My computer is asking for a BitLocker recovery key — what do I do?

The blue screen asking for a 48-digit key is not a fault or a scam. Where the key is actually stored, why the screen appeared, and what to do if you cannot find it.

Difficulty: beginner
Time: 20 min
Read: 5 min
Safety: warning

Short answer

The key is almost always saved to the Microsoft account that set up the computer — sign in at Microsoft's device recovery key page from a phone or another computer and it will be listed against your device. If the machine is managed by an employer or a school, their IT holds it. If it was a local account and the key was never saved anywhere, the data cannot be recovered.

BitLocker encrypts a Windows drive so it is unreadable without the key, and on most modern machines it is switched on automatically. Under normal conditions you never see it, because the key is unlocked automatically by a chip on the motherboard once it confirms the machine has not changed. The recovery screen appears when that check fails — which happens after a firmware update, a hardware change, a change to secure boot settings, or a failed startup. It is the system working correctly and being cautious, which is little comfort at the time.

Safety

Without the recovery key, the data on an encrypted drive cannot be recovered by you, by a repair shop, or by Microsoft. That is the point of encryption, not a fault. Do not reinstall, reformat or reset the machine while you still have any route to finding the key, because those actions destroy the encrypted data permanently.

Step by step

Do not reinstall or reset anything yet.The recovery screen usually offers options that include resetting the PC. Taking them destroys the data you are trying to reach. Nothing on this screen is time-limited, so you can leave the machine and go and find the key.
Note the key identifier shown on screen.The recovery screen displays a key ID, a short string of characters. It matches the key to the drive, which matters if your account holds keys for several devices.
Look in your Microsoft account first.From a phone or another computer, sign in at Microsoft's device recovery key page. Keys saved during setup are listed there against each device. This is where the great majority of home users find it, often without having known it was saved.
Check any other Microsoft account you might have used.If the computer was set up by a family member, or with a different email from the one you use now, sign in with that account instead. The key is attached to the account that was signed in when encryption started, not to you.
Ask IT if the device is managed.Work and school devices store the recovery key in the organisation's directory. Their IT team can retrieve it in minutes. Do not spend hours on this yourself if the machine is managed.
Look for a printed or saved copy.When encryption is enabled manually, Windows offers to print the key or save it to a file or a USB stick. Check the folder you keep documents in, any USB sticks from around the time you set the machine up, and any printed sheet filed with the receipt.
Work out why it appeared, so it does not recur.A BIOS or UEFI update, changing the boot order, enabling or disabling secure boot, adding or removing hardware, or a failed startup can all trigger it. If you know what you changed, changing it back sometimes lets the machine boot normally again.
Once you are in, save the key properly and back up.In the BitLocker settings, back up the recovery key again to your Microsoft account and to somewhere physical. Then make sure you have a current backup of the files, because the next time this happens the outcome should be an inconvenience rather than a loss.

Common mistakes

Choosing the reset option on the recovery screen — It is right there and it looks like a way forward. It reinstalls Windows and discards the encrypted data, which is exactly the outcome you were trying to avoid.
Assuming the key can be recovered from the drive itself — It cannot, by design. Encryption that could be bypassed by whoever holds the drive would be pointless, which is why a stolen laptop is safe and an unremembered key is fatal.

If it doesn't work

Appeared after a BIOS or firmware update

Cause: The security chip no longer recognises the boot configuration — Fix: Enter the key once and the machine will resume normal automatic unlocking. Some manufacturers advise suspending BitLocker before a firmware update for exactly this reason.

Appeared after changing boot order or plugging in a USB stick

Cause: Boot configuration changed — Fix: Remove the USB device or restore the original boot order and restart. It often boots normally without needing the key at all.

Key from the account does not work

Cause: Wrong key for that drive — Fix: Match the key identifier shown on screen to the identifier listed beside each key in your account. A machine with more than one encrypted drive, or an account with several devices, produces exactly this confusion.

Recovery screen appears every single startup

Cause: A hardware fault, a failing security chip, or protection left in a suspended state — Fix: Once you are in, check the BitLocker status. If protection cannot be resumed cleanly, decrypt the drive, resolve the hardware issue and re-encrypt.

No Microsoft account was ever used on the machine

Cause: Set up with a local account and the key saved nowhere — Fix: Check for a printed copy or a file on a USB stick. If there genuinely is none, the data is not recoverable. The machine can be reset and reused; the files are gone.

A pop-up or caller offers to unlock it for a fee

Cause: Scam — Fix: Nobody can unlock BitLocker without the key. Any offer to do so is fraudulent — the catalogue's guide on tech support scams covers the pattern.

Questions people ask

Why is my drive encrypted when I never turned it on?

Recent versions of Windows enable device encryption automatically on machines that support it, and the key is saved to the Microsoft account used at setup. It is genuinely good for security — a lost laptop is unreadable — and it catches people out precisely because they did not know it was on.

Can Microsoft recover the key for me?

Only in the sense that it may be stored in your account, where you can retrieve it yourself. Microsoft does not hold a master key and cannot decrypt your drive.

Should I turn BitLocker off?

Generally no. It protects your data if the machine is lost or stolen, which is a far more likely event than a recovery prompt you cannot answer. The right response is to make sure the recovery key is saved in at least two places and that you have a backup.