How to Back Up BitLocker Recovery Key in Windows 11
- 14 steps
- Needs administrator rights
A BitLocker recovery key is a 48-digit numerical password that unlocks your encrypted drive when Windows 11 refuses to start normally. Without it, the data on that drive is not recoverable. That is how the encryption is meant to work.
Backing up the key prevents a permanent lockout after a BIOS or firmware update, a motherboard swap, or a change to the boot settings. You can save it to your Microsoft account, a USB flash drive, or a text file, or print a paper copy. Do this while you can still sign in. The backup takes a couple of minutes and needs no restart.
Windows 11 Pro, Enterprise, and Education include full BitLocker management. Many Home PCs use “device encryption”, a lighter version that usually backs the key up to your Microsoft account when you sign in with one. On Home, check Settings Privacy & security > Device encryption. If that page is missing, your PC may not support it.
Open Command Prompt as administrator, type manage-bde -protectors -get C: and press Enter to view your recovery key ID and confirm the key exists. Then save the 48-digit recovery key to your Microsoft account, a USB drive, or a printed copy—store backups away from your PC.
Finding Your Recovery Key ID
The BitLocker Recovery Key ID is a short code that tells Windows, and you, which key belongs to which drive. The blue recovery screen shows it before you are asked to type the 48-digit key. It is a mix of letters and numbers, and the screen may show only the first part, so match the start of the string.
Using Command Prompt for Advanced Management
Command Prompt lets you check a drive’s protection status and view its key identifiers without clicking through settings menus. It needs administrator rights, so open it with Run as administrator. Without them, the command fails with an access error.
This is also the quickest way to confirm that a recovery key exists on the drive before you rely on a backup.
Follow these steps to open an administrator Command Prompt and read the ID of your drive’s recovery key. The numbering carries on below, where you back the key up.
- Open the Start menu and type Command Prompt. The Command Prompt app appears at the top of the results.
- Right-click Command Prompt and choose Run as administrator.
- Select Yes if a User Account Control prompt appears. A black window opens with a title that starts with “Administrator”.
- Type manage-bde -protectors -get C: and press Enter. The window lists the key protectors for drive C. Change the drive letter if you want to check a different drive.
- Find the Numerical Password entry in the output and note its ID. This is the recovery key ID of your drive. Write it down so you can compare it with your backup later.
If you get a message that the drive is not BitLocker-protected, the drive is not encrypted. That is common on Windows 11 Home PCs without device encryption. In that case, there is no key to back up on that drive.
manage-bde -protectors -get C:
The command lists all active key protectors alongside their identifiers. The entry labelled Numerical Password is the recovery key, and its ID is the string you compare against the blue recovery screen. Other entries, such as TPM, are different protectors and are not the key you back up.
The output can also show the full 48-digit password. Treat that screen like a password. Don’t paste it into a chat or leave it in a shared screenshot.
If you copy the key somewhere, do not store it on the same encrypted drive. You could not read it when you need it most.
Summary
A BitLocker recovery key backup is essential for unlocking your computer during a lockout. Store the key in your Microsoft account, save it to a USB drive or a file, or print a physical copy. Two copies are better than one. A good pair is your Microsoft account plus a printout kept somewhere safe.
These steps finish the process and back up your BitLocker recovery key, including the printed copy. They use the Control Panel BitLocker page, which is available on Windows 11 Pro, Enterprise, and Education.
- Open Control Panel. Select the Start menu, type Control Panel, and select it from the results.
- Select System and Security. A list of system tools appears.
- Select BitLocker Drive Encryption. Your drives are listed with their BitLocker status.
- Select Back up your recovery key under the drive you want to protect. A window asks how you want to back up the key.
- Choose where to save the key. The options are Save to your Microsoft account, Save to a USB flash drive, Save to a file, and Print the recovery key. Use two of them if you can.
- Follow the prompts for the option you chose. For a USB drive or a file, pick a location that is not the encrypted drive.
- To print the key, choose Print the recovery key, pick your printer in the Print window, and select Print. The page that comes out shows the recovery key ID and the 48-digit key.
- Close the window when it confirms the key is saved.
- Compare the ID on your saved copy with the ID you noted in step 5. They should match. If they do not, repeat the backup for the correct drive.
That’s it. Your recovery key is now saved in at least one place outside the encrypted drive, and you have checked that its ID matches the drive.
A few notes on the paper copy. Check that every digit is readable before you file the page, because a smudged or cut-off digit makes the key useless. Keep it somewhere secure, such as a home safe or a locked drawer, and not in the laptop bag. Anyone who holds the page and the PC can unlock the drive.
If you have no printer, you can pick Microsoft Print to PDF in the printer list if it appears there. Save the PDF to a USB drive or another location off the encrypted drive, then print it later from a different PC. A PDF stored on the protected drive is no help in a lockout.
If Back up your recovery key is missing, BitLocker is probably off for that drive, or your edition does not include BitLocker management. If Save to your Microsoft account is missing, you are likely signed in with a local account. Sign in with a Microsoft account, or use another option.
Keep copies away from the PC itself, and don’t leave a USB drive plugged into the laptop it protects. If you change the encryption or decrypt the drive later, generate a new backup so you aren’t holding an outdated key and printout. Destroy the old paper copy once the new one is verified.
Frequently asked questions
How to set up the Windows keyboard for 🪟 Windows 11 for english?
To set up an English keyboard in Windows 11, open Settings, go to Time & language, then select Language & region. If English is not listed, select Add a language and choose English (United States). Then open the language's options and confirm a keyboard layout such as US is added. Press Win+Space to switch layouts.
How to find BitLocker recovery key?
Sign in to your Microsoft account at account.microsoft.com/devices/recoverykey and match the Recovery Key ID shown on the blue recovery screen. If you saved the key to a USB drive, text file, or paper printout, check there first. The key is a 48-digit number.
How to get BitLocker recovery key?
Get the key from your Microsoft account, a saved file, or a printed copy. Compare the Recovery Key ID on the blue recovery screen with the ID next to each saved key so you pick the right one. If you never saved the key, your encrypted data cannot be opened.
What is BitLocker recovery?
BitLocker recovery is the state where Windows locks an encrypted drive and asks for a 48-digit recovery key before it starts. Windows triggers it when it detects a hardware change, a firmware update, or a change to boot settings. It protects your data from people who try to access the drive without permission.
What is a BitLocker recovery key?
A BitLocker recovery key is a 48-digit number that unlocks an encrypted drive when normal sign-in fails. Windows creates it when you turn on BitLocker. Keep a copy somewhere safe, because without the key, you cannot open the drive's files after a lockout.
How do I find my BitLocker recovery key?
Look in your Microsoft account at account.microsoft.com/devices/recoverykey, or check any USB drive, text file, or printout where you saved the key. Match the Recovery Key ID shown on your blue recovery screen. The key has 48 digits.
Still have a question?
Answered by AI from this guide. Good questions may be added to this page — please don't include personal details.
Did this guide fix your problem?
About the Author
Richard
Tech Writer, IT Professional
Richard is a writer at Geek Rewind who turns complex IT tasks into clear, step-by-step guides. He draws on years of hands-on experience in system administration and enterprise IT operations, focusing on Windows, Linux and WordPress: the problems people actually run into, and the fixes that work. His server and WordPress guides come from systems he runs himself. Richard builds and maintains the platform behind Geek Rewind, from its Ubuntu servers and Nginx configuration to its custom WordPress plugins. Many new tutorials start with readers' questions, and he's always glad to answer them in the comments.
No comments yet — be the first to share your thoughts!