Here's the scenario:

I have an external harddrive encrypted with bitlocker. I disconnect that drive from the PC that encrypted it, and connect it to a different PC.

Surprisingly, when I do this, all that is required to unlock the drive is a password. I figured I would need the recovery key.

I was under the impression that passwords in bitlocker are not used to unlock the drive, but rather sent to the TPM, which then returns the (long) decryption key. Is that not how it works with external harddrives?

My password is fairly good, but if it was a regular, lets say 8 digit password wouldn't that make the drive easy to crack by brute force?

  • The recovery key is in the end also a password, just a special password regarding used characters, formatting and length.
    – Robert
    May 14, 2022 at 12:01
  • Yes but I believe the idea of the TPM is that your password can be something reasonable for a human to remember, while your decryption key can be MUCH stronger. The TPM is supposed to prevent brute forcing of the (relatively) weak pin by limiting the attempts, and the long encryption key prevents brute forcing the encryption directly by making it computationally unreasonable.
    – Drew
    May 15, 2022 at 5:53
  • Your question was about an external Bitlocker protected drive where you have to enter a password. This type of protection works without TPM. It just uses key derivation to generate the key from the entered password.
    – Robert
    May 15, 2022 at 8:47
  • @Robert Thanks I was not aware of that but I know now.
    – Drew
    May 16, 2022 at 3:17

2 Answers 2


BitLocker defaults to using 128-bit AES for encryption, and can be configured to use 256-bit AES. The data is not directly encrypted with the key stored in the TPM nor with the password, but those are only used to decrypt the key.

  1. The provided key is run through a key derivation function (KDF).
  2. The output of the KDF a.k.a. the key-protector key is used to decrypt the volume master key (VMK).
  3. The VMK is used to decrypt the volume encryption key (FVEK), which is the actual key used for the AES encryption.

This is described in detail in the TechNet article by Byron Hynes: Keys to Protecting Data with BitLocker Drive Encryption.

Naturally, if you use a weaker password it is faster to brute-force the KDF phase.

  • So what you're saying is that if you use a weak password on external drives, it's likely to be brute-forceable. Whereas if you were to use the same (weak) password as a pin for the TPM, it should still be hard to brute force, because the TPM will limit the attempts on it?
    – Drew
    May 15, 2022 at 5:59
  • The PIN in BitLockers TPM+PIN is a factor for the BitLocker itself; the key is derived from the key stored in TPM + the PIN provided by the user. In this screnario, TPM limits the rate for brute-forcing the PIN, add possibly the attempts, too, by locking the TPM. The way you worded it sounds more like a BIOS password given before the TPM releases the key. May 15, 2022 at 6:16
  • External Bitlocker protected drives that are unlocked by password do not make use of a TPM.
    – Robert
    May 15, 2022 at 8:49

I've found the answer here:


Finally, we are there. BitLocker passwords are used to protect volumes stored on external devices (including regular BitLocker and BitLocker To Go). The password is also the default when it comes to protecting fixed, non-system volumes. In other words, BitLocker passwords are extremely likely to be used on anything but the system volume. Passwords on bootable (system) volumes are rarely encountered as BitLocker’s default policy is TPM only. Using a password (without TPM) is blocked by the default security policy. While users may edit the policy and enable password-only BitLocker protection on the boot volume, this is fairly uncommon.

So the answer is yes. If a weak password is used on an external drive encrypted with bitlocker, it is probably brute-forceable. This is also evidenced by the fact that the article is from a company who makes software specifically for this purpose.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .