Security Guides

#BitLocker #disk encryption #Windows #theft protection #devices

BitLocker vs 'Device encryption' — the same technology, full version vs automatic lite

BitLocker and Device encryption share one engine: Device encryption is the automatic lite version on Home, BitLocker the full one on Pro. Differences, checks.

Published 2026-06-11 Updated 2026-10-06 9 min read

On this page

"Is BitLocker the same as the 'Device encryption' I see in Settings?" Here's the answer. Up front: the encryption technology is the same; what differs is the features you get. No attack steps here.

The same encryption technology, with different features

Device encryption
automatic, lite (Home OK)

BitLocker
full control (Pro+)

↓ same core ↓

BitLocker encryption engine (turns data at rest into ciphertext)

Both use the same BitLocker encryption engine. 'Device encryption' is the automatic, lite version; BitLocker is the version with full control.

The differences at a glance

Aspect	Device encryption	BitLocker
Editions	Works on Home	Pro / Enterprise / Education
Turning on	Automatic when conditions are met (MS account)	You enable/configure it manually
Options	Minimal (mostly hands-off)	Rich (method, scope, operations)
Startup PIN	Not really	Available (more theft resistance)
External/USB encryption	No	Yes, via BitLocker To Go
Recovery key storage	Auto-escrowed to MS account	You choose where to save it
Management command	Almost none	`manage-bde` for detailed control
Default cipher	XTS-AES 128-bit	Same default; changeable via Group Policy
Work or school PCs	Recovery key goes to Entra ID / Active Directory	Managed by your organization's policy
Encryption effect (the point)	Same (protects data at rest)	Same

Which one does your PC use? How to check

Look for 'Device encryption' in Settings

If Settings search shows a "Device encryption" toggle, that's what's in use (common on Home).

On Pro+, open 'Manage BitLocker'

Search for "Manage BitLocker" to see each drive's encryption state and manage the recovery key.

Check status via command

In an admin terminal, run manage-bde -status to list whether, and how, it's encrypted.

Always confirm where the recovery key is

In either case, confirm the recovery key is kept outside the PC (e.g. your MS account). This matters most (→ what is BitLocker).

"Encrypted" and "protected" are not the same thing

This is the point people miss most often. Microsoft explains that Device encryption starts encrypting when Windows setup finishes, but at first it uses a "clear key" with no lock on it. That's the same as a suspended BitLocker: the drive contents are ciphertext, but the key sits where anyone can use it.

Protection only turns on once one of these happens:

Personal PC: an administrator signs in with a Microsoft account and the recovery key is saved to that account
Work or school PC: the recovery key is saved to Microsoft Entra ID or Active Directory

For PCs that only use local accounts, Microsoft writes that "the data is encrypted but not protected." In that state you don't get the real benefit: a thief being unable to read the drive.

Where to look	Protected	Encrypted but not protected
Drive C: in File Explorer	Lock icon	Yellow warning icon
"Protection Status" in `manage-bde -status`	Protection On	Protection Off
Recovery key	Saved to a Microsoft account or similar	Not saved anywhere

Where the settings are (Windows 11)

On Home, "Device encryption" is under Settings → Privacy & security → Device encryption. If the item isn't there, open System Information (msinfo32) as an administrator and check the "Device Encryption Support" row. If it doesn't say "Meets prerequisites," the reasons are listed right there.

From Windows 11 version 24H2 the requirements are looser (Modern Standby/HSTI and the DMA-port condition were removed), so more freshly installed PCs get encrypted automatically.

By situation: what to do

Your situation	What to do
Home, signed in with a Microsoft account	Check that "Device encryption" is on, and that the recovery key is saved to the account
Home, local account only	It may be encrypted but not protected. Check "Protection Status" in `manage-bde -status`. To protect it, sign in once with an administrator Microsoft account
Pro, personal use	Turn it on in "Manage BitLocker" and keep the recovery key outside the PC: Microsoft account, printout, or USB
PC issued by work or school	Don't change settings yourself. Your organization holds the recovery key; ask IT
You also want USB sticks or external drives encrypted	Device encryption doesn't cover them. Use BitLocker To Go (Pro and up)
You carry sensitive data or worry about theft	On Pro and up, add a startup PIN (TPM + PIN)

Common mistakes and fixes

Turning encryption off because of a recovery-key prompt

Turning it off won't open a drive you're locked out of. Find the recovery key first (→ when BitLocker asks for a recovery key). Also, once Device encryption is off, it never turns itself back on.

