Enable Full-Disk Encryption on Windows 11 (Home & Pro)

For Windows 11 Home, go to Settings > Privacy & security > Device encryption and toggle it On. For Windows 11 Pro, use Control Panel > BitLocker Drive Encryption for more control. Crucial: You absolutely must back up your 48-digit Recovery Key to a USB drive or your Microsoft Account, or a BIOS update could permanently lock you out of your data.

Windows 11 handles encryption in two tiers, which confuses most users.

1. Device Encryption: Available on Windows 11 Home and Pro. It is a "set it and forget it" version of BitLocker. It encrypts the whole drive but lacks granular controls.
2. BitLocker Drive Encryption: Available only on Windows 11 Pro/Enterprise. It allows you to encrypt specific partitions, USB drives (BitLocker To Go), and choose encryption strength (XTS-AES 256).

Why enable it? Without it, a thief can pull your SSD, plug it into a $10 USB adapter, and read every single file regardless of your Windows password. Encryption turns that data into random noise without the key.

Checklist

• TPM 2.0 Module enabled in BIOS (Standard for Win 11).
• Secure Boot enabled in BIOS.
• Signed into a Microsoft Account (Required for Home edition "Device Encryption" to auto-backup the key).
• The Hidden Requirement: Your device must support "Modern Standby" (S0 Low Power Idle). If you built your own PC or have an older laptop, the "Device Encryption" option might be missing from Settings entirely because the hardware doesn't support this specific sleep state. You can verify this by running powercfg /a in