BitLocker Asks for the Recovery Key at Startup: 8 Ways to Get Back into Your PC

You turn the computer on and, instead of the sign-in screen, Windows shows a blue message: BitLocker is asking for the recovery key. You cannot go any further. The code is 48 digits, and you do not remember writing it down.

This article will also interest you: What software to secure my Windows? Here are 7 security suites

This lock is common, especially after a BIOS change, a hardware change, or an update. The key is often stored in your Microsoft account. Without those 48 digits, the encrypted drive cannot be opened: no command replaces the key. Here is why the screen appears, where to look, and 8 fixes, from the simplest to a reinstall.

Why does BitLocker ask for the key at startup?

BitLocker is the disk encryption built into Windows. It protects files if the PC is stolen or if someone removes the drive. On most machines, a TPM chip (Trusted Platform Module) releases the encryption key automatically when the hardware and the boot path have not changed.

When that check fails, BitLocker locks the drive and asks for the recovery key: 48 digits, in eight groups of six. The usual triggers are:

• A hardware change: motherboard, drive, RAM, a dock, or a USB-C / Thunderbolt device plugged in at boot.
• A BIOS/UEFI update, or a reset of the firmware settings.
• TPM or Secure Boot turned off, or the TPM cleared.
• A changed boot order, or a boot from a USB drive.
• A power loss, or several failed startups in a row.
• A Windows update that changes boot files measured by the TPM.

The PC is not saying you forgot your Windows password. It is saying the startup no longer matches the one that was sealed, so prove you own the device with the 48-digit key.

Where to find your BitLocker recovery key

When encryption was turned on, Windows almost always saved this key. Check these places from a phone or another computer:

• Your Microsoft account. Open aka.ms/myrecoverykey. Sign in, then match the key ID on the blue screen (the first 8 characters are enough) with the IDs in the list. Starting with Windows 11 version 24H2, the recovery screen can also show a hint of the Microsoft account tied to the key.
• An older account. The key is stored in the account used at first setup, which may not be the one you use now. Try old addresses, and the account of the person who set the PC up.
• A work or school account. The key may be in Microsoft Entra ID. Open aka.ms/aadrecoverykey with that account, or contact IT. Do not wipe the drive before you reach them.
• A USB drive or a printout. During setup, Windows offers to save a text file or print the key. The file is often named BitLocker Recovery Key.

Microsoft Support cannot retrieve, provide, or recreate a lost key. That is stated on Microsoft's official page. If the key is gone from every place it could have been saved, the files on the encrypted drive are unreachable.

8 ways to get back in

The first two fixes cover most cases. The others do not decrypt a locked drive: they undo the cause, or they apply only after the key has been accepted.

Solution 1: Type the recovery key carefully

The key contains only digits, 0 through 9. There is no letter O and no letter I. It is not a Windows product key.

On the blue screen, the keyboard layout is often US. On an AZERTY laptop, the top number row may need Shift, or it may type digits without Shift. If the code is rejected even though it is the right one:

• type it again with the numeric keypad;
• try the top number row the other way, with Shift and without it;
• let Windows insert the dashes; the eight groups of six digits fill in as you type;
• if several keys are saved on the account, use the one whose ID matches the screen.

Solution 2: Suspend BitLocker, then turn it back on, once Windows is open

Use this when the key was accepted, but the blue screen comes back at every boot. It does nothing while the drive is still locked. The command manage-bde -pause does not skip that screen: it only pauses encryption or decryption that is already running.

After you are signed in to Windows, open Command Prompt as administrator and run:

manage-bde -protectors -disable C:

manage-bde -protectors -enable C:

The first command suspends protection. The second turns it back on and reseals the TPM to the PC's current state (BIOS, Secure Boot, hardware). Replace C: if Windows is on another letter. Without -rebootcount, a suspend on its own resumes at the next startup. Running both commands is what stops the loop.

Solution 3: Turn BitLocker off and decrypt the drive

Do this only if you want encryption removed, and only after the recovery key has let you into Windows. In an administrator command prompt:

manage-bde -off C:

Decryption can take several hours. Leave the PC on and plugged in. When it finishes, the drive is no longer protected if the computer is stolen. Check progress with manage-bde -status C:. The command fails if the volume is still locked.

