How to Back Up BitLocker Recovery Key in Windows 11
A BitLocker recovery key is a 48-digit numerical password. It unlocks your encrypted drive when Windows 11 detects a hardware or security change and refuses to start normally. Without it, the data on that drive is not recoverable. That is how the encryption is meant to work.
Backing up this key prevents a permanent lockout when your PC asks for a safety check before letting you sign in. Common triggers are a BIOS or firmware update, a motherboard swap, or a change to the boot settings. You can save the key to your Microsoft account, a USB flash drive, or a text file, or print a paper copy. Do all of this while you can still sign in, not after the blue recovery screen appears. The backup takes a couple of minutes and needs no restart.
Which edition you run matters. Windows 11 Pro, Enterprise, and Education include full BitLocker management. Many Windows 11 Home PCs use “device encryption”, a lighter version that usually backs the key up to your Microsoft account automatically when you sign in with one. If you see no BitLocker options on a Home PC, that is why. On Home, check Settings Privacy & security > Device encryption to see whether it is on. If that page is missing, your PC may not support device encryption.
Open Command Prompt as administrator, type manage-bde -protectors -get C: and press Enter to view your recovery key ID and confirm the key exists. Then save the 48-digit recovery key to your Microsoft account, a USB drive, or a printed copy—store backups away from your PC.
Finding Your Recovery Key ID
The BitLocker Recovery Key ID is a short code that tells Windows, and you, which key belongs to which drive. The blue recovery screen shows this string during a recovery prompt. It is a mix of letters and numbers, and you will see it before you are asked to type the 48-digit key. The screen may show only the first part of the ID, so match the start of the string.
The ID matters when you have more than one PC or drive. Your Microsoft account may list several keys, and the ID is how you pick the right one. Take a photo of the blue screen, or write the ID down, before you go looking for the key.
Using Command Prompt for Advanced Management
Command Prompt lets you check a drive’s protection status and view its key identifiers quickly, without clicking through the settings menus. It needs administrator rights, so open it with Run as administrator. Otherwise the command fails with an access error.
This is also the quickest way to confirm that a recovery key actually exists on the drive before you rely on a backup.
Follow these steps to open an administrator Command Prompt and read the ID of your drive's recovery key. The steps carry on below, where you back the key up.
- Open the Start menu and type Command Prompt. The Command Prompt app appears at the top of the results.
- Right-click Command Prompt and choose Run as administrator.
- Select Yes if a User Account Control prompt appears. A black window opens with a title that starts with "Administrator".
- Type manage-bde -protectors -get C: and press Enter. This shows the key protectors for drive C. Change the drive letter if you want to check a different drive.
- Find the Numerical Password entry in the output and note its ID. This is the recovery key ID of your drive. Write it down so you can compare it with your backup later.
If you get a message that the drive is not BitLocker-protected, the drive is not encrypted. That is common on Windows 11 Home PCs without device encryption. In that case there is no key to back up on that drive.
manage-bde -protectors -get C:
This command lists all active key protectors alongside their recovery key identifiers. The entry labelled Numerical Password is the recovery key, and its ID is the string you compare against the blue recovery screen. Other entries, such as TPM, are different protectors and are not the key you back up.
Treat that screen like a password. Don't paste it into a chat or leave it in a shared screenshot. If you copy it somewhere, do not store it on the same encrypted drive, because you could not read it when you need it.
Summary
Store the key in your Microsoft account, save it to a USB drive, or print a physical copy. Doing two of these is better than one. A good pair is your Microsoft account plus a printout kept somewhere safe.
These steps finish the process and back up your BitLocker recovery key. They use the Control Panel BitLocker page, which is available on Windows 11 Pro, Enterprise, and Education.
- Open Control Panel. Press the Start menu, type Control Panel, and select it from the results.
- Select System and Security. A list of system tools appears.
- Select BitLocker Drive Encryption. Your drives are listed with their BitLocker status.
- Select Back up your recovery key under the drive you want to protect. A window asks how you want to back up the key.
- Choose where to save the key. The options are Save to your Microsoft account, Save to a USB flash drive, Save to a file, and Print the recovery key. Use two of them if you can.
- Follow the prompts for the option you chose. For a USB drive or a file, pick a location that is not the encrypted drive. For a printout, pick your printer.
- Close the window when it confirms the key is saved.
- Compare the ID on your saved copy with the ID you noted in step 5. They should match. If they do not, repeat the backup for the correct drive.
If Back up your recovery key is missing, BitLocker is probably off for that drive, or your edition does not include BitLocker management. If Save to your Microsoft account is missing, you are likely signed in with a local account. Sign in with a Microsoft account, or use another option.
Keep copies away from the PC itself, and don't leave a USB drive plugged into the laptop it protects. If you change the encryption or decrypt the drive later, generate a new backup so that you aren't holding an outdated key. Check that the ID on your saved copy matches the one shown by the command above.
Have a question about this guide?
Answered by AI from this guide. Good questions may be added to this page — please don't include personal details.
Did this guide fix your problem?
About the Author
Richard
Tech Writer, IT Professional
Richard is a writer at Geek Rewind who turns complex IT tasks into clear, step-by-step guides. He draws on years of hands-on experience in system administration and enterprise IT operations, focusing on Windows, Linux and WordPress: the problems people actually run into, and the fixes that work. His server and WordPress guides come from systems he runs himself. Richard builds and maintains the platform behind Geek Rewind, from its Ubuntu servers and Nginx configuration to its custom WordPress plugins. Many new tutorials start with readers' questions, and he's always glad to answer them in the comments.
No comments yet — be the first to share your thoughts!