Back Up Your BitLocker Recovery Key Safely

Backing up your BitLocker recovery key gives you a way to unlock an encrypted drive if Windows asks for recovery information—for example, after certain hardware, firmware, or startup changes. It does not turn off BitLocker or replace your Windows sign-in password. Have access to the Windows device and an appropriate, secure place to store the key before you begin.

What You’ll Need

A Windows device with BitLocker or Device Encryption enabled, and permission to manage its encryption settings. On a work or school computer, an administrator may control these options.
Access to a storage destination: a Microsoft account, a separate USB drive or other location for a file, or a printer and a secure place for a paper copy. Available choices can vary by Windows edition and device management.
The ability to identify which recovery key belongs to which device. If you already have a saved key, keep its key ID or device name with it for matching later.

Step-by-Step

Check that encryption is on. Open Start and search for Manage BitLocker. If the Control Panel page opens, look beside the operating-system drive, commonly C:, for its BitLocker status. Windows Home devices may instead show Device Encryption in Settings; search Settings for Device encryption. Menu paths and labels may differ slightly by Windows version. If encryption is off, there may be no recovery key to back up.
Open the recovery-key backup option. In Manage BitLocker, find the encrypted drive and select Back up your recovery key. If that exact link is missing, check the drive’s BitLocker options or the Device Encryption settings. On a managed work or school device, contact the administrator rather than changing policy or trying to bypass restrictions.
Choose a storage method. Windows may offer options such as saving the key to your Microsoft account, saving it as a file, or printing it. Select a destination you can access even if this computer will not start. A second device or protected account is often more useful in an emergency than a file saved only on the encrypted computer.
Save or print the key. Follow the prompts and complete the save or print action. A file may contain sensitive recovery information: do not leave it in a public folder, shared drive, or on the same encrypted drive without another accessible backup. If you print it, store the paper somewhere secure and separate from the computer.
Confirm the backup exists. Check that the file is present in the intended location, that the printout is readable, or that the account backup completed. Do not assume that opening the backup dialog alone saved anything. If Windows displays a key ID, note it alongside the copy so you can distinguish it from keys for other devices.
Keep it current and retrievable. If BitLocker is turned off and set up again, the recovery information may change. Back up the key again after a new encryption setup or when Windows provides a new recovery key, and remove obsolete copies securely. Make sure a trusted person can locate the backup if you are unavailable, without exposing it unnecessarily.

Common Mistakes

Saving the only copy on the encrypted computer: If the drive cannot boot or be accessed, that copy may be unreachable. Keep another copy in a separate location.
Confusing the recovery key with a password: The recovery key is a 48-digit recovery password; it is not your Microsoft account password, Windows Hello PIN, or drive-unlock PIN.
Leaving the key unprotected: Anyone who has the recovery key may be able to unlock the drive. Do not post it, email it casually, or keep an unprotected copy where others can access it.
Forgetting which key matches: A Microsoft account or folder can contain multiple keys. Record the device name and key ID, and match the ID shown on the recovery screen before using a key.
Assuming an organization-managed key is yours to move: Work and school devices may automatically store recovery keys under administrator control. Follow your organization’s process and do not copy company data to a personal account without approval.

Tips

Use at least one backup location that is independent of the encrypted device, and consider a second secure copy for important personal devices.
For a digital copy, use storage protected by a strong account sign-in and keep the file in a private location. Avoid leaving it on a shared or public computer.
For a paper copy, label it clearly enough to identify the device, but do not attach it to the computer or keep it in the same bag.
Check that you can sign in to the account or reach the storage location from another device. A backup that cannot be accessed during recovery is of limited use.
Do not share the recovery key with anyone who does not need authorized access. Microsoft support generally cannot recreate a key that was never backed up.

Troubleshooting

The backup option is missing. Confirm that BitLocker or Device Encryption is enabled and that you are looking at the correct drive. Some settings are unavailable on certain Windows editions, or are controlled by a work or school administrator. Search Windows Settings for Device Encryption or ask the device administrator for the approved backup method.

The save or print action fails. Check that the selected folder or USB drive is available and writable, or that the printer is connected. Choose a different secure destination if needed, then verify the new copy before closing the window. Do not delete an older usable backup until the replacement is confirmed.

You are already at a BitLocker recovery screen. Use another device to check the Microsoft account associated with the computer or locate the saved file or printout. Match the recovery-screen key ID to the ID associated with a backup, then enter the corresponding 48-digit key. If it is a managed device, contact your organization’s IT team. Do not guess repeatedly or reset the device before checking for a valid key, because resetting can remove data.

You cannot find the key in your account. Check any other Microsoft account that may have been used when encryption was enabled, along with USB drives, printed records, or backups made by an administrator. If no copy exists, contact the device manufacturer or your organization for device-specific guidance; a recovery key generally cannot be derived from the device’s serial number.

Frequently Asked Questions

Where does Windows save a BitLocker recovery key?

It depends on the choice made when the key was backed up. It may be in a Microsoft account, a file, a printout, or an organization-managed system. Check the relevant locations and match the key ID to your device.

Can I back up the key after BitLocker is already enabled?

Yes. Open Manage BitLocker and use the recovery-key backup option for the encrypted drive, or check Device Encryption settings where appropriate. If the option is unavailable, the device’s edition or administrator policy may limit what you can do.

Is it safe to save the recovery key to my Microsoft account?

It can be a convenient off-device backup, provided you protect the account and can access it from another device. Follow any workplace rules for managed computers, and avoid sharing account access or the key.

Does backing up the key turn off BitLocker?

No. Backing up creates or stores a copy of the recovery information; it does not disable drive encryption. Keep the key private because it can unlock the protected drive.

What if I lose the recovery key?

Look for copies in the account, files, printed records, and any organization-managed backup. If the drive requests recovery and no valid key is available, encrypted data may not be recoverable; do not erase or reset the device until you have checked every likely backup location.

Further reading: Microsoft Support. Details can change, so check the official page for anything that matters to you. Spotted a mistake? Tell us. How we write an answer.