Solution 4: Undo the change in BIOS/UEFI

If the screen appeared right after a firmware change, restoring the previous state can be enough, without typing the key. Shut the PC down, unplug USB drives, SD cards, and docks, then enter the BIOS (often Del, F2, F10, or Esc, depending on the brand).

• Put the Windows drive first in the boot order.
• Turn TPM and Secure Boot back on if they were disabled.
• Roll the BIOS back if the manufacturer offers the previous version.

If the TPM was cleared, this will not unlock the drive. The key inside the chip is gone, and only the 48 digits can open the disk.

Solution 5: Repair startup, after the drive is unlocked

Startup Repair fixes damaged boot files. It does not remove BitLocker. If the volume is locked, Windows asks for the recovery key first.

On the blue screen, choose Skip this drive, then Troubleshoot, Advanced options, Startup Repair. Type the key when the tool asks for it. Let the repair finish, restart, then use solution 2 to reseal the TPM.

In the recovery command prompt, the Windows drive letter is not always C:. Find it with manage-bde -status. To unlock with the key:

manage-bde -unlock C: -RecoveryPassword YOUR-KEY-HERE

Solution 6: Use System Restore, after the drive is unlocked

System Restore does not bypass encryption. It helps only if Windows was already failing before the BitLocker screen, and if a restore point exists.

Go to Troubleshoot, Advanced options, System Restore. Enter the key when Windows asks, pick a point from before the problem, then restart. After that, suspend and resume BitLocker as in solution 2, or the blue screen can return.

Solution 7: Do not mix up the PIN and the 48-digit key

A BitLocker PIN shown before Windows is short, usually 4 to 20 characters. The recovery key is always 48 digits. The blue screen in this guide is the key screen, not the PIN screen.

If you see a PIN you have forgotten, Esc usually offers the recovery key instead. Settings, Accounts, Sign-in options is the Windows Hello PIN. You cannot open that page while the PC is stuck on BitLocker, and changing it does not unlock the drive.

Once Windows is open, an administrator can change the BitLocker PIN with:

manage-bde -changepin C:

Solution 8: Reinstall Windows, as a last resort

If no key exists in a Microsoft account, a work account, a file, or a printout, the remaining option is to erase the drive. Reinstalling does not decrypt the data. It destroys it.

• On another PC, create a Windows installation USB with Microsoft's Media Creation Tool.
• Boot the locked PC from that USB drive.
• At the partition step, delete every partition on the encrypted drive.
• Install Windows on the free space.

Before you erase anything, check every Microsoft account that might have been used. Files already synced to OneDrive stay in the cloud. Anything that existed only on the encrypted drive is gone. Do not pay a service that promises to remove BitLocker without the key. That cannot be done.

What to do in each case

FAQ: BitLocker at startup

What if BitLocker asks for the key again after accepting it?

Open an administrator command prompt and run manage-bde -protectors -disable C: then manage-bde -protectors -enable C:. Also confirm that TPM and Secure Boot are on, and unplug USB devices before startup.

Can Microsoft recover my BitLocker key?

No. Microsoft cannot retrieve, provide, or recreate a lost BitLocker recovery key. It exists only in your Microsoft account, your organization, or the copy you saved.

How do I stop BitLocker from asking for the key again?

Save the key at aka.ms/myrecoverykey. Before a BIOS, drive, or motherboard change, suspend BitLocker with manage-bde -protectors -disable C:, make the change, restart, then turn protection back on.

Is BitLocker on by default in Windows 11?

Yes on many recent PCs. Device encryption often turns on as soon as you sign in with a Microsoft account, including on some Home editions. Save the key at first startup.

Conclusion

The BitLocker screen is an ownership check, not a dead computer. Start with the 48-digit key in the Microsoft account, an older account, or your IT department. Once Windows is open, suspend protection and turn it back on so the TPM accepts this PC again.

Startup Repair, System Restore, and decryption come only after that key. Without it, the remaining path is a Windows reinstall, and the files on the drive are lost. If this PC still boots today, save that key somewhere you can open without this computer.