iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A BitLocker recovery screen is asking for a pre-existing 48-digit recovery key, not a password that can be guessed or regenerated. To get back into Windows without deleting data, identify the eight-digit recovery-key ID shown on the screen, locate the matching key in a Microsoft account, work or school account, printout, or USB text file, and then investigate any recent firmware or boot change that caused the prompt. Microsoft Support says it cannot retrieve, provide, or recreate a lost key, so do not use a reset until you have accepted that the files may be removed.
These four approaches are the supported ways to restore access while preserving the encrypted volume. They do not bypass BitLocker encryption; each depends on finding the key that was saved when BitLocker was enabled.
What the BitLocker recovery screen means
BitLocker normally unlocks the Windows drive automatically when the computer’s measured boot state matches the state in which encryption was configured. A recovery prompt appears when Windows detects a security risk or a hardware, firmware, or boot-environment change. The screen displays a recovery-key ID so you can distinguish among multiple saved keys.
The recovery key itself is a 48-digit number. Write down the first eight digits of the recovery-key ID exactly as displayed; those digits are the matching label used in Microsoft’s account listings and in many organizational records. Do not confuse the ID with the 48-digit key: the ID only identifies which saved key to enter.
#1 Best Overall
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
On Windows 11, version 24H2 and later, the recovery screen can show a hint of the Microsoft account associated with the key. Use that hint to choose the right personal account, especially if several people have used the PC. Microsoft’s current instructions are at Find your BitLocker recovery key.
The prompt does not by itself prove that the drive is failing or that files have been erased. It means the normal automatic-unlock trust check needs an additional proof. Treat the screen as a request to locate the already-created key, not as an invitation to create a replacement. Keep the computer powered and avoid clearing the TPM, changing random firmware options, or repeatedly interrupting startup while you search.
Compare the four no-data-loss recovery paths
| Approach | Where the key may be | What you need | When it is most useful |
|---|---|---|---|
| Match the personal Microsoft-account key | The Microsoft account used on the PC | Account sign-in and the first eight ID digits | A personally owned Windows PC |
| Check work or school storage | Your organization’s device directory or IT records | Organization account access or help-desk assistance | A work-, school-, or formerly managed PC |
| Find a paper or USB copy | A printed recovery page or an existing USB text file | The original printout or USB containing the saved file | The key was backed up offline |
| Investigate a recent boot or firmware change | The key from one of the first three paths, plus the changed setting | A known Secure Boot, PXE, firmware, or boot-order event | The prompt began immediately after that event or keeps recurring |
No supported method has a published success-rate percentage. The deciding factor is whether an intact copy of the correct key exists and whether the change that triggered recovery can be corrected. The first three approaches are key-location methods; the fourth explains why a valid key is suddenly required or why the prompt returns. None decrypts a volume without its key.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems1. Match the recovery-key ID to your Microsoft account
This is the fastest route for a personally owned PC when you or another household member enabled BitLocker with a Microsoft account.
Record the identifier before leaving the screen
- On the BitLocker recovery screen, copy the first eight digits of the recovery-key ID. Photographing the screen can prevent transcription errors.
- Note the account hint, if the Windows 11 version 24H2 screen shows one. It may identify the Microsoft account that contains the key.
- From another phone or computer, open Microsoft’s recovery-key page and sign in to the account associated with the locked PC.
- Review the listed recovery keys and select the entry whose ID begins with the same eight digits. Copy the entire 48-digit number, preserving its order.
- Enter that number on the recovery screen. If it is accepted, Windows should continue startup; keep the key in a secure backup after you regain access.
If someone else set up the computer, purchased it for you, or turned on BitLocker, the key may be in that person’s Microsoft account rather than yours. Ask that person to check the account instead of creating a new account and expecting a key to appear.
When the listed key does not match
- Recheck each of the eight ID digits; a single transcription error can make a correct key appear absent.
- Sign out and try every Microsoft account that has been used to set up or administer the PC.
- Do not enter a key merely because it is associated with the same computer name. The ID must match the recovery screen.
- If several entries exist, compare the complete ID, not just a familiar device name or an approximate date. A computer can accumulate multiple keys after hardware or encryption changes.
Only use Microsoft’s account page reached through its official support instructions. Do not give your Microsoft password or the 48-digit key to a caller or website promising an instant unlock. The key is equivalent to the credential needed to open the encrypted volume.
2. Check a work or school account and contact IT
A device that has ever been joined to a company, government, or school environment may have its recovery key escrowed by that organization. This can remain true after a user changes departments or leaves the organization.
Look in the organization’s device listing
- From another device, sign in with the work or school account used on the locked computer.
- Open the organization’s device-management or account portal and select the affected device.
- Choose View BitLocker Keys, when that option is available.
- Compare the displayed recovery-key IDs with the first eight digits on the recovery screen.
- Use only the matching 48-digit key to unlock Windows.
