A .bek file is a BitLocker Encryption Key file. It unlocks a drive without requiring a user to type a recovery key. A text file contains a string of numbers for humans. In contrast, a .bek file is a digital key that Windows reads from a USB drive to start the system.

If you see a blue recovery screen and are unsure if you need a .bek file or a 48 digit code, use our BitLocker Recovery Key: Find It or Fix a Lost One guide to identify your needs.

How a .bek file works

BitLocker is a full disk encryption feature from Microsoft. It protects sensitive information from unauthorized access [1]. The system usually unlocks using a default mechanism like a TPM chip on the motherboard [2]. Certain events trigger recovery mode. These include entering a PIN incorrectly too many times or changing system hardware [2].

Windows asks for proof of ownership when this happens. You have two options:

  1. A recovery key: This is a 48 digit number you type manually into the blue screen.
  2. A startup key: This is the .bek file on a USB flash drive. Windows reads the .bek file and unlocks the system automatically when you plug in the drive.

Differences between .bek and .txt files

Users often confuse .bek files with .txt files because both help with BitLocker recovery. They differ in usage.

A .txt file is a human readable document containing the 48 digit recovery key. You must open it on another device, read the numbers, and type them into the locked computer.

A .bek file is a machine readable binary file. You do not open or read it. You place it on a USB drive and insert that drive into the computer. The system detects the file to decrypt the drive. Some third party tools on Linux can read .bek files to print information, but Windows uses them as a physical key.

Example: Recovering access to your drive

Follow these steps to get back into your system if you see a blue screen.

First, look at the blue screen and write down the Recovery Key ID. This ID is a label, not the key. It ensures you use the correct key if you have multiple saved.

Next, use a phone or another computer to find your key. The location depends on your account type:

  • For personal accounts, sign in at aka.ms/myrecoverykey.
  • For work or school accounts, go to myaccount.microsoft.com, select Devices, and then View BitLocker Keys. You can also contact your IT team.

Find the key that matches your Recovery Key ID. If you have a 48 digit recovery key, type it into the blue screen. If your setup used a startup key, insert the USB drive with the .bek file.

Restart the computer once Windows starts. This returns BitLocker to normal protection mode. Save your recovery key in a place accessible from a separate device to avoid future lockouts.

What happens if the key is lost

BitLocker provides strong protection [1]. The drive cannot be unlocked if you lack the .bek file on a USB drive and cannot find the 48 digit recovery key in your Microsoft account, Entra ID, or Active Directory.

There is no way to bypass the encryption in this scenario. The only option is to reset the PC. This erases all data on the drive to allow the operating system to be reinstalled.

Always back up recovery information in multiple locations. You can use our BitLocker Recovery Key: Find It or Fix a Lost One tool to help you navigate the recovery process and secure your keys for the future.