Keeping the recovery key only in a file on the PC

If the PC won't open, neither will that file. Keep at least one copy outside the PC: Microsoft account, a printout, or a separate USB drive.

Doing nothing before a BIOS update or repair

When BIOS/UEFI settings or boot components change, BitLocker asks for the recovery key. Before an update, suspending protection is enough; you don't need to turn it off (→ turning BitLocker off vs suspending it).

Assuming external drives are encrypted too

Device encryption only covers the OS drive and internal fixed drives. A USB stick you carry around needs separate handling.

Which is enough?

Device encryption is often enough (individuals)

The goal is "don't let a thief read the contents on loss"
If it's automatically on, you already get that key effect
Getting to an encrypted state is the first priority

When you need BitLocker (Pro)

You want a startup PIN for more theft resistance
You want to encrypt external/USB drives (To Go)
You want fine control of method and operations

You may be encrypted without knowing it — check the recovery key now

Recent Windows increasingly turns 'Device encryption' on automatically during initial setup, even on supported Home PCs. Convenient — but if you don't realize you're encrypted, a TPM change or hardware swap can prompt for the recovery key and lock you out of your own data. Confirm now that the recovery key is escrowed to your Microsoft account (or kept somewhere safe).

This site's view: look at the 'state,' not the product name

"BitLocker or Device encryption" isn't the point for an individual. Only two things matter: data at rest is encrypted, and the recovery key is kept outside the PC. Reach that state and, whatever it's called, a loss or theft means "you only lost the hardware." Conversely, even full BitLocker locks you out if you lose the recovery key.

On this site we recommend the habit of checking "what state is my PC in (encrypted? recovery key?)," not "which feature."

Sources (official)

Checked against Microsoft's official documentation on 6 October 2026 (assumes Windows 11 version 24H2 or later).

Microsoft Learn, "BitLocker overview" (Device encryption, clear key, local accounts, 24H2 requirement changes, XTS-AES 128-bit) — learn.microsoft.com
Microsoft Support, "Device encryption in Windows" (where the setting is, availability on Home) — support.microsoft.com
Microsoft Learn, "BitLocker countermeasures" (TPM + PIN, recovery mode after BIOS/UEFI changes) — learn.microsoft.com

FAQ

QAre BitLocker and Device encryption different?

They share the same root. 'Device encryption' uses the same BitLocker encryption technology underneath, packaged to work automatically and simply — even on Windows Home. The differences are packaging and management: Device encryption turns on automatically when you sign in with a Microsoft account and has minimal options, while BitLocker (Pro/Enterprise/Education) adds fine control like a startup PIN and external-drive encryption (BitLocker To Go).

QCan Windows Home encrypt the disk?

Yes. On supported hardware (TPM, etc.) and signed in with a Microsoft account, Home can use 'Device encryption' (often on automatically). The full BitLocker management UI is Pro and up, but the key effect — turning data at rest into ciphertext — is available on Home's Device encryption too.

QHow do I check which one my PC uses?

If Settings shows a 'Device encryption' toggle, that's what's in use. On Pro and up, open 'Manage BitLocker' from search to see each drive's state. Via command line, run manage-bde -status in an admin terminal to see whether and how it's encrypted. Either way, what matters is that it's encrypted and that you know where the recovery key is kept.

QWhy doesn't 'Device encryption' appear in Settings?

Your PC doesn't meet the Device encryption requirements. Open System Information (msinfo32) as an administrator and look at the 'Device Encryption Support' row: it shows either 'Meets prerequisites' or the reasons it doesn't. Microsoft says Windows 11 version 24H2 dropped some requirements (Modern Standby/HSTI and the DMA-port condition), so more PCs now qualify. On Pro and up you can still turn BitLocker on manually from 'Manage BitLocker'.

QDoes Device encryption protect me if I use a local account?

Possibly not. According to Microsoft, Device encryption starts right after setup in a 'clear key' state with no lock. When an administrator signs in with a Microsoft account, the recovery key is saved to that account and TPM protection is turned on. For devices that only use local accounts, Microsoft states the data is 'encrypted but not protected.' Check the 'Protection Status' line in manage-bde -status.

QIs it OK to turn Device encryption off?

Microsoft recommends keeping it on for devices that support it. Once you turn it off, it won't turn itself back on; you'd have to re-enable it manually. If the reason is a recovery-key prompt, find the recovery key first, before turning anything off. The steps and caveats for turning it off are on our page about turning BitLocker off.