BitLocker Drive Encryption scrambles everything on a drive so that a lost or stolen laptop, or a removed disk, cannot be read without your sign-in or a recovery key. On Windows 11 Pro you can turn it on in a few minutes. The step that matters most is saving the 48-digit recovery key somewhere you can reach when the PC will not unlock.
| Option | Windows 11 Home | Windows 11 Pro |
|---|---|---|
| Device encryption (automatic, supported hardware) | Yes | Yes |
| BitLocker Drive Encryption (choose drives, manage keys) | No | Yes |
| BitLocker To Go for USB drives | No | Yes |
| Manage BitLocker in Control Panel | No | Yes |
| Recovery key backup options | Linked to your account | Account, USB, file or print |
Is BitLocker available on Windows 11 Home or only Pro?
BitLocker Drive Encryption is available only on Windows 11 Pro, Enterprise and Education editions, not on Windows 11 Home, which offers device encryption instead: it automatically encrypts the system drive on supported hardware when you sign in with a Microsoft account, but without the controls to choose drives and protectors.
Microsoft's BitLocker Drive Encryption support page states that if Manage BitLocker does not appear in Start search, the PC is not running the correct edition. Device encryption appears under Settings > Privacy & security > Device encryption when the hardware supports it.
If you need full BitLocker on a Home PC, the edition upgrade keeps your files and apps; our Windows 11 Pro vs Home comparison lists the other features you gain, and a Windows 11 Home to Pro upgrade key unlocks them without reinstalling.
What do you need before turning on BitLocker?
Before turning on BitLocker you need Windows 11 Pro or higher, an administrator account, a Trusted Platform Module (TPM), which Windows 11 requires in version 2.0 on supported PCs, and a safe place for the recovery key, such as your Microsoft account, a USB drive or a printed copy.
Cause and effect: the TPM stores the encryption key and checks that the start-up files have not been altered while the PC was off. If the firmware, boot order or motherboard changes, the TPM refuses to release the key and Windows asks for the recovery key instead.
Advanced nuance: Microsoft states that BitLocker can encrypt the system drive on a device without a TPM, but a startup key on a removable drive then becomes mandatory and there is no pre-boot integrity check. On Windows 11 this mainly matters for virtual machines without a virtual TPM. To check your TPM, see our guide to Windows 11 requirements, TPM 2.0 and Secure Boot.
How do you turn on BitLocker in Windows 11 Pro?
To turn on BitLocker in Windows 11 Pro, sign in as an administrator, type BitLocker in Start search and open Manage BitLocker, select Turn on BitLocker next to the operating system drive, back up the recovery key, choose how much of the drive to encrypt, and start encryption. You can keep working while it runs.
- Sign in with an administrator account.
- Select Start, type BitLocker and choose Manage BitLocker.
- Next to the operating system drive (usually C:), select Turn on BitLocker.
- Choose where to back up the recovery key: Microsoft account, USB flash drive, file or print. Use at least two.
- Choose to encrypt used disk space only or the entire drive.
- Start encryption and, if asked, restart so Windows can run the system check.
Microsoft's BitLocker FAQ notes that encrypting used space only can be considerably faster on a new drive, and that new data is encrypted as it is saved. On a drive that previously held sensitive files, encrypting the entire drive also covers deleted data that may still be recoverable.
What we commonly see: users close the laptop lid during encryption and worry the drive is damaged. Microsoft states that encryption resumes where it stopped the next time Windows starts.
Where should you save the BitLocker recovery key?
Save the BitLocker recovery key in at least two places that are separate from the encrypted PC, for example your Microsoft account plus a printed copy or a USB drive kept elsewhere, because Microsoft states that its support staff cannot retrieve, provide or recreate a lost recovery key for you.
- Microsoft account: the key is saved to the recovery keys library of your account. Work or school PCs may save it to the organisation's account instead.
- USB flash drive: the key file is only a few kilobytes. Microsoft warns not to store this USB drive with the computer.
- File: saved as plain text. It cannot be saved to the drive being encrypted.
- Print: keep the printout with other important device papers.
You can create another backup at any time from Manage BitLocker by selecting Back up your recovery key next to the drive, as described on Microsoft's back up your BitLocker recovery key page.
How do you find your BitLocker recovery key?
To find your BitLocker recovery key, note the first eight characters of the key ID on the recovery screen, then sign in at aka.ms/myrecoverykey from another device with the Microsoft account used on the PC and match the key ID. If the key is not there, check your printout, USB drive or saved text file.
For PCs signed in with a work or school account, Microsoft points to aka.ms/aadrecoverykey, or the organisation's IT department. Microsoft also notes that since Windows 11 version 24H2 the recovery screen shows a hint of the Microsoft account associated with the key, which helps when a family member set up the PC.
Advanced nuance: if the key cannot be found and the change that triggered recovery cannot be undone, Microsoft's guidance is to reset the device, which removes all files. This is why backups of the key and of your data matter as much as encryption itself.
How do you encrypt a USB drive with BitLocker To Go?
To encrypt a USB drive, connect it, open Manage BitLocker, find it under Removable data drives - BitLocker To Go, select Turn on BitLocker, choose a password to unlock it, back up its recovery key and start encryption, after which the drive asks for that password whenever it is connected to a Windows PC.
BitLocker To Go is part of Windows 11 Pro and higher editions. It is useful for carrying client files or backups, because a lost encrypted USB drive does not expose its contents.
What we commonly see: users encrypt a USB drive used for backups and then lose the password. The drive's recovery key is separate from the system drive's key, so back it up as well.
How do you check BitLocker status in Windows 11?
To check BitLocker status, open Manage BitLocker to see whether each drive shows BitLocker on or off, or open Command Prompt as administrator and run manage-bde -status, which lists every drive with its conversion status, percentage encrypted, encryption method, protection status, lock status and key protectors in one report.
Microsoft documents the syntax on its manage-bde status reference; manage-bde -status C: shows only drive C. A "Protection Off" status with the drive fully encrypted usually means BitLocker is suspended.
Advanced nuance: suspending BitLocker keeps the data encrypted but stores a clear key temporarily, which allows firmware or hardware changes without a recovery prompt. Microsoft explains that protection is resealed when BitLocker is resumed, so resume it as soon as the update is finished.
Frequently asked questions
Does BitLocker slow down Windows 11?
On modern PCs, BitLocker usually has little noticeable effect on everyday speed, because encryption and decryption happen as data is read and written rather than all at once. The first encryption pass takes time and uses the drive in the background. You can keep working while it runs.
Will I lose data if I turn on BitLocker?
Turning on BitLocker encrypts data in place and does not delete files. The real risk is losing access later if Windows asks for the recovery key and you do not have it. Back up the 48-digit key in two separate places, and keep a normal backup of important files as well.
Why is BitLocker asking for a recovery key?
BitLocker asks for the recovery key when it detects a possible security risk or hardware change, such as a firmware update, boot order change or new motherboard. Microsoft notes that a changed boot order can trigger the prompt. Enter the key from your Microsoft account or backup, and Windows starts normally.
Can I turn off BitLocker later?
Yes, open Manage BitLocker and select Turn off BitLocker next to the drive, which fully decrypts it. Decryption takes time, like encryption, and the PC stays usable. If you only need to install a firmware update or change hardware, suspending protection is quicker than decrypting.
Do I need Windows 11 Pro to use BitLocker on a USB drive?
To encrypt a USB drive with BitLocker To Go, you need Windows 11 Pro, Enterprise or Education, because Manage BitLocker is not available on Home. Plan where the drive will be used before encrypting it, and keep its recovery key backed up separately from the drive itself.