How to Regenerate Lost BitLocker Recovery Key
You are looking at a blue BitLocker recovery screen, or you just realised the recovery key you saved is nowhere to be found. The first thing to know is what is and is not possible. You cannot create a replacement recovery key while a drive stays locked: if you have no way in at all (no password, no copy of the key and no other working unlock method), the data is gone by design. But if you can still open the drive, or you can still sign in to Windows, you can make a new recovery key and retire the lost one. This guide covers both situations: finding a key that exists somewhere, and creating a fresh one while you still have access.
What a recovery key actually is
The recovery key (technically a recovery password) is a 48-digit number split into eight groups. It is a backup way in: BitLocker asks for it when the normal unlock method fails, for example after a forgotten password, a forgotten PIN, or a change to the boot configuration that the TPM does not trust. Each recovery key belongs to a specific drive and is identified by a key ID. When Windows shows the recovery screen, it displays the first 8 characters of that ID, and you can use it to pick the right key if you have several.
Part 1: Look for the key that already exists
Before generating anything, check the places BitLocker offers to store the key. Any of these may already hold it:
- Your Microsoft account. Sign in at aka.ms/myrecoverykey with the account you used when you set up the PC. If you backed the key up to your account, it is listed there with its key ID and the device name. Match the ID shown on the recovery screen.
- A work or school account. If the device was managed by an organisation, the key may be stored in Microsoft Entra ID or Active Directory. Try aka.ms/aadrecoverykey, or ask your IT team.
- A file. Search other drives and cloud folders for a text file named “BitLocker Recovery Key” followed by the key ID.
- A USB flash drive. The wizard can save the key there.
- A printout. Check wherever you keep device paperwork.
If you find it, enter it on the recovery screen, or on a locked data drive choose More options in the unlock prompt and use the recovery key instead of the password.
Part 2: Create a new recovery key while you still have access
If the old key is lost, or you think it has leaked, but the drive is still unlocked or Windows is running, you can replace it. You need an administrator account.
Prerequisite: the drive must be unlocked (for a data drive) or you must be signed in to the running Windows installation (for the C: drive). The keys are only ever changed from an unlocked state.
Method A: the graphical way, for backing up the key you already have
- Open Manage BitLocker from the Start menu, or go to Control Panel, System and Security, BitLocker Drive Encryption.
- If the drive is locked, choose Unlock drive and enter the password.
- Choose Back up your recovery key and pick where to save it: your Microsoft account, a file on another drive, or a printout.
Be clear about what this does. It saves another copy of the existing key. It does not create a new one. That is exactly what you want if the key is still valid and you merely lost your copy, but it does nothing if you believe the old key has leaked.
Method B: create a brand new key and remove the old one (PowerShell)
Open PowerShell as administrator. Replace E: with your drive letter.
# 1. See the current protectors and their IDs
(Get-BitLockerVolume -MountPoint "E:").KeyProtector
# 2. Add a new recovery password (this prints the new 48-digit key)
Add-BitLockerKeyProtector -MountPoint "E:" -RecoveryPasswordProtector
# 3. Copy the new key and back it up, then remove the OLD recovery password by its ID
Remove-BitLockerKeyProtector -MountPoint "E:" -KeyProtectorId "{OLD-KEY-PROTECTOR-ID}"- The first command lists every key protector on the drive. Each entry has a
KeyProtectorId(a GUID in braces) and a type. Recovery passwords have the typeRecoveryPassword, and theRecoveryPasswordproperty holds the 48 digits. Add-BitLockerKeyProtector ... -RecoveryPasswordProtectorcreates a new random 48-digit recovery password and adds it as an extra protector. It adds; it does not replace, so the old key keeps working until you remove it.Remove-BitLockerKeyProtector ... -KeyProtectorIddeletes one specific protector. Use the ID of the oldRecoveryPasswordentry; deleting a password or TPM protector by mistake removes a way into the drive.
The classic tool does the same job. manage-bde -protectors -get E: lists protectors with their IDs, manage-bde -protectors -add E: -RecoveryPassword adds a new recovery password, and manage-bde -protectors -delete E: -id {ID} removes one.
The moment the new key appears, copy it somewhere safe: your Microsoft account backup, a file on a different drive, and a printout kept away from the computer. Then run the list command again to confirm that exactly the protectors you expect are present.
Backing the new key up to your account or organisation
On a Microsoft Entra ID joined device, BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId "{ID}" stores the key in your organisation’s directory. On a domain-joined PC, Backup-BitLockerKeyProtector does the same for Active Directory. On a personal PC, use Method A and choose your Microsoft account.
What if the drive is locked and nothing works?
If the drive is locked, you have forgotten the password, you have no other working unlock method (a startup key, a TPM that still unlocks the system drive, or a data recovery agent in a managed setup), and you cannot find any copy of the recovery key in your Microsoft account, organisation, files, USB drives or printouts, there is no supported way to open it. BitLocker is built so that nobody, including Microsoft, can bypass it. The remaining option is to format the drive, which destroys the data, so treat that as a last step after you are certain the key is unrecoverable, and restore from your backup if you have one.
Avoid the situation next time
- Save the recovery key to your Microsoft account and to one offline location the moment you enable BitLocker. The setup steps are in how to enable BitLocker in Windows 10/11.
- Never store the recovery key on the drive it protects.
- Write down the key ID next to each stored copy, so you can match a key to a drive.
- Suspend BitLocker before BIOS or firmware updates, so a routine update does not send you to the recovery screen in the first place.
Common questions
Can I recover a BitLocker key from the drive itself?
Not from a locked drive. On an unlocked drive, or the running C: drive, an administrator can read the recovery password with manage-bde -protectors -get C: (use the right drive letter).
Is the key ID the same as the key?
No. The ID only identifies which key belongs to which drive. It is safe to note down; the 48 digits are the secret.
Will a new recovery key break my existing password?
No. Adding or removing a recovery password protector does not change the password or TPM protectors, as long as you remove only the protector you meant to.
Keep reading
- How to Enable BitLocker in Windows 10 and 11 (Step by Step) — Turn on BitLocker and store the key safely.
- Top 5 Windows Security Tips to Protect Your PC From Malware — More Windows protection basics.
- NTFS Explained: Features, Limits, Permissions and Repair — The file system BitLocker protects.
