recovery key. It's worth picking at least two options — for example, save it to your Microsoft account and also print it or save it to a file on a different device.
4. Choose how much of the drive to encrypt: 'Encrypt used disk space only' is faster and fine for a new PC with no deleted personal data; 'Encrypt entire drive' is slower but more thorough for a PC that's already been in use, where deleted-but-not-overwritten sectors could still hold data.
5. Choose the encryption mode: 'New encryption mode' for the internal drives of this PC, or 'Compatible mode' if the drive might need to be read on devices running older versions of Windows (relevant mainly for removable drives).
6. Run the BitLocker system check if prompted, then restart — this confirms BitLocker can read the recovery keys correctly before encryption actually begins.
7. After the restart, encryption continues in the background and you can keep using the PC normally. On a modern SSD with hardware-accelerated AES, the slowdown is usually not noticeable in everyday use.

How to Turn On Device Encryption in Windows 11 Home

Go to Settings → Privacy & security → Device encryption and flip the toggle (administrator rights required). The device needs a TPM, a configured Windows Recovery Environment (WinRE), and Secure Boot enabled. If the toggle is greyed out or missing entirely, check msinfo32 for prerequisite status, and make sure you're signed in as an administrator with a Microsoft account — automatic encryption is tied specifically to that account.

PIN at Startup: When You Need One

Pairing TPM with a PIN makes sense for a laptop you carry around: it stops the drive from being unlocked purely by powering the device on, even if someone has physical possession of it and tries to bypass the Windows sign-in screen through the boot menu. This is enabled via the 'Require additional authentication at startup' group policy (available on BitLocker-capable editions), followed by adding a PIN protector:

manage-bde -protectors -add C: -TPMAndPIN

The command will prompt you to set and confirm a PIN, which will then be requested every time the PC is powered on, before Windows loads.

Where to Store and How to Find Your BitLocker Recovery Key

A BitLocker recovery key is a 48-digit code. Every key has a recovery key ID — the first 8 characters of the code — which helps you pick the right key on the recovery screen if you have several saved from different devices or drives.

Where to look once you actually need the key:

• your Microsoft account, at aka.ms/myrecoverykey, if the key was saved there when BitLocker or device encryption was turned on;
• a work or school account, at aka.ms/aadrecoverykey or through your organization's IT department, if the PC is joined to a work or school account;
• a printout, if you chose 'Print the recovery key' when enabling BitLocker;
• a text file on a USB drive or elsewhere, if you chose 'Save to a file.'

How to store it properly: don't keep your only copy on the same drive it's protecting — if that drive becomes inaccessible, you can't read the key file either. A reasonable approach is to keep a copy in a password manager (see this guide to choosing and setting up a password manager) plus a separate offline copy — a printout or a USB drive stored apart from the PC.

You can view and save your key in advance with an administrator command prompt:

manage-bde -protectors -get C:

Or through Control Panel → 'BitLocker Drive Encryption' → 'Back up your recovery key' for the drive in question.

What to Do If Windows Asks for a Recovery Key

The BitLocker recovery screen can appear for several reasons: firmware or UEFI setting changes, a Secure Boot toggle, a motherboard or other key component replacement, and sometimes a Windows update itself. That's exactly what happened in April 2026: the KB5083769 cumulative update for Windows 11 24H2/25H2 changed the bootloader's digital signature on some PCs, which, under a specific group policy configuration, caused TPM measurements to stop matching what was expected — triggering recovery mode. The issue mainly affected business PCs with particular security policy settings, and was resolved in KB5089549.

What to do when the recovery screen appears:

1. check the recovery key ID shown on screen (the first 8 characters) against the IDs of the keys you've saved — this lets you pick the right one immediately if you have several;
2. find the matching key by that ID on another device — your Microsoft account, your work account, a printout, or a USB drive;
3. enter all 48 digits of the key on the recovery screen;
4. once you're back in Windows, install the latest Windows and UEFI firmware updates — this reduces the chance of the same issue triggering the screen again.

It's worth being direct about this: if the recovery key isn't saved anywhere on the list above, the data on that encrypted drive cannot be recovered. That's a direct consequence of how encryption works — neither Microsoft nor anyone else can bypass it without the key.

If you're planning a BIOS or UEFI update yourself, it's smart to suspend BitLocker protection beforehand to avoid an unnecessary key prompt after the reboot: use the 'Suspend protection' button in Control Panel, or run manage-bde -protectors -disable C: -RebootCount 1, which disables protection for exactly the next reboot.

BitLocker To Go: Encrypting Flash Drives and External Disks

BitLocker To Go encrypts removable media — USB flash drives and external hard drives. It's available only on editions with full BitLocker (Pro, Enterprise, Education); you can protect the drive with a password or a smart card. A drive encrypted this way can be plugged into and read on a different Windows PC entirely, just by entering the password — it doesn't require the same account or the same PC that originally encrypted it.

BitLocker To Go is particularly useful for flash drives carrying work documents between machines, and for external drives holding backups. For guidance on setting up those backups correctly against ransomware in the first place, see how to protect against ransomware — an encrypted backup drive closes exactly the risk of that backup ending up in the wrong hands if it's lost or stolen.

BitLocker and VPN: Two Different Layers of Protection

BitLocker and a VPN protect data in two different states. BitLocker protects data at rest — files sitting on the disk of a powered-off or locked device. A VPN protects data in transit — the traffic your device sends and receives over the network while you're actively working.

Picture a common scenario: you're working on a laptop at a coffee shop or an airport gate. If the laptop is stolen while it's off or locked, BitLocker is what stops anyone from reading the drive without the recovery key. But while you're connected to that coffee shop's or airport's open Wi-Fi and actively online, it's your network traffic that's exposed — and that's where a VPN matters, not BitLocker; see public Wi-Fi security and VPNs for more on that risk.

LiMP VPN for Windows can be downloaded from the LiMP VPN apps page — the client runs on top of an already BitLocker-encrypted drive without any conflict with file-system encryption. For details on setting up a VPN client specifically on a Windows PC, see VPN for Windows.

Checklist: Secure Your Drive in 15 Minutes

• Check your current encryption status: Settings → Device encryption, or manage-bde -status.
• If the drive isn't encrypted, turn on BitLocker (Pro) or Device Encryption (Home).
• Save the recovery key in at least two places other than the drive itself: a Microsoft account plus a printout or USB drive.
• Note or verify your recovery key ID — the first 8 characters of the 48-digit code.
• On a laptop you carry around, turn on a startup PIN with a TPM-and-PIN protector.
• Encrypt a flash drive holding important documents with BitLocker To Go, if your edition supports it.
• Suspend BitLocker protection before a BIOS/UEFI update to avoid an unnecessary recovery prompt.
• Before selling or handing off a PC, make sure data is genuinely inaccessible to the new owner — an encrypted drive with the recovery key left behind helps with exactly that.