How do I recover a BitLocker partition when the recovery key prompt loops forever?

Your computer shows the blue BitLocker recovery screen and asks for a 48-digit key. You type it correctly, the machine restarts — and asks again. This loop is frightening because your files are on the drive, locked behind a prompt that never seems satisfied.

The loop has real causes, and most are fixable without wiping the drive.

Quick Answer

A looping BitLocker prompt usually means Windows accepts the recovery key but then fails to boot normally — due to a changed boot configuration, a TPM or Secure Boot change, a failed update, or damaged boot files — so it falls back to recovery on every start. Break the loop by entering the key once, then in the recovery options use Advanced Options to suspend BitLocker protection from a command prompt with manage-bde -protectors -disable C:, repair startup, and resume protection after Windows boots cleanly. Never format or reset the PC as a first step, because that destroys the encrypted data permanently.

Why the Recovery Key Loop Happens

On a normal start, BitLocker measures the boot environment using the TPM chip — firmware settings, Secure Boot state, boot order, and boot files. If those measurements changed, it demands the recovery key to prove the change was yours.

The loop appears when something keeps making the boot environment look changed, and Windows still cannot complete a normal boot after unlocking. Common triggers include a firmware update, Secure Boot or TPM changes, a boot mode change between UEFI and Legacy, a failed Windows update, a replaced motherboard, or corrupted boot data.

Critical Safety Warnings

Your data is encrypted. Without a working unlock path, no recovery company can simply read the drive. Do not choose Reset this PC, do not format the partition, and do not remove or re-create partitions in Disk Management or an installer. Those actions can destroy the encrypted volume beyond recovery. Also, if the drive itself is failing — clicking, disappearing, or extremely slow — clone it sector by sector to an equal or larger drive first using a tool that copies raw sectors, and work on the clone. Trying fixes repeatedly on dying hardware wastes its remaining life.

Step 1: Confirm You Are Using the Correct Key

1. On the recovery screen, note the Key ID shown at the top. It is a short string of letters and numbers.
2. Find your recovery key in the place it was saved: your Microsoft account, a printed page, a USB file, or your IT department for a work device.
3. Match the Key ID on screen with the Key ID next to the 48-digit key. A family or workplace may have several keys for several drives, and the wrong key for a different drive or partition will never work.
4. Type the digits carefully. The screen groups them automatically and ignores dashes. Use the function keys or on-screen input exactly as prompted if your keyboard layout seems different.

Microsoft explains where keys are stored and how the IDs match in its official guide to finding your BitLocker recovery key. If no key matches the displayed ID at all, skip to the no-key section below before trying anything destructive.

Step 2: Use Advanced Options Instead of Just Restarting

1. On the recovery screen, look for Skip this drive or press Esc for more recovery options, depending on your Windows version.
2. When the Choose an option screen appears, select Troubleshoot, then Advanced options.
3. Try Startup Repair first and let it complete. It fixes common boot file and configuration damage automatically.
4. If Startup Repair reports it could not repair the PC, return to Advanced options for the command prompt steps in the next section rather than choosing Reset or Continue repeatedly.

Step 3: Suspend BitLocker and Repair the Boot Configuration

Open Command Prompt and Unlock the Drive

1. In Advanced options, choose Command Prompt. The system may ask for the recovery key once more to open it.
2. Check the status of the system drive with: manage-bde -status
3. If the Windows volume is still locked, unlock it with: manage-bde -unlock C: -RecoveryPassword YOUR-48-DIGIT-KEY — note that in the recovery environment the Windows drive may use a different letter, often D: or E:. Use diskpart and list volume to confirm which letter shows the Windows folder, and adjust the commands.
4. Suspend protection so the next boots stop triggering recovery measurements: manage-bde -protectors -disable C:, again using the correct letter for your system.

Repair Boot Files While Protection Is Suspended

1. Rebuild the boot configuration with: bcdboot C:\Windows /s Z: /f UEFI only if you have confirmed your EFI partition letter and Windows path — this is an advanced step, so if you are unsure, prefer Startup Repair and system file checks below.
2. Check the Windows installation for corruption with: sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows, adjusting letters as needed.
3. Exit the command prompt and choose Continue to attempt a normal boot while protection is suspended. A successful clean boot here is the turning point.

