When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process completed.

I'm not very familiar with how BitLocker works.

My questions are thus. With what key has my system-drive been encrypted? Is the key in any way related to the password for my Administrator-User-Account? How is it that I did not have to enter any new keys when setting up BitLocker or when booting the system?


By default, BitLocker encryption uses a security device, the TPM chip, for key storage. So windows stores the key inside the TPM and makes sure that the TPM does not "hand out" the key unless the original windows system on which the key was created is booted.

So how does this protect your data? You're protected because there's still the windows logon password. This logon password is between someone hostile and your data. The password cannot be brute-forced at the logon screen in a reasonable time. if you don't believe that, please try to enter 100 guessed passwords and see if you can do it in less than 15 minutes. Now imagine someone would plan to brute force your machine. Even with a programmable keyboard, this would take years even for a password of length 6.

| improve this answer | |
  • It may be worth expanding the answer slightly to talk about Secure Boot, which is another important part of the overall security of Bitlocker. – David Nov 21 '19 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.