BitLocker Is Asking for a Recovery Key at Startup? Here's Why and Where to Find Your Key

Your PC starts to a blue “BitLocker recovery” screen asking you to “Enter the recovery key for this drive” — a 48-digit number — before Windows will load.

Why: BitLocker watches the early boot path (firmware, Secure Boot, the TPM, the boot manager) for changes. When something it measures changes unexpectedly, it can’t safely auto-unlock the drive, so it falls back to asking for your recovery key. Microsoft’s documented triggers include a BIOS/UEFI firmware update, turning off or clearing the TPM, disabling Secure Boot, changing the boot device order, docking or undocking a laptop, moving the drive into another PC, or entering the wrong PIN too many times. It is usually a one-time hiccup, not a sign your data is lost — you just need the key once.

Fix 1: Find your recovery key and unlock the drive

The recovery screen shows a Recovery key ID (and, on Windows 11 24H2, a hint of which Microsoft account holds the key). You need the 48-digit key whose ID matches.

1. On a phone or another computer, go to https://aka.ms/myrecoverykey and sign in with the same Microsoft account you use on the locked PC.
2. You’ll see a list of devices and keys. Match the Key ID on screen (the first 8 characters are enough) to the entry online, then read off that entry’s 48-digit recovery key.
3. Type the 48 digits into the recovery screen and press Enter. Windows should boot normally.

If the device was set up by someone else (a family member or a shop), the key may be in their Microsoft account. For a work or school PC, the key is usually held by your IT department — check https://aka.ms/aadrecoverykey or contact IT.

Fix 2: Stop it happening every restart

If you get back into Windows but the recovery prompt returns on every boot, the boot measurements are still out of sync. Resealing them with a suspend/resume clears it without re-encrypting:

Suspend-BitLocker -MountPoint "C:" -RebootCount 1
Resume-BitLocker -MountPoint "C:"

Open Windows PowerShell as administrator first (Start, type PowerShell, right-click, Run as administrator). Suspending leaves the drive fully encrypted; the resume reseals the encryption key to the current, working boot state so BitLocker trusts it again.

Fix 3: If a firmware or BIOS change caused it

A pending or recent BIOS/UEFI update is one of the most common causes. After you’re back in Windows, finish that update, then run the suspend/resume in Fix 2 so the new firmware becomes the trusted baseline. Next time you plan a firmware update, suspend BitLocker first — see our guide on suspending BitLocker before a BIOS update — to avoid this prompt entirely.

FAQ

Is my data gone if I can’t find the key? No — the data is intact and encrypted. But without the correct recovery key it stays locked, and Microsoft Support cannot retrieve, provide, or recreate a lost key. Your only options then are any other saved copy of the key or resetting the PC (which erases your files).

The Key ID on screen doesn’t match anything in my account. You may be signed into a different Microsoft account, or the matching key is in a work/school account. Only a key whose ID matches the one on the recovery screen will unlock that drive.

Will entering the key turn BitLocker off? No. It unlocks the drive for this boot. BitLocker stays on.

Sources: Microsoft Support — Find your BitLocker recovery key, Microsoft Learn — BitLocker recovery overview, Microsoft Learn — BitLocker preboot recovery screen