BitLocker recovery key locations before repairing or resetting Windows computers

Checking Your Microsoft Account for the Recovery Key

A BitLocker recovery key is often stored automatically in your Microsoft account if you signed in with that account when encryption was turned on. You can check it from any other device by opening a browser and navigating to your Microsoft account’s recovery key page — the direct address is aka.ms/myrecoverykey — then signing in with the same email and password. Look for an entry that matches your device name or a specific key ID, then copy the key exactly as it appears, hyphens and dashes included, before proceeding with a repair or reset.

The BitLocker recovery screen displayed during startup shows a short Key ID that helps signal which stored key is the right one — take note of it before doing anything else, since it’s the only thing that tells you which of possibly several saved keys actually matches this drive. When several keys are listed in your account, compare the ID from the startup screen against the IDs you see there to avoid locking yourself out again with the wrong choice. No key showing up in your Microsoft account after this check means moving to another location rather than repeating the same steps.

Searching for a Printed or Saved Copy of the Key

When BitLocker was first activated, Windows gave you the option to print the recovery key or save it as a file. Many users stored it as a PDF, a text file, or on a separate USB drive. Check any printed documents kept near the computer, in a safe, or with essential paperwork. On the computer itself, folders like Documents, Downloads, or the Desktop may contain a file named something like “BitLocker Recovery Key” if the drive still works and lets you navigate to those locations. Search for such a file before risking changes through the repair process. A USB drive may hold the key if it was saved there; plug the drive in and open the file that refers to your device name or appears with a matching key ID.

That file will contain a string of 48 digits arranged in eight groups of six, along with the Key ID that identifies it. Match the Key ID in the file against the ID from the startup screen to confirm you are holding the correct key. No printed or saved version being located means do not attempt to guess or find an online generator for the code; those attempts will never work and may create further risk with your data remaining hidden.

Checking with Your Work or School IT Department

Computers issued by an employer, school, or similar organization often store BitLocker recovery keys under a central management setup rather than inside any personal Microsoft accounts. Systems such as Microsoft Entra ID (the current name for what used to be called Azure Active Directory) or on-premises Active Directory keep the recovery key separate from those issued via the user’s own credential. Contact the IT team directly with the Key ID exactly as the recovery screen shows it, and they can produce the matching 48-digit key during a phone call, within a written ticket, or through a secure online portal — often by looking it up in the Microsoft Intune console if the device is centrally managed.

Resetting, reinstalling, or otherwise tampering with a managed device before contacting the support channel risks leaving the drive permanently inaccessible. Organization policy typically expects key retrieval first, so inspect the log-on screen for work or school affiliation, or note any branding like “your organization manages this device” when Windows starts. That visible clue tells you the key is not in your personal account.

Using the Key ID to Match the Correct Recovery Key

It’s important to keep two separate things straight here, since mixing them up is one of the most common mistakes people make during an actual BitLocker lockout: the recovery key is the 48-digit number, grouped into eight sets of six digits, that actually unlocks the drive. The Key ID is a much shorter separate identifier — the recovery screen shows only its first 8 characters — whose only job is to tell you which of your saved keys matches this specific drive. Typing the Key ID into the box that’s asking for the recovery key will simply get rejected; they are not interchangeable, and the recovery screen itself only ever displays the short Key ID, never the full key.

Write down the full Key ID shown on screen, or take a clear photo with another device, before you close the recovery screen. Compare that ID against the IDs listed in your Microsoft account, your saved files, or the IT department’s records — only the entry whose Key ID matches will have the correct 48-digit key attached to it. This matters especially if you’ve owned several devices with the same device name, or reused a name across machines, since your Microsoft account will then list multiple keys that look similar at a glance and only the Key ID reliably tells them apart.

A matching key not being found after checking all common locations means do not proceed with a repair or reset that requires BitLocker to be turned off. Consider data recovery options through a professional service that supports BitLocker-encrypted drives. That decision is safer than attempting a repair without the key, which can result in permanent data loss. Saving or printing the recovery key immediately after turning on BitLocker helps avoid this situation in the future.