The full syntax and options for these tools are documented in Microsoft’s manage-bde command reference on Microsoft Learn. Our own walkthrough on fixing Windows startup and boot errors step by step covers the general repair menu in more depth once BitLocker is suspended.

Step 4: Fix the Root Cause Inside Windows

If Windows now starts, fix the trigger and then restore full protection properly.

1. Let any pending Windows updates finish completely, then restart once on purpose.
2. Check that Secure Boot and the TPM are enabled in your firmware settings if they were on originally. Sudden changes to either one re-trigger recovery.
3. Open an admin terminal and check status with manage-bde -status C:.
4. Resume protection with: manage-bde -protectors -enable C:
5. Save a fresh copy of the recovery key to your Microsoft account and to a separate safe place, and confirm its Key ID matches this drive.
6. Restart twice to confirm the loop is truly gone and Windows reaches the sign-in screen without asking for the key.

Step 5: If the Loop Started After a Firmware or Hardware Change

If the problem began after a BIOS update, motherboard repair, or boot-order change, the measurements BitLocker trusted no longer match the machine. Suspending protection, booting cleanly once, and then resuming protection usually teaches BitLocker the new measurements. If you changed boot mode from UEFI to Legacy or disabled Secure Boot, restore the original settings first.

When You Do Not Have the Recovery Key

BitLocker encryption cannot be bypassed or cracked by recovery software. Check every possible place first — Microsoft accounts of anyone who set up the PC, printouts, USB drives with a .BEK file, photos of setup screens, and your employer or school IT helpdesk if the device was ever managed by them.

If the key is truly lost, the encrypted data is not recoverable. The drive can be wiped and reused for a fresh install, but the old files cannot be saved. That is why checking for the key is always step one.

Common Mistakes That Make the Loop Worse

• Choosing Reset this PC from the recovery menu: Reset removes your installation and can erase the encrypted volume. It should never be used while you still hope to keep the data.
• Clearing the TPM in firmware settings: Clearing the TPM destroys the trusted keys it holds and makes the situation harder, not easier. Leave TPM settings alone unless a repair guide for your exact loop cause requires it after data is safe.
• Repeatedly entering the key and force-powering off mid-boot: Interrupted boots and updates corrupt the very boot files you need. Let each attempt finish or fail fully.
• Formatting the partition from an installer: The installer may offer the locked space as usable. Accepting deletes the encrypted volume header and its data.
• Suspending protection and forgetting to resume it: A suspended drive boots without its normal checks and is less protected. Resume protection and save a fresh key once the boot is stable.
• Ignoring drive health: If unlock attempts get slower or the drive vanishes from list volume, treat it as hardware failure. Raw-clone the disk first and run BitLocker repairs on the clone.

Conclusion

A BitLocker recovery loop does not mean your data is gone. It usually means the key unlocks the drive, but something in the boot path keeps failing or keeps looking changed. Verify the Key ID matches, use Advanced options rather than blind restarts, suspend protection with manage-bde, repair startup, boot cleanly once, fix updates and firmware settings, and then resume protection with a freshly saved key. Above all, avoid reset and format options while the data matters — with encryption, careful steps are the only steps that keep recovery possible.

Frequently Asked Questions

Why does BitLocker accept my key and then ask for it again after restart?

Accepting the key unlocks the drive for that one attempt. If Windows then fails to boot fully, the system returns to recovery. Suspend protection during a repaired boot, let Windows start completely, then resume protection so new measurements are recorded.

Is suspending BitLocker the same as decrypting the drive?

No. Suspending keeps data encrypted but pauses boot checks for a limited number of restarts. Full decryption rewrites the entire drive as plain data, takes much longer, and is not needed to break a loop.

Can I recover files by removing the drive and attaching it to another PC?

Yes, if you have the correct recovery key. Attached as a secondary drive, the partition will appear as locked, and Windows will prompt for the key or let you unlock it with manage-bde. You can then copy files safely. Without the correct key, the attached drive reveals nothing.

The loop started after a Windows update. Should I uninstall the update?

Often completing the update is better than removing it. Try Startup Repair first, or use Uninstall Updates if a specific update clearly triggered the failure. Do this only after the drive is unlocked in the recovery environment.

How can I prevent this loop from happening again?

Keep a verified copy of the recovery key outside the PC, suspend BitLocker before firmware updates, let Windows updates finish without forced shutdowns, and avoid changing Secure Boot, TPM, or boot mode casually.