US How BitLocker works
BitLocker is Microsoft’s full-volume encryption feature for Windows. It encrypts every sector of a drive, including the operating system, applications, page file and free space, so someone who removes the drive or boots the computer from other media sees only scrambled data. It first appeared in Windows Vista and is now part of the business editions of Windows 10 and 11.
The data is encrypted with AES. Since Windows 10 version 1511, fixed drives use XTS-AES with a 128-bit key by default, and 256-bit can be chosen through policy. Encryption and decryption happen on the fly as data is read and written, so applications do not notice it, and on current processors with AES instructions the effect on speed is usually small.
The key that encrypts the drive is itself locked by one or more key protectors. Windows can only unlock the drive at start-up if a protector releases that key.
Some SSDs can encrypt data in their own controller, and BitLocker once handed the work to them by default. After flaws were found in several drives’ hardware encryption in 2018, Microsoft changed the default in 2019 so that BitLocker encrypts in software unless policy says otherwise. Drives encrypted before that change keep their original method until BitLocker is turned off and on again.
BitLocker and TPM
On most computers the main protector is the TPM. During start-up the TPM records a measurement of each stage, from the firmware to the boot manager, and releases the BitLocker key only if the measurements match those taken when BitLocker was turned on. That ties the drive to that computer and to an unchanged boot chain. It works alongside Secure Boot, which checks the signature of each boot file.
-
//
TPM only. The drive unlocks automatically at start-up. Nothing to type, so it suits computers that must start unattended.
-
//
TPM and PIN. The user enters a PIN before Windows loads. Stronger against a stolen laptop or tablet, but someone has to be present at every start.
-
//
TPM and startup key. A USB drive holding a key must be inserted at start-up.
-
//
Recovery password. A 48-digit number, kept outside the computer, that unlocks the drive when the other protectors fail.
Which Windows editions include BitLocker
BitLocker is not in every edition of Windows. Home editions get a simpler feature called device encryption on supported hardware.
| Edition | BitLocker management | BitLocker To Go | Notes |
|---|---|---|---|
| Windows 10 and 11 Home | No | No (can unlock drives) | Device encryption on supported hardware, few settings |
| Windows 10 and 11 Pro | Yes | Yes | Full control panel and manage-bde tools |
| Enterprise and Education | Yes | Yes | Adds central management and network unlock |
| Windows 10 and 11 IoT Enterprise | Yes | Yes | Enterprise features, including LTSC releases, for fixed-purpose devices |
| Windows Server | Yes, as an optional feature | Yes | Installed through Server Manager or PowerShell |
BitLocker To Go is the version for removable drives such as USB sticks and SD cards. A drive encrypted with it can be unlocked with a password on most Windows editions.
Why BitLocker asks for a recovery key
The recovery screen appears when the TPM sees something different at start-up and refuses to release the key. That is BitLocker working as designed, but it can stop a computer at an unattended site. Common triggers are:
-
//
Firmware changes. A BIOS or UEFI update, a change to Secure Boot or a change to the boot order alters the measurements. Suspend BitLocker before a planned update to the UEFI firmware and it resumes after the next restart.
-
//
TPM changes. Clearing the TPM, or resetting the firmware settings that control it, removes the stored key.
-
//
Hardware changes. Moving the drive to another computer, or replacing the motherboard, means the original TPM is no longer there.
-
//
Wrong PIN. Too many incorrect PIN attempts trigger the TPM’s lockout.
BitLocker on industrial computers
Industrial PCs in kiosks, cabinets and vehicles are easier to steal or tamper with than office PCs, so disk encryption is often required by the site’s security policy. Most current industrial PCs and boards include TPM 2.0, and our Windows IoT Enterprise industrial PCs run an edition that includes BitLocker. Our guide to Windows 11 IoT Enterprise and Pro editions covers the hardware requirements.
Two decisions matter most. The first is the protector: TPM only lets an unattended system restart after a power cut, while TPM and PIN suits a handheld or a vehicle terminal with an operator. The second is where the recovery keys are kept. Keys can be backed up to a Microsoft account, Active Directory or Microsoft Entra ID, or recorded per serial number for offline sites. Encryption also helps at the end of life, because a drive that was always encrypted is far easier to erase securely.
Quick answers on BitLocker
BitLocker: common questions
What does BitLocker do?
It encrypts a whole drive. Without the key, the data on the drive cannot be read, even if the drive is taken out and connected to another computer.
What is a BitLocker recovery key?
A 48-digit backup password. It unlocks the drive when the TPM or PIN cannot, for example after a firmware change. It is shown with a key ID, which identifies the matching key when several are stored.
Does BitLocker need a TPM?
Not strictly, but it is the normal set-up. Without a TPM, group policy can allow a password or USB startup key instead, but the drive is then not tied to the computer’s boot chain.
Is BitLocker open source?
No. It is proprietary Microsoft software. Linux tools such as cryptsetup can open BitLocker drives, but cannot create them.
Should I turn off BitLocker?
Usually not. Turning it off decrypts the drive and leaves the data readable if the computer is lost. To update firmware, suspend it instead and it turns itself back on.
We image Windows IoT Enterprise on the industrial PCs we supply and set up TPM, Secure Boot and BitLocker to the site’s policy as standard, recording recovery keys against each serial number before the system ships. Tell us how the system will start and who can reach it, and we will choose the protector to match.