BitLocker recovery key: find it at the blue screen, or fix a lost one
The BitLocker recovery screen shows a Recovery Key ID. Match that ID to a saved 48-digit recovery password, usually stored in your Microsoft account, your organization's Entra ID or Active Directory, a printed page or a saved .TXT file. A .BEK file is different: it is a startup key read from a USB drive, not something you type.
How to use it
- Write down the Recovery Key ID shown on the blue screen. If your drive has more than one saved key, the ID tells you which one to use.
- On your phone or another computer, sign in at aka.ms/myrecoverykey if the PC uses a personal Microsoft account. For a work or school PC, open myaccount.microsoft.com, choose Devices, then View BitLocker Keys, or ask your IT team for the key.
- Find the key whose ID matches the one on the blue screen and type its 48-digit recovery password. If your setup used a startup key instead, insert the USB drive that holds the .BEK file.
- After Windows starts, restart once so BitLocker is protecting the drive normally again, and save the recovery key somewhere you can reach from another device.
Methodology and sources
Steps follow Microsoft's BitLocker recovery documentation. The guide is written for a phone screen because the locked PC cannot show it. The lookup paths differ by how the PC is managed: a personal Microsoft account, a work or school account in Microsoft Entra ID (formerly Azure AD), or on-premises Active Directory, which is why the steps name each one. If no saved copy of the key exists in any of those places, the drive cannot be unlocked and the only option is to reset the PC, which erases it.
FAQ
Why did BitLocker ask for a recovery key, and how do I stop it after BIOS updates?
Common triggers are BIOS, firmware or TPM updates (Dell and most other makers can cause this), Secure Boot changes, a new boot device order, docking stations and hardware changes. BitLocker asks for the key to confirm it is really you. To avoid it after a BIOS update, suspend BitLocker before the update and it resumes after the next restart.
What is the difference between a .BEK and a .TXT file?
A .TXT file holds the 48-digit recovery password you type. A .BEK file is a startup key that BitLocker reads from a USB drive; you cannot type it.
What is aka.ms/myrecoverykey, and what is the recovery key ID?
aka.ms/myrecoverykey is a Microsoft page that lists the BitLocker recovery keys saved to a personal Microsoft account. The key ID is the identifier on the blue screen. Each saved key has its own ID, so match the ID on the screen to the one listed to pick the right 48-digit password.
I lost my BitLocker recovery key. What can I do?
First check every place a copy could be: the Microsoft account you signed in with, your work or school account, your IT team's directory, a printout, a saved .TXT file or a USB drive. Microsoft cannot generate a replacement key. If no copy exists, the drive cannot be unlocked and the only option is to reset the PC, which erases it.
Where is the recovery key on an Azure AD or Entra ID work laptop?
If the laptop is joined to Microsoft Entra ID (formerly Azure AD), the key is usually saved to your work account. Open myaccount.microsoft.com, choose Devices, then View BitLocker Keys. If you do not see it, your IT administrator can look it up in the Entra or Intune admin portal.
Can you automate device recovery-key backups for my team?
Yes. We build monitoring that checks every device has an escrowed key and alerts when one is missing. Start a custom build from the contact page.
Related tools
Related service
Keyword, price and uptime monitors, plus scheduled digests, so nothing has to be checked by hand.
Need this tuned to your data?
This tool runs on public data. We build the same kind of thing on your own data, wired into your systems.