# How to Enable BitLocker Drive Encryption in Windows 11

URL: https://www.mytechnician.tech/tips/enable-bitlocker-drive-encryption-windows-11/
Published: 2026-05-20 | Updated: 2026-08-07 | Author: Ankit Kumar
Tags: Windows 11, Security
Summary: Turn on BitLocker in Windows 11 Pro to encrypt C: and external drives—save your recovery key so a lost laptop doesn't mean lost data or a leak.

## The Problem
A stolen laptop with an unencrypted SSD is trivial to read—pull the drive, plug it into another PC, copy everything. **BitLocker** scrambles the whole volume so Windows only boots when the key is available (TPM + PIN, password, or recovery key). Home users on **Windows 11 Home** get **Device encryption** instead on many OEM PCs; this guide focuses on **BitLocker** in Pro/Enterprise/Education.

## Before You Start
* **Windows 11 Pro, Enterprise, or Education** (Home: check **Settings** → **Privacy & security** → **Device encryption** toggle).
* **TPM 2.0** enabled (most Windows 11 PCs already are—see [enable TPM for upgrade](https://www.mytechnician.tech/tips/enable-tpm-secure-boot-windows-11-upgrade/) if BIOS disabled it).
* Save the **recovery key** somewhere that is not only on the encrypted drive (Microsoft account, printout, employer portal).

## The Fix: Encrypt the System Drive (C:)

### Step 1: Open BitLocker Settings
1. **Settings** → **Privacy & security** → **Device encryption**, or search **Manage BitLocker**.
2. Or: `Win + R` → `control /name Microsoft.BitLockerDriveEncryption`.

### Step 2: Turn On BitLocker for C:
1. Click **C:** → **Turn on BitLocker**.
2. When prompted to save the recovery key, pick **Save to your Microsoft account** (personal PCs) or **Save to a file** on a USB stick you will store safely—not on C: itself.
3. Choose how to unlock at startup:
   * **TPM only** — seamless boot on trusted hardware (common on laptops).
   * **TPM + PIN** — stronger; you enter a PIN at boot.
   * **Password** — used more on PCs without TPM.

### Step 3: Choose Encryption Mode
* **New encryption mode** — faster on modern SSDs (AES-XTS).
* **Compatible mode** — only if you dual-boot older Windows or move the drive to odd hardware.

### Step 4: Run the Encryption
Choose **Encrypt used disk space only** for faster first run on a PC already in use, or **Encrypt entire drive** for new installs. Click **Start encrypting**—the PC remains usable; expect hours on large HDDs, less on SSDs.

## Encrypt a USB or External Drive
1. Insert the drive → File Explorer → right-click the drive → **Turn on BitLocker**.
2. Use a **password** or **smart card** (password is typical for USB sticks).
3. Save the recovery key the same way as for C:.

## Recovery Key: Do Not Lose It
* View keys: [https://account.microsoft.com/devices/recoverykey](https://account.microsoft.com/devices/recoverykey) (signed in with the same Microsoft account).
* After firmware/BIOS changes, Windows may ask for the 48-digit recovery key at boot—normal behavior.

## Suspend BitLocker for BIOS or Hardware Changes
**Manage BitLocker** → **Suspend protection** before motherboard swaps or major firmware updates, then **Resume** after booting successfully once.

## BitLocker vs Selling the PC
Encryption protects data in use; selling the machine still needs a full wipe—follow [wipe a PC before selling](https://www.mytechnician.tech/tips/wipe-pc-before-selling-donating/) and turn off BitLocker or let the reset remove keys as part of a factory reset.

## Being Asked for the Recovery Key at Every Boot?
A firmware update, a Secure Boot change, or new hardware makes the TPM refuse to release the key, so BitLocker falls back to asking you. That is a separate problem with its own fix—including where to find your key: [fix the BitLocker recovery key loop](https://www.mytechnician.tech/tips/fix-bitlocker-recovery-key-loop-windows-11/).

Encryption protects a stolen laptop; it does nothing against code running on a machine you are signed into. Pair it with [Core Isolation and Memory Integrity](https://www.mytechnician.tech/tips/enable-core-isolation-memory-integrity-windows-11/) and [LSA protection](https://www.mytechnician.tech/tips/enable-lsa-protection-credential-guard-windows-11/), which protect the running system and your stored credentials.

---
Source: https://www.mytechnician.tech/tips/enable-bitlocker-drive-encryption-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides.
More guides: https://www.mytechnician.tech/llms.txt