How to turn on device encryption on Windows 11

2 min read · 5 steps · Updated 2 October 2026

Short answer

Sign in as an administrator, open Settings, click Privacy & security, then Device encryption, and switch it on. If you sign in with a Microsoft account, encryption is usually on already and the recovery key is saved in that account.

Device encryption scrambles everything on the PC's drive, so that nobody can read your files by removing the drive or starting the PC from a USB stick. Unlike BitLocker, it is included in Windows 11 Home. It matters most for laptops, which get lost and stolen.

These steps are for Windows 11. The pictures are simplified diagrams of the Settings window, not screenshots, so colours and spacing on your PC look a little different.

Step by step

  1. Sign in with an administrator account

    Standard accounts cannot change this setting.

  2. – ▢ ✕SettingsSystemBluetooth & devicesNetwork & internetAppsAccountsTime & languagePrivacy & securityWindows UpdatePrivacy & securityWindows SecurityFind my deviceDevice encryptionFor developers

    Open Settings and click Privacy & security

    Press Windows + I. Privacy & security is in the sidebar.

  3. Click Device encryption

    If the entry is missing, the PC does not support device encryption. See the notes below.

  4. – ▢ ✕SettingsSystemBluetooth & devicesNetwork & internetAppsAccountsTime & languagePrivacy & securityWindows UpdateDevice encryptionDevice encryptionBitLocker drive encryption

    Switch it on

    Encryption runs in the background while you keep working. On a large drive it takes a while.

  5. Check where the recovery key is

    When you sign in with a Microsoft account, the recovery key is attached to that account. Sign in to your Microsoft account on the web and look under your devices for the recovery keys. Without the key, an encrypted drive cannot be opened if Windows ever asks for it.

Good to know

When you set up a PC with a Microsoft account, Windows switches device encryption on by itself. With a local account it does not.

If Device encryption is not listed, the PC may have no TPM security chip, or the chip or Secure Boot may be switched off in the firmware. Type System Information into the search box, open it as administrator and look at the line Device Encryption Support for the reason.

Windows 11 Pro has BitLocker, which does the same job with more options. It is in the same place in Settings.

Encryption protects a PC that is switched off or locked. Use a good PIN as well: how to change your PIN on Windows 11.

In short: Administrator, Settings, Privacy & security, Device encryption, On. Know where the recovery key is.

Sources
  • Microsoft Support: Device Encryption in Windows

Rules and prices change. Check the official source before you act.