BitLocker Recovery: what to do at the blue screen

Your PC booted to a blue screen asking for a BitLocker recovery key. Nothing is lost: the drive is encrypted and Windows wants proof it is still you. This page is built to be read from a phone while the computer is stuck.

The rule most people miss: a recovery key comes in two different forms. A .TXT file (or a printout, or a web page) holds the 48-digit recovery password, which you type. A .BEK file is a startup key: the recovery screen's “Load your recovery key from a USB device” option reads it from the root of a USB drive. That option never reads a .TXT, and a .BEK file is not something you can type.

1. Read the key ID on the screen

Look for the line Recovery key ID (on older screens, Key ID). It shows 8 characters, for example 1A2B3C4D. Some screens show the full 32-character ID after you press Esc for more options.
Write those 8 characters down. They identify which key unlocks this drive. Every key you find below will be labeled with a matching ID; use only the one that matches.
Note the drive label if the screen shows one. On a PC with several encrypted drives, each drive has its own key.

2. Find the recovery key

Where	Applies when	How to get it
Microsoft account	Personal PCs signed in with a Microsoft account (most Windows 10/11 home laptops encrypt automatically and back the key up here)	On a phone, go to `aka.ms/myrecoverykey`, sign in with the account used on that PC, and match the key ID.
Work or school account (Microsoft Entra ID, formerly Azure AD)	Company-managed or school-managed devices	Sign in to `aka.ms/aadrecoverykey` or your organization's device portal, or ask your IT help desk. Give them the key ID.
Active Directory	Domain-joined PCs in an office network	Your IT team can look up the key by key ID in Active Directory. Call the help desk.
Printed or saved file	Whoever set up BitLocker chose “Print” or “Save to a file”	Look for a sheet or a file named like `BitLocker Recovery Key <ID>.TXT` on another drive, a USB stick, or cloud storage. Check that the ID in the file matches the screen.
Password manager	You or your IT team stored it there	Search the vault for “BitLocker” or for the 8-character key ID.
USB startup key (`.BEK`)	BitLocker was set up with a USB startup key	Plug that USB drive in and choose Load your recovery key from a USB device.

3. Enter it

Typing the 48-digit password: the screen accepts digits only, in eight groups of six. Dashes are added for you. On many laptops the number row works when the numeric keypad does not, or the reverse: try the other one if keys seem dead.
Using a USB startup key: plug the drive in before choosing the option. The .BEK file must be in the root folder of a FAT32-formatted USB drive. If the option cannot see the drive, the firmware is not reading that port: try another port, or fall back to typing the 48-digit password.
After Windows starts, other encrypted data drives usually unlock automatically if auto-unlock was turned on. If you are in the Windows Recovery Environment (WinRE) rather than a normal boot, auto-unlock does not apply; unlock each drive from the command prompt with manage-bde -unlock D: -RecoveryPassword <48 digits> or manage-bde -unlock D: -RecoveryKey E:\<file>.BEK.

If no source has a key with a matching ID, the data on that drive cannot be recovered. Microsoft support cannot generate or bypass a key. Reinstalling Windows is then the only way to use the drive again, and it erases it.

Why it happened: common triggers

Trigger	Why BitLocker reacts
BIOS/UEFI or firmware update	The TPM measures the firmware at boot. New firmware means new measurements, so the TPM will not release the key.
TPM or fTPM firmware update, or TPM cleared/reset	AMD fTPM and Intel PTT live in firmware. A firmware update, a CMOS reset, or clearing the TPM can wipe or change the keys it holds.
Secure Boot turned off, or its keys changed	Secure Boot state is part of what the TPM checks.
Boot order changes, docking stations, USB or network boot	Booting from a new device (a dock's network adapter, a USB stick left in) changes the measured boot path.
Hardware changes	Moving the drive to another PC, swapping the motherboard, or some RAM and storage changes.
Repeated wrong PIN or password	BitLocker locks to recovery after too many failed pre-boot attempts.

Before a BIOS or firmware update

Confirm you can reach a copy of every recovery key from another device (your phone). Do not rely on one copy.
Suspend BitLocker from an admin prompt: manage-bde -protectors -disable C: -RebootCount 0. A count of 0 keeps it suspended until you resume it.
Run the update, reboot, and confirm you reach the desktop.
Resume protection: manage-bde -protectors -enable C:.

Prevention checklist

List your drives and their key IDs now, while Windows works: manage-bde -protectors -get C: (repeat for each drive).
Keep at least two copies of each recovery password, in different places: for example your Microsoft account plus a password manager or a printout.
If you rely on a USB startup key, keep the .BEK file in the root of a FAT32 USB drive and store the 48-digit password separately as a fallback.
When you re-encrypt or add a protector, a new key ID is created. Save the new key and label old copies as retired so you do not grab the wrong one later.
Suspend BitLocker before firmware updates, and unplug docks and USB drives you do not boot from.
Test your recovery path once: confirm the key ID stored in your backup matches the one manage-bde reports.

General guidance, not vendor support. For a company-managed device, your IT team's process comes first.