The Problem

You power on and get a blue BitLocker recovery screen asking for a 48-digit key instead of your desktop. You find the key, type it in, Windows starts — and the next boot asks again.

BitLocker seals its decryption key inside the TPM chip, and the TPM only releases it when the boot environment measures exactly as it did when encryption was switched on. Change anything in that measurement and the TPM refuses, so BitLocker falls back to asking a human. Common triggers: a BIOS or firmware update, toggling Secure Boot or CSM, changing the boot order, adding or removing hardware, docking or undocking, a flat CMOS battery, or a Windows update that touched the boot manager.

Windows 11 also turns on device encryption automatically on many machines during setup, so plenty of people meet this screen without ever having chosen to use BitLocker.

Be clear about one thing before you start: there is no way to bypass this screen without the recovery key. Microsoft cannot recover it for you, and neither can anyone else. The key exists in one of the places in Step 1 or it does not exist at all — so work through that list carefully.

Symptoms

A blue "Enter the recovery key to get going again" screen at every boot.
A Key ID shown on screen — the first eight characters of the identifier you need to match.
Prompts started right after a BIOS update, a hardware change, or a Windows update.
The same key works each time, but the prompt keeps coming back.

Step 1: Find Your Recovery Key

Note the Key ID shown on the recovery screen first — if more than one key is stored, that is how you pick the right one.

Microsoft account — on a phone or another PC, go to account.microsoft.com/devices/recoverykey and sign in with the same account used on the locked PC. This is where personal machines almost always have it.
Work or school account — sign in at myaccount.microsoft.com, open Devices, find the PC, and choose View BitLocker keys. Your IT team can also retrieve it.
Printed or saved — check for a printout, or a BitLocker Recovery Key <ID>.txt file on a USB stick or in your OneDrive files.
Another PC signed into the same account — open Terminal (Admin) there and run manage-bde -protectors -get C: for keys stored locally.
Type the 48 digits carefully. The screen accepts them in groups; the hyphens are added for you.

Step 2: Check Whether the Drive Is Even Meant to Be Encrypted

Once you are back in Windows, find out what is actually enabled.

Right-click Start → Terminal (Admin).
Run:
```
manage-bde -status
```
Read Conversion Status and Protection Status for each volume. Protection On means BitLocker is active.
Also check Settings → Privacy & security → Device encryption. If that toggle exists and is on, this is automatic device encryption rather than BitLocker you configured.
Background on the feature: enable BitLocker drive encryption.

Step 3: Save a Fresh Copy of the Key Somewhere You Control

Do this before changing anything else. If a later step goes wrong, this is what gets you back in.

Settings → Privacy & security → Device encryption → BitLocker drive encryption → Back up your recovery key.
Save it to your Microsoft account and to a printout or a file on a different device.
Or from Terminal (Admin):
```
manage-bde -protectors -get C:
```
Copy the full 48-digit Numerical Password and the ID beside it.
Do not store the only copy on the encrypted drive itself — you cannot read it when locked out.
Somewhere safe means an actual password manager: use a password manager safely.

Step 4: Reseal the Key to the Current Boot State

This is the fix for a loop caused by a legitimate change you have already made. Turning protection off and on again re-measures the boot environment and stores a fresh seal in the TPM — it does not decrypt the drive.

In Terminal (Admin):
```
manage-bde -protectors -disable C:
```
Reboot to confirm it starts without prompting.
Turn protection back on:
```
manage-bde -protectors -enable C:
```
Reboot again. The prompt should now be gone.
Check with manage-bde -status that Protection Status reads Protection On — if you stop after step 1, the drive stays encrypted but unprotected.

Step 5: Undo the Firmware Change That Triggered It

Enter firmware setup: how to enter BIOS or UEFI.
Confirm Secure Boot is Enabled and CSM / Legacy Support is Disabled — matching how Windows 11 was installed. See enable TPM and Secure Boot.
Confirm the TPM is enabled and set to the same mode as before (fTPM/PTT on, not cleared).
Put the boot order back with Windows Boot Manager first.
If the PC keeps losing these settings between boots, the CMOS battery is flat — replacing it stops the loop.

Step 6: Suspend BitLocker Before Future Firmware Updates

This is the habit that prevents the whole problem returning.

Before a BIOS update, a TPM firmware update, or a motherboard change, run:
```
manage-bde -protectors -disable C: -RebootCount 2
```
-RebootCount 2 suspends protection for the next two restarts and then re-enables it automatically — no need to remember.
Or use the graphical route: Control Panel → BitLocker Drive Encryption → Suspend protection.
Do the same before enabling or disabling Secure Boot, or clearing the TPM.
Keep the machine updated in a controlled way: keep your devices updated safely.

Step 7: Check the TPM Is Healthy

Windows + R → tpm.msc → Enter.
Status should read "The TPM is ready for use". If it reports the TPM is not found, the firmware setting was turned off — go back to Step 5.
Confirm the Specification Version is 2.0, which Windows 11 requires.
⚠️ Do not use "Clear TPM" while BitLocker is on. Clearing the TPM destroys the sealed key, and the only way back in is the 48-digit recovery key. If you must clear it, first fully decrypt the drive or suspend protection with Step 6 and confirm you have the recovery key saved elsewhere.

Step 8: Decide Whether to Keep Encryption On

If the PC is a laptop or leaves the house, keep it on. Encryption is what makes a stolen machine useless to the thief.
If you decide to turn it off entirely, run:
```
manage-bde -off C:
```
Decryption runs in the background and can take hours. Keep the PC plugged in and let it finish.
Check progress with manage-bde -status until Conversion Status reads Fully Decrypted.
Consider re-enabling it afterwards with the key backed up properly: enable BitLocker drive encryption.
Either way, keep real backups — encryption protects against theft, not against drive failure: set up automatic backups.

What Not to Do

Don't clear the TPM to "reset" the prompt. It permanently destroys the sealed key and locks you out unless you have the 48 digits.
Don't run BitLocker "recovery key generators" or "bypass tools". None of them work; the encryption is sound. They exist to install malware on people who are locked out and desperate.
Don't leave protection suspended after a firmware update. manage-bde -status showing Protection Off means the drive is encrypted but the key is stored unprotected.
Don't store the recovery key only on the encrypted machine. It is unreadable exactly when you need it.

Still Not Working?

If you genuinely cannot locate the key in any of the Step 1 locations, the data on that drive is not recoverable — that is by design. The remaining path is a clean install, which erases the drive: how to clean install Windows 11. Before doing that, check every Microsoft account you have ever used on the machine, and any work account, since the key is stored per-account.

How to Fix the BitLocker Recovery Key Loop in Windows 11