What is a BitLocker Drive Encryption
startup key or PIN?
When you use BitLocker Drive
Encryption, you need a BitLocker Drive
Encryption startup key or personal
identification number (PIN) to start
BitLocker stores its own encryption
and decryption keys in a hardware
device called the Trusted Platform
Module (TPM) security hardware, which
is a special microchip in some newer
computers that supports advanced
security features. The keys are not
stored on the computer’s hard disk.
The TPM must be accessible by the
basic input/output system (BIOS)
during startup. When you start your
computer, BitLocker will get these
keys from the TPM automatically.
If your computer was not manufactured
with TPM version 1.2 or higher, you
can create a BitLocker startup key
using a USB flash drive to store the
encryption keys and decryption keys.
You will have to insert the flash
drive each time you start the
In addition to the option of creating
a startup key, you have the option of
creating a startup personal
identification number (PIN). You can
create either the startup key or the
startup PIN, but not both. The startup
PIN can be any number that you choose
from 4 to 20 digits in length. The PIN
is stored on your computer. You will
have to type the PIN each time you
start the computer.
You can only create a startup key or
PIN when you turn on BitLocker for the
first time. After you create the
startup key or PIN, you can use the
BitLocker Manage Keys feature to
change the PIN. You can also make
additional copies of the startup key
to use in case you lose the original.