Is Your Laptop Encrypted? Turn On Device Encryption, BitLocker or FileVault (and Save the Recovery Key)

By Web Asset House Studio · October 29, 2026

Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.

How we wrote this: A summary of Microsoft's and Apple's official support pages on Device Encryption, BitLocker recovery keys and FileVault (linked below), checked October 29, 2026. Menu names can differ slightly between versions.

A lost or stolen laptop is an inconvenience. A lost laptop holding client files, tax returns and saved passwords on an unencrypted drive is a much bigger problem. Full-disk encryption means someone who takes the computer can't read the drive without your sign-in. Both Windows and macOS include it at no extra cost. The one real risk is losing your recovery key, so this guide covers that too.

Windows: Device Encryption or BitLocker

Microsoft's Device Encryption page explains the two options:

Device Encryption turns on BitLocker encryption automatically for the system drive and fixed drives. It is available on a wide range of devices, including Windows Home.
BitLocker Drive Encryption, with more controls, is available on Windows Pro, Enterprise and Education.

Is it already on? Microsoft says Device Encryption turns on automatically when you first sign in or set up the device with a Microsoft account or a work or school account, and the recovery key is attached to that account. If you use a local account, it is not turned on automatically.

To turn it on (Windows 11 and 10):

Sign in with an administrator account.
Open Settings > Privacy & security > Device encryption.
Turn Device encryption on.

If that setting doesn't appear, Microsoft says the feature isn't available on your device or you're signed in as a standard user. To see why, run System Information as administrator and look at Device Encryption Support (or Automatic Device Encryption Support). Common reasons Microsoft lists:

TPM is not usable: no Trusted Platform Module, or it's turned off in the BIOS/UEFI.
WinRE is not configured: the Windows Recovery Environment isn't set up.
PCR7 binding is not supported: Secure Boot is off, or certain devices (like docks or external graphics) are connected during startup.

Save the Windows recovery key

Microsoft's recovery key page says the BitLocker recovery key is a 48-digit number. Windows may ask for it after a hardware change or a security event. The same page warns that Microsoft Support can't retrieve, provide or recreate a lost recovery key. If you can't find it, the remaining option is to reset the device, which removes all your files.

Where the key may be:

Your Microsoft account, at aka.ms/myrecoverykey (sign in from another device). If someone else set up the PC, it may be in their account.
A work or school account, at aka.ms/aadrecoverykey, or through that organization's IT team.
A printout or a USB flash drive, if you saved it that way when BitLocker was turned on.

Check now that you can see your key, and keep a second copy somewhere safe and separate from the laptop.

Mac: FileVault

Apple's FileVault guide says:

On a Mac with Apple silicon or an Apple T2 Security Chip, your data is already encrypted automatically. Turning on FileVault adds a layer so nobody can decrypt the data without your login password.
On a Mac without Apple silicon or a T2 chip, you must turn on FileVault to encrypt your data.

To turn it on:

Choose Apple menu > System Settings, click Privacy & Security, then click FileVault (you may need to scroll).
Turn on FileVault. You need to be an administrator, and you may be asked for your password.
Choose how you'd unlock the disk if you forget your password: let your iCloud account unlock it, or create a recovery key and don't use iCloud. If you choose a recovery key, write it down and keep it safe.
Click Continue. Other users on the Mac may need to be enabled with their own passwords.

Apple's warning is blunt: if you forget your login password and can't reset it, and you also lose your recovery key, "you won't be able to log in, and your files and settings will be lost forever."

A short checklist for a home office

Every laptop and desktop with work files shows encryption turned on.
You know where each recovery key is, and there is a second copy stored away from the device.
Your accounts that hold recovery keys are protected with strong sign-in; see passkeys explained.
You keep backups, because encryption protects against theft, not drive failure. See the 3-2-1 backup rule.
When a computer is retired, you follow the wipe-before-recycling steps.