Windows · Privacy & Security
Encrypt Your Drive with Device Encryption
Device Encryption (built on BitLocker technology) encrypts your entire system drive so its contents are unreadable to anyone without your Windows sign-in credentials or a separate recovery key, even if the physical drive is removed and connected to another PC. It's automatically available on many modern PCs that meet specific hardware requirements, and can be extended to additional drives on Pro, Enterprise, and Education editions.
How to open BitLocker Device Encryption
- Open Settings → Privacy & Security → Device encryption.
- Check whether encryption is already on, since many PCs enable it automatically.
- Turn it on if available and sign in with a Microsoft account when prompted.
- Verify your recovery key is saved by checking account.microsoft.com/devices.
What you should know
- Check whether Device Encryption is already on for your system drive, since many newer PCs enable it automatically during setup.
- Turn on Device Encryption manually if it's available but currently off, which requires signing in with a Microsoft account.
- Your recovery key is automatically saved to your Microsoft account online, letting you retrieve it if you're ever locked out.
- Pro, Enterprise, and Education editions can additionally use the full BitLocker Drive Encryption Control Panel tool to encrypt removable and secondary drives with more configuration options.
Losing access to your recovery key while also being locked out of your Microsoft account can mean permanently losing access to your encrypted data — save or print your recovery key somewhere separate from the PC itself as a backup.
Why it matters
Device Encryption protects your data from a real and common risk: a lost or stolen laptop, where an unencrypted drive lets anyone with physical access simply remove it and read your files on another machine. Because encryption happens transparently in the background once enabled, it costs you essentially nothing in daily convenience while closing a genuine security gap. For anyone storing sensitive personal or work data on a portable device, having this on is one of the highest-value, lowest-effort security decisions available in Windows.
Best practices
- Confirm your recovery key is actually saved to your Microsoft account (or printed/saved elsewhere) before relying on Device Encryption being fully protective.
- Enable Device Encryption on every portable device that holds sensitive files, not just your primary daily-use laptop.
- Keep your Microsoft account credentials secure and recoverable, since losing access to that account can complicate retrieving your recovery key later.
- Use the full BitLocker Control Panel tool on Pro, Enterprise, or Education editions if you need to encrypt a removable USB drive or a secondary internal disk.
- Avoid disabling Device Encryption temporarily for unrelated troubleshooting unless specifically instructed to, since re-encryption takes time to complete afterward.
Common problems and fixes
- Windows asks for a recovery key unexpectedly at startup.
- This is usually triggered by a significant hardware or firmware change (like a BIOS update); retrieve your recovery key from your Microsoft account's device page at account.microsoft.com to unlock the drive.
- Device Encryption option doesn't appear in Settings at all.
- Your specific hardware may not meet Device Encryption's requirements (like Modern Standby or a TPM 2.0 chip); check if your edition supports the full BitLocker Control Panel tool instead, which has broader hardware compatibility.
- You're not sure whether your drive is actually encrypted.
- Check Settings → Privacy & Security → Device encryption for its current status, or run 'manage-bde -status' in an elevated Command Prompt for a detailed per-drive breakdown.
Tips and tricks
- Visit account.microsoft.com/devices to check or retrieve saved BitLocker recovery keys for any of your devices from another computer or phone.
- Run 'manage-bde -status' in an elevated Command Prompt for a detailed technical view of encryption status beyond what the Settings page shows.
Frequently asked questions
What's the difference between Device Encryption and full BitLocker?
Device Encryption is a simplified, automatically-managed version available on more editions and hardware configurations, while full BitLocker (Pro, Enterprise, Education) offers more granular control, including encrypting removable drives and choosing specific encryption methods.
Does encryption slow down my PC noticeably?
On modern hardware with built-in encryption acceleration, the performance impact is generally negligible for everyday use.
What happens to my recovery key if I sell or give away my PC?
You should decrypt the drive or fully reset the PC beforehand, since your recovery key remains tied to your Microsoft account and the new owner won't have legitimate access to your encrypted data anyway.
Related settings
- Windows SecurityWindows Security is the built-in protection center for virus & threat protection, firewall & network protection, and device health. It runs Microsoft Defender Antivirus and lets you review recent scans and threats.
- ActivationActivation shows whether your copy of Windows is genuinely licensed and linked to your hardware or Microsoft account, which edition you're running, and lets you enter a new product key or upgrade to a different edition, like from Home to Pro. A properly activated Windows unlocks full personalization options and removes the persistent activation watermark.
- Storage SettingsStorage Settings let you view how much disk space is being used by apps, system files, temporary files, and media. You can free up space automatically using Storage Sense or manually remove unwanted files.
More Privacy & Security guides for Windows
- Camera PermissionCamera Permission controls which applications are allowed to access your device's camera. Managing these permissions helps protect your privacy and ensures that only trusted applications can capture video or images.
- Microphone PermissionMicrophone Permission lets you control which applications can use your device's microphone. This is essential for maintaining privacy and preventing unauthorized audio recording by untrusted software.
- Privacy & SecurityPrivacy & Security is the central hub introduced in Windows 11 that groups Windows Security (antivirus and firewall), sign-in options, app permissions, and general privacy controls like diagnostic data and activity history into one settings category. It's the starting point for auditing everything related to your PC's security and data posture in one place.
- App PermissionsApp Permissions organizes privacy controls by capability rather than by app, letting you see at a glance which installed apps can access location, contacts, calendar, file system, and a dozen other data types. Instead of checking each app individually, you pick a permission type and review every app that has requested it.
- Location PrivacyManages whether Windows and individual apps can access your device's location, including the master location toggle and per-app permissions for location data.
- Diagnostics & FeedbackControls how much diagnostic and usage data your device sends to Microsoft, along with feedback frequency, tailored experiences, and options to view or delete diagnostic data.