Portal names and permissions vary. Some organizations hide the key from end users entirely, in which case the device listing will not offer a key even though IT can retrieve it. Contact the organization’s IT or help desk and provide the device name, serial number if available, and the eight-digit recovery-key ID. Do not email the full key to an unverified address or post it in a public ticket.
IT should also check whether a recent policy, firmware deployment, motherboard replacement, or boot-configuration change caused the prompt. On a managed device, changing firmware settings without approval can create another recovery event or violate the organization’s security policy. Ask IT to confirm ownership and authorization before making any change to Secure Boot, TPM, PXE, or boot order.
3. Locate an existing printout or USB key file
Microsoft supports saving a recovery key on paper or as a text file on removable storage. Search for that original backup before trying repair or reset operations.
Search paper records
- Check the computer’s purchase and setup papers, safe-deposit records, and any page labeled BitLocker recovery key.
- Look for the 48-digit number and its recovery-key ID. A page without a matching ID may belong to another drive or an earlier encryption setup.
- Keep the paper private: anyone who has the matching key can unlock the encrypted drive when they have physical access to the PC.
Read a saved USB text file
- Find the USB drive that was used when the key was backed up. Buying a new, empty USB drive cannot recreate a key that was never saved.
- Insert the existing drive into the locked computer, if the recovery screen accepts removable media, or connect it to another trusted computer.
- Open the text file and locate the recovery-key ID that matches the eight digits on the BitLocker screen.
- Copy the corresponding 48-digit number into the recovery prompt.
A USB flash drive is useful only as storage for a key that already exists. It is not a key-generation device, and a generic file-recovery or password utility cannot manufacture the missing 48 digits. If the file is readable on another computer, copy the number carefully and keep the original drive unchanged while you test the match.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft’s backup guidance, including saving a key to a file and verifying that a backup exists, is documented in Back Up Your BitLocker Recovery Key. After unlocking Windows, create an additional protected backup rather than relying on one USB device.
4. Investigate a recent firmware or boot change
A key can be valid yet appear unexpectedly because the computer’s measured boot path changed. This approach is for explaining and stopping a repeat prompt; you still need the existing recovery key to resume Windows the first time.
One-time Secure Boot update prompt
Microsoft’s Secure Boot troubleshooting guide, published in March 2026, describes a scenario in which a Secure Boot update causes one recovery prompt. Enter the valid key to continue into Windows, then check the device manufacturer’s firmware-update instructions. In that documented case, the prompt is temporary rather than evidence that BitLocker has been defeated or that the drive is damaged.
Recurring prompts caused by PXE-first boot order
If recovery appears after every restart, check whether the firmware attempts PXE or network boot before the local Windows Boot Manager. Microsoft identifies PXE-first ordering as one cause of recurring BitLocker recovery prompts. If network boot is not required, the device’s authorized administrator can move Windows Boot Manager ahead of PXE or disable PXE. Firmware menus differ by manufacturer, so use the model-specific instructions and record the original setting before changing it.
Other recent changes
Motherboard or TPM work, Secure Boot changes, boot-manager edits, and major firmware updates can all alter the measurements BitLocker protects. If you cannot identify the change, stop before experimenting with firmware options and ask the device manufacturer or organizational IT for model-specific guidance. Randomly clearing the TPM or disabling Secure Boot can make recovery harder and may trigger additional prompts.
Write down what happened immediately before the first prompt: a BIOS update, a motherboard repair, a policy change, a new boot disk, or a network-boot setting. That timeline helps support staff distinguish a one-time Secure Boot event from a persistent boot-order problem. Do not assume every recovery screen has the same cause; PXE guidance is relevant only when network boot is actually ahead of the local boot manager.
Can Startup Repair fix the problem without a key?
Startup Repair can address certain startup faults, including damaged system files and boot-configuration problems, but it is not a BitLocker bypass. Microsoft states: “If you’ve encrypted your device, you’ll need your BitLocker key to complete this task.” See Startup Repair.
Windows Recovery Environment (WinRE) contains Startup Repair and other diagnostic tools. An encrypted device may require the recovery key before those tools can access the Windows volume. Microsoft’s Windows recovery environment documentation explains the environment and its limits. Use WinRE after you have located the key, and choose a repair operation that matches the observed fault; do not expect Command Prompt, System Restore, or Startup Repair to reveal or regenerate a missing key.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
In practice, separate two questions: first, can you unlock the encrypted volume with the matching key; second, is there a startup fault that a recovery tool can repair? A valid key answers only the first question. Startup Repair is appropriate for supported boot-file or configuration problems, not for an absent key, and running unrelated tools repeatedly can complicate diagnosis.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when no key can be found
Microsoft Support’s position is unambiguous: “Microsoft Support doesn’t have the ability to retrieve, provide, or recreate a lost BitLocker recovery key.” Password-recovery programs, key generators, and generic optimization utilities cannot decrypt the drive or manufacture the missing 48-digit value.
