How to find your BitLocker recovery key. It was almost certainly saved somewhere when BitLocker was switched on. Here is everywhere to look.

1. Your personal Microsoft account (the most common place). If this is a home laptop, and especially a Windows Home machine, Windows most likely turned on Device Encryption automatically and escrowed the key to the Microsoft account you signed in with. From any device, go to account.microsoft.com/devices/recoverykey (or the short link aka.ms/myrecoverykey), sign in, and you will see the recovery keys stored against your devices. Match the key ID on your recovery screen to the one shown online. The single most common reason people do not find it here is that they try the wrong Microsoft account, so try every account you or your household might have used to set the machine up, including an old email address.

2. Your work or school account, in Microsoft Entra ID. If the machine belongs to an employer or a school, the key is almost certainly escrowed in the organisation's Microsoft Entra ID (formerly Azure AD). You can look at aka.ms/aadrecoverykey, signing in with your work or school account, and view the BitLocker keys stored against your device; or, more usually, your IT department or administrator reads it out for you. This is the quickest route for a company laptop.

3. On-premises Active Directory (for a traditional company domain). Many organisations store the key in on-premises Active Directory, against the computer object, as the msFVE-RecoveryPassword attribute. Your IT department reads it with the BitLocker Recovery Password Viewer in Active Directory Users and Computers, or with PowerShell, matching the key ID on your screen to the record. You will not do this yourself; ask IT.

4. Intune or MBAM (for managed devices). If your device is managed with Microsoft Intune, the recovery key is visible to administrators in the device's properties in the Intune admin centre. Older managed estates use MBAM, Microsoft BitLocker Administration and Monitoring, which stores keys centrally and issues single-use keys, so a key that worked before will have expired and your administrator retrieves the current one. Again, this is a job for IT.

5. A printout, a saved text file, or a USB key file. When BitLocker is turned on manually, it offers to print the key, save it to a text file, or save it to a USB stick as a small key file. So check: any printout filed with your important papers; a file named something like BitLocker Recovery Key.txt on a USB stick, another drive, or in your cloud storage; and a .BEK file on a USB stick. People who deliberately enabled BitLocker often saved it this way and forgot.

How the key ID helps.

The blue recovery screen shows a key ID, the first eight characters of the identifier for the key that particular drive needs. If you have several encrypted devices, or several keys in your Microsoft account, this is how you tell which key is the right one: find the stored key whose ID begins with those same eight characters. A key whose ID does not match will be refused no matter how carefully you type it, so always check the ID first.

What if it is not in any of these places?

Then it may never have been escrowed, which happens most often when a machine was signed in with a local account rather than a Microsoft account when it encrypted, or when the Microsoft account it used has since been deleted. Microsoft is explicit that it cannot access or reset a lost BitLocker recovery key; there is no master key and no backdoor. At that point, whether your data can be recovered depends on what else is true about the drive, a weak password that can be attacked, or a memory capture if the machine is still running, and for a modern AES-256 drive with none of those, the honest answer is that it cannot be recovered. The lost-key page and the when-it-cannot-be-recovered page explain this honestly, and we assess it free.