BitLocker is Microsoft’s built-in full volume encryption for Windows that protects data by converting entire drives into unreadable form unless the correct keys are present. It works with a computer’s Trusted Platform Module (TPM) chip to store cryptographic keys and unlock the drive at start-up, and it can require extra factors like a PIN on capable devices. BitLocker can encrypt operating system drives, fixed data drives and removable media through BitLocker To Go for USB sticks and external disks. If Windows cannot unlock a drive automatically, a 48-digit recovery key is used, which you can save to a file, print, or back up to a Microsoft account, Active Directory or Microsoft Entra ID. You manage BitLocker through the Windows Settings or Control Panel, with advanced control via manage-bde and PowerShell, and at scale through Group Policy or Intune. On some Home edition laptops a lighter Device Encryption feature is available, which applies similar protection when the hardware supports it.
