How to Change BitLocker Encryption in Windows 11

What is BitLocker?

BitLocker is a Windows feature that scrambles your files, making them unreadable to anyone without the right key, and it can protect your main computer drive, USB sticks, and other storage.

When you turn on BitLocker for your main Windows drive, it can unlock automatically using a special chip in your PC called the Trusted Platform Module (TPM). This means you won’t have to enter a password every time you start your computer. Learn more about TPM here.

Why Change the Encryption Method?

BitLocker uses a type of encryption called XTS-AES 128-bit by default. While this is already quite secure, you can switch to a stronger 256-bit encryption for extra protection. This makes it even harder for someone to break into your data.

How to Change BitLocker Encryption Using Group Policy

You can change how BitLocker encrypts your drives using the Local Group Policy Editor, a built-in Windows tool that lets you adjust these security settings.

1. Open the Group Policy Editor: Click the ⊞ Start button, type Edit group policy, and press Enter. ⚠️ Admin privileges required
2. In the window that opens, follow this path: Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption
3. On the right side, find and double-click “Choose drive encryption method and cipher strength (Windows 10 Version 1511 and later)”.
4. In the window that opens:

   • Select Enabled.
   • Now you can choose the encryption method and strength for:
     • Operating system drives
     • Fixed data drives
     • Removable data drives
   • Pick the desired encryption type from the drop-down menus (for stronger encryption, pick a 256-bit option).
5. Click OK to save.
6. 🔄 Restart your computer to apply the changes.

How to Change BitLocker Encryption Using Registry Editor

Changing BitLocker encryption settings is also possible using the Windows Registry Editor, though you should be careful as incorrect changes can cause system issues.

1. Open the Registry Editor: ⊞ Click Start, type regedit, and press Enter. ⚠️ Admin privileges required
2. If prompted, click Yes to allow changes.
3. Go to this folder path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE
4. Look for these three entries on the right side:

   • EncryptionMethodWithXtsOs
   • EncryptionMethodWithXtsFdv
   • EncryptionMethodWithXtsRdv
5. If you don’t see them, 🖱️ right-click on an empty space, choose New → DWORD (32-bit) Value, and create these three names exactly as above.
6. Double-click each entry and set its value to:

   • 4 for AES-CBC 256-bit encryption
   • 7 for XTS-AES 256-bit encryption
7. Click OK for each, then close the Registry Editor.
8. 🔄 Restart your PC to apply changes.

Reset to Default Encryption

If you want to go back to the original BitLocker encryption (XTS-AES 128-bit), delete the three registry entries you created:

• EncryptionMethodWithXtsOs
• EncryptionMethodWithXtsFdv
• EncryptionMethodWithXtsRdv

Then restart your PC.

Summary

You can customize BitLocker encryption in Windows 11 to make your files more secure by changing its settings through tools like the Group Policy Editor or Registry Editor.