How to Turn On BitLocker on Windows

BitLocker is a built-in Windows encryption tool that protects your data by scrambling the entire drive. If your laptop or PC is lost or stolen, an encrypted drive keeps your files unreadable without the recovery key. This guide walks you through enabling BitLocker on a Windows 10 or Windows 11 Pro, Enterprise, or Education edition. You’ll need an administrator account and, on most systems, a Trusted Platform Module (TPM) chip—though you can enable it without one using a Group Policy tweak (covered below).

What You’ll Need

A Windows edition that supports BitLocker: Pro, Enterprise, or Education. Home edition does not have BitLocker.
Administrator rights on the computer.
A TPM chip (version 1.2 or later) on most systems. If you don’t have one, you can still use BitLocker with a startup USB key (see Step 5).
A way to save your recovery key: a USB flash drive, a file on another device, or a printed copy.
For encrypting an external drive, the drive must be formatted with NTFS, FAT32, or exFAT.

Step-by-Step

Check your Windows edition. Press Win + R, type winver, and press Enter. The window shows your edition. If it says “Home,” BitLocker isn’t available—you’d need to upgrade to Pro or Enterprise.
Open Control Panel. Click the Start button, type Control Panel, and press Enter. Then go to System and Security > BitLocker Drive Encryption. Alternatively, search for “Manage BitLocker” in the Start menu.
Choose the drive. In the BitLocker window, you’ll see your drives. Click Turn on BitLocker next to the drive you want to encrypt (usually the C: drive).
Set up how to unlock the drive at startup. If your PC has a TPM, you’ll see options like “Enter a PIN” or “Insert a USB flash drive.” Choose a method and follow the prompts. If you don’t see these options, your TPM may be disabled or missing—see Troubleshooting below.
Save your recovery key. Windows will ask how you want to back up the recovery key. Choose one or more options: save to a Microsoft account, save to a file (on a different drive), or print it. This key is your only way to access the drive if you forget your password or the system changes. Store it somewhere safe, not on the encrypted drive itself.
Choose how much of the drive to encrypt. You’ll see two options: “Encrypt used disk space only” (faster, recommended for new PCs) or “Encrypt entire drive” (slower but more thorough, good for drives that already have data). Pick the one that fits your situation.
Select the encryption mode. For a fixed drive (like your internal C:), choose “Compatible mode” (default). For a removable drive, choose “Compatible mode” if you’ll use it with older Windows versions, or “New encryption mode” for best security on Windows 10/11 only.
Run the BitLocker system check. If encrypting the system drive, Windows will ask you to restart. Check the box “Run BitLocker system check” and click Continue. This ensures the computer can read the encryption keys at startup.
Restart and start encryption. After the restart, Windows will boot and begin encrypting. You can keep working while it encrypts, but the process may slow down your system. You’ll see a BitLocker icon in the system tray showing progress.
Confirm it’s on. Once encryption finishes (it can take minutes to hours), open the BitLocker Drive Encryption panel again. The drive should show “BitLocker on.”

Common Mistakes

Saving the recovery key on the same drive. If you save the key file to the C: drive you’re encrypting, it becomes useless. Always save to another drive, a cloud account, or print it.
Forgetting your PIN or password. If you set a PIN, you need it every time you boot. If you forget it, you’ll need the recovery key. Make sure you remember both.
Encrypting a full drive when not needed. Encrypting used space only is faster and perfectly secure for new drives. Encrypting everything takes much longer but is required if the drive previously had deleted files you want to ensure can’t be recovered.
Disabling TPM in BIOS. Many motherboards have TPM turned off by default. If BitLocker says “Compatible TPM cannot be found,” you need to enable it in the BIOS/UEFI. See Troubleshooting.
Interrupting encryption. Don’t force shutdown or unplug the drive during encryption. If interrupted, Windows will resume on next boot, but it can cause errors.

Tips

Use a PIN for extra security. Even with TPM, adding a PIN means someone with your laptop can’t boot it without the PIN, even if they remove the drive and put it in another machine.
Back up your recovery key in multiple places. Save it to your Microsoft account, a USB drive, and a printed copy. You’ll thank yourself later.
Encrypt external drives too. BitLocker To Go works on USB drives. Right-click the drive in File Explorer and select “Turn on BitLocker.”
Check if your PC supports “Device Encryption.” Some Windows 11 Home devices have a lighter version called Device Encryption. If you have it, you can turn it on in Settings > Privacy & Security > Device encryption, even on Home edition.
Use BitLocker with a Microsoft account. If you sign in with a Microsoft account, the recovery key is automatically backed up to your account, making recovery easier.

Troubleshooting

“Compatible TPM cannot be found.” This means your TPM is disabled or not present. Restart your PC, enter BIOS/UEFI (usually by pressing Del, F2, or F12 during boot), find the Security or Trusted Computing section, and enable TPM (often called “Intel PTT” or “AMD fTPM”). Save and exit. Then try BitLocker again.
“BitLocker requires a recovery key” at startup. If Windows asks for a recovery key unexpectedly, you may have changed hardware, BIOS settings, or the boot configuration. Enter the 48-digit recovery key you saved. If you don’t have it, you may lose access to the drive.
BitLocker is grayed out. If the “Turn on BitLocker” option is grayed out, your drive may be too small (needs at least 2 GB), not formatted with NTFS, or you’re not running as administrator. Right-click the drive in File Explorer, choose Format, and select NTFS (back up data first).
Encryption is stuck at a percentage. This can happen if the drive is in use. Close all programs, and try restarting. Windows will resume encryption. If it stays stuck for hours, check the Event Viewer for errors, but usually it’s just slow on large drives.
You don’t have BitLocker on Home. As mentioned, Home doesn’t include BitLocker. You can either upgrade to Pro, or use a third-party encryption tool like VeraCrypt (open-source).
Forgot your PIN? You can use the recovery key to get back in. Once booted, you can disable the PIN or reset it. If you lost the recovery key too, there’s no way to recover the data—this is why backups are critical.

Frequently Asked Questions

Is BitLocker available on Windows 10 Home?

No. BitLocker is only on Pro, Enterprise, and Education editions. Windows 10 Home has “Device Encryption” on some devices, but it’s not the full BitLocker.

Does BitLocker slow down my computer?

There’s a slight performance impact, especially during encryption and on older hardware. Modern CPUs with AES-NI acceleration handle it well, and the slowdown is usually negligible for everyday use.

Can I turn off BitLocker later?

Yes. Open the BitLocker panel and click “Turn off BitLocker.” It will decrypt the drive, which may take a while. Your data stays intact.

What happens if I lose my recovery key?

If you lose the recovery key and forget your password/PIN, there is no way to access the drive. The data is permanently encrypted. Always keep multiple copies of the key.

Can I encrypt only a folder or file?

BitLocker encrypts entire drives, not individual folders. For single files, you can use the Encrypting File System (EFS) on NTFS drives, but it’s less common.

Does BitLocker work on external hard drives?

Yes, it’s called BitLocker To Go. You can encrypt USB drives and external HDDs. The drive will require a password or smart card to unlock on another computer.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →