Save Your BitLocker Key Today, Before You Ever Need It

First, check whether this PC uses BitLocker or device encryption

First, check whether this PC uses BitLocker or device encryption

Some PCs have no recovery key at all, because encryption was never turned on. A short check now keeps you from hunting later for a key that does not exist, and it tells you which name your PC uses.

Open Settings and search for 'device encryption.' If you see a switch or a note that it is on, encryption is on. You can also open Control Panel and select 'Manage BitLocker' to check whether it is on for the Windows drive, usually drive C.

The name may differ, and that is normal. Many Windows Home PCs say 'device encryption' instead of BitLocker, while other editions use the BitLocker name in Control Panel. Either way, the Windows drive is encrypted, and both produce a recovery key worth saving.

While you are in Settings, write down the exact PC name shown on the System, About page, spelling and all, so the saved key can be tied to this machine later. If encryption is off for the Windows drive, there is no key to save, and you can stop here.

Find and back up the key while you can still sign in

Find and back up the key while you can still sign in

Start on this PC, while you are signed in as normal. Open Control Panel, open BitLocker Drive Encryption, and select "Back up your recovery key" beside the Windows drive. Follow the on-screen prompts to save the key, and wait until Windows confirms the backup is done. If you use device encryption and do not see that option, use the Microsoft account route below instead.

Open your browser and go to the Microsoft account recovery key page, at account.microsoft.com/devices/recoverykey. Sign in with the same Microsoft account you use to sign in on this PC, not a family member's account or an old address. The page lists keys by PC name and Key ID. Open the entry that matches the PC name you wrote down earlier. Other PCs may be listed too.

Check the result before you close anything. A complete key has 48 digits in eight groups of six, with dashes between the groups, for example six digits, a dash, six digits, and so on. Beside it, write the shorter Key ID, the PC name, and today's date. If any group is missing or cut off, go back and open the full key again from start to finish.

Keep two copies, and keep them away from the PC itself

Start with the copy you have already checked. If the full key is in your Microsoft account and tied to this PC name, count that as copy one. You can open it later from a phone, a tablet, or another computer by signing in to that same account, even when this PC is locked. Open it once from another device if you can.

Do not stop at a text file saved on this PC. If that file sits only on the same encrypted drive, you cannot open it on the day the recovery screen appears. That drive is the one you are trying to get into, so a copy stored only there does not help. The same problem applies to a note in an app that only opens on this PC.

For copy two, pick one place your household can reach without this PC, such as a USB drive kept at home. A USB drive can be lost or fail, so store it somewhere you will remember. A photo of the key or a message thread is easier to lose track of, because a photo can be shared by accident.

Name the file or photo with the PC name and the date only. That is enough to match it to the right PC later. Keep the key private from there. Never send it to a stranger, send it to a repair shop in a message, or post it in a public forum.

Print the key and file it as part of your Emergency PC Kit

Print while you are still on the backup or account page, and select Print when the option appears. Take the page from the printer and read it back against the screen, checking that all eight groups of six digits are clear and complete, with no faint or smudged numbers. If any group is hard to read, print it again now.

At the top of the printout, write the PC name, today's date, and the Key ID in large, clear handwriting. Slide the page into a folder or a sealed envelope and mark the outside with that PC name, so you can pick the right key without opening every envelope first. If your home has more than one PC, use a separate envelope for each one.

File the envelope with the household PC papers, in the place set aside for the Emergency PC Kit. This printout is the BitLocker page of that kit, so keep it in that file and return it there after any check. Tell one trusted person in the home where the file lives and which envelope to hand you if the recovery screen appears.

Keep the printout private while you file it, and put it away the same day you print it. Never tape it to the PC, carry it in the laptop bag, or leave it on a desk where visitors can read it. Paper works when accounts and devices do not, but only if the page is complete, filed in its proper place, and still there when you need it.

Check the saved copy once a year and when a PC changes

Pick one date each year and write it on the envelope. On that date, take the printed page out of your Emergency PC Kit and compare it with the copy in your Microsoft account, group by group. All eight groups of six digits should match, and the PC name and Key ID should match too.

If the ink has faded, the paper is torn, or a group is hard to read, print a fresh copy that day using the steps earlier on this page. Check all eight groups on the new page, file it, and shred the printout it replaces. The kit should never hold two different keys for the same PC.

Make a fresh copy sooner if the PC changes. A new PC, a replaced drive, or turning encryption off and on again can create a new key, so the old page may no longer be the right one. Save the new key, print it, label it with the PC name and date, and shred the outdated page.

Do the same short check for every PC in the home. Each machine needs its own labeled page in its own envelope, checked on the same yearly date. When every page matches its account copy and is easy to read, put the kit back where your trusted person knows to find it.

Frequently asked questions

What if this is a work or school PC?

Ask the IT team that manages it before you save or print anything. Work and school keys are often stored by the organization, and that team is the one who can help if the recovery screen appears.

What if someone else set up my PC?

The key may be saved in that person's Microsoft account, because setup uses the account signed in at the time. Ask them to check their recovery keys page and help you move a copy into your own kit.