BitLocker protects the data on a laptop that is lost or stolen. Here's how it works, how to turn it on, and the mistake people make most often.
What it protects — and what it doesn't
Encryption doesn't protect against everything. Know where it helps.
| Situation | Does BitLocker help? |
|---|---|
| Laptop lost or stolen (powered off) | Yes — contents are ciphertext; unreadable without credentials/recovery key |
| Drive pulled and connected to another PC | Yes — same; carrying it away is pointless |
| Someone uses/peeks at your already-logged-in PC | No (that's strong login + auto-lock) |
| Malware infection / phishing | No (needs separate defenses) |
How it works (briefly)
The key is held by the TPM (the PC's security chip), tied to hardware integrity and released at boot. For more strength, require a PIN at startup.
Most important: keeping the recovery key safe
With BitLocker, the real trouble is rarely "it gets broken" — it's locking yourself out.
Lose the recovery key and your own data never opens again
A TPM change, a motherboard swap, or a firmware update can make BitLocker ask for the 48-digit recovery key. If you didn't save it, you — the rightful owner — are locked out of your data. The rule: store it outside the encrypted PC. Saving it only inside the same PC means you can't reach it during a lockout.
How to enable it
Check your edition
Enable it and save the recovery key OUTSIDE the PC
For more strength, require a PIN
Use BitLocker To Go for external/USB drives
How to check your own PC
Don't assume the drive is encrypted. Check its state and where the recovery key actually lives.
See whether encryption is on
Look at the details from the command line
manage-bde -status. For each drive it shows the Protection Status, the encryption method, and the percentage encrypted. If protection is off, the drive is not protected even if it is encrypted.Find where the recovery key is stored
manage-bde -protectors -get C: so you know which key belongs to which drive.Suspend before a BIOS update
A PC with only a local account can be encrypted but not protected
According to Microsoft, device encryption starts in a state equivalent to "suspended," with the key stored in the clear. Protection turns on once the recovery key is saved to a Microsoft account (or, for work PCs, Entra ID or similar). A PC used only with a local account stays in the unprotected state even though its data is encrypted. Check the protection status with manage-bde -status above.
Example: the 2024 outage that made many people need their recovery keys
In July 2024, an update to an enterprise security product left many Windows machines unable to start. Microsoft estimated that about 8.5 million devices were affected.
Microsoft's published recovery steps required starting the PC in Safe Mode or the recovery environment, and warned that you may be asked for the BitLocker recovery key along the way. On machines where nobody knew where the key was stored, recovery stopped at that point.
Recovery keys are not only for theft. This case shows what helps to prepare:
- Keep the recovery key outside the device and somewhere you can find quickly (a Microsoft account for individuals; Entra ID or Active Directory for organizations)
- Record which device each recovery key ID belongs to
- Decide who is allowed to view recovery keys (anyone holding the key can read everything on that drive)
How to locate the key is covered in How to find your BitLocker recovery key.
How it differs from similar features
| Feature | What it encrypts | Where you find it |
|---|---|---|
| BitLocker | OS drive and internal drives (external and USB drives too, with BitLocker To Go) | Windows Pro / Enterprise / Education |
| Device encryption | OS drive and internal drives (not external or USB drives) | Supported devices, including Windows Home. Uses the same BitLocker engine |
| FileVault | The startup disk | macOS |
| EFS (Encrypting File System) | Individual files and folders | Windows. Does not protect the whole disk |
For the finer differences between BitLocker and device encryption (settings screens, available protectors), see BitLocker vs device encryption. To turn BitLocker off safely, see How to turn off BitLocker.
This site's view: the minimum protection for any device that leaves the building
Disk encryption is the minimum for any device you take outside. A laptop is full of material that leads to further damage if it leaks: saved passwords, SSH keys, work files. Without encryption, a theft means the drive is pulled and all of it read. Turn on BitLocker (or FileVault on a Mac) and keep the recovery key outside the PC. Those two steps reduce a loss or theft to "you only lost the hardware." But encryption is a "powered-off" defense, so always pair it with a strong login and auto-lock.
Read next
- If you are asked for a recovery key: How to find your BitLocker recovery key
- To turn it off: How to turn off BitLocker
- On the go: Securing a laptop you carry around
- Inventory: Security inventory (auditing the PC that holds your keys)
- Storage: How to choose a password manager
- Compare: BitLocker vs device encryption
Sources (primary)
- Microsoft Learn, "BitLocker overview" — learn.microsoft.com (supported editions, TPM and PIN, device encryption requirements and recovery key backup, relaxed requirements in Windows 11 24H2, default XTS-AES 128)
- Microsoft Learn, "BitLocker recovery overview" — learn.microsoft.com (what triggers recovery, the 48-digit recovery password, storage locations, suspend and resume)
- Microsoft official blog (July 20, 2024, on the response to the outage) — blogs.microsoft.com (estimated number of affected devices)
- Microsoft Support, "KB5042421" (recovery steps for the outage) — support.microsoft.com (the recovery key may be requested during recovery)