If you have checked the personal account, organization records, paper files, and existing USB backups, and you cannot undo the firmware or boot change that caused recovery, resetting Windows may be the remaining supported option. It is not a no-data-loss fix. Microsoft warns, “Resetting your device will remove all of your files.” Read the current Reset your PC instructions and confirm that you accept the loss before proceeding.
A reset should therefore be treated as a last resort, not as one of the four ways to preserve files. If the data is irreplaceable, stop and consult the device owner, organization IT, or a qualified data-recovery professional before authorizing any operation that writes to the drive. No legitimate service can promise to bypass BitLocker without the key.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Troubleshoot the most common recovery-screen situations
The account page shows several keys
Use the recovery-key ID, not the computer’s name, date, or a guess about which key is newest. Match the first eight digits and then copy the complete 48-digit value.
The key is rejected
Verify that you entered all 48 digits in the correct order and that the ID belongs to this exact drive. If the ID and number came from separate records, find the original paired entry. Try another saved key only when its ID also matches the screen.
The key works, but recovery returns on the next reboot
That pattern points to a continuing boot-measurement change. Review the Secure Boot or PXE cases above, then ask the manufacturer or IT to inspect firmware, TPM, and boot order. Do not repeatedly clear security hardware or disable protections as a test.
The PC is owned by an employer or school
Stop making firmware changes and contact the organization that manages it. The organization may have the escrowed key and the policy needed to correct the underlying boot change.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →You are using Windows 10
Microsoft’s Windows Recovery Environment page records that Windows 10 support ended on October 14, 2025. The recovery-key principles still apply, but obtain current security and support guidance before continuing to use an unsupported installation.
The screen shows an account hint you do not recognize
The hint may belong to the person who first configured the PC or enabled BitLocker. Ask that account holder to sign in and match the ID. Do not assume the currently logged-in Windows user owns the saved key.
Prevent a future lockout after you regain access
- Open BitLocker management in Windows and use Microsoft’s documented backup process to save the recovery key to at least two protected locations.
- Keep one offline copy, such as a clearly labeled printout or an existing encrypted USB record, separate from the PC.
- Verify that each backup includes the recovery-key ID alongside the 48-digit number.
- For a work or school device, confirm with IT where the organization escrowed the key and who can retrieve it.
- Before changing Secure Boot, TPM, firmware, or boot order, check the manufacturer’s and organization’s instructions and have the recovery key available.
- Periodically confirm that the account, paper, or USB copy is still accessible. A backup that cannot be opened or whose ID cannot be matched is not a dependable recovery plan.
A quick decision checklist
- Photograph the recovery screen and record the first eight ID digits.
- Use the Windows 11 24H2 account hint, if present, to identify the likely Microsoft account.
- Check every relevant personal Microsoft account, then the work or school account or IT portal.
- Search the original paper records and existing USB text files, matching the ID before entering any number.
- After unlocking, identify whether a Secure Boot update, PXE-first order, or other documented change explains the prompt.
- Use WinRE or Startup Repair only with the key available and only for a corresponding startup fault.
- If no key exists, stop before reset unless you knowingly accept that the files will be removed.
Frequently Asked Questions
How many digits is a BitLocker recovery key?
It is a 48-digit number. The first eight digits of the recovery-key ID shown on the screen identify which saved 48-digit key belongs to that device.
Can Microsoft Support give me a lost BitLocker key?
No. Microsoft Support says it cannot retrieve, provide, or recreate a lost recovery key. You must find an existing copy in an account, organizational record, printout, or USB file.
What if I have several keys in my Microsoft account?
Match the first eight digits of each recovery-key ID to the ID on the recovery screen. Do not choose by computer name or date alone.
Can a new USB drive recover my missing key?
No. A USB drive can store a text file that was saved earlier, but buying an empty drive does not generate or recreate an unsaved key.
Why does BitLocker ask for the key after every restart?
A continuing boot-measurement change may be responsible. Microsoft documents PXE or network boot placed ahead of Windows Boot Manager as one possible cause; Secure Boot, TPM, firmware, and motherboard changes can also matter. Use model-specific or organizational guidance before changing settings.
Can Startup Repair unlock BitLocker without the key?
No. Microsoft says an encrypted device needs its BitLocker key to complete Startup Repair. WinRE tools are not a way to bypass encryption.
Free tools Windows power users keep installed
One-click scans. No signup required.
Will resetting Windows preserve my files if I cannot find the key?
Do not assume that it will. Microsoft warns that resetting the device removes all files in this recovery scenario, so treat reset as a last resort after accepting the data-loss consequence.
What should I do with a work or school computer?
Contact the organization’s IT or help desk, provide the device details and the eight-digit recovery-key ID, and let authorized staff retrieve the escrowed key or correct firmware and boot settings.
The Bottom Line
Use the recovery-key ID to find the matching 48-digit key in a Microsoft account, work or school records, a printout, or an existing USB file. Then correct a known Secure Boot or PXE boot-order trigger if the prompt repeats. If no valid key exists, BitLocker cannot be bypassed and a reset can remove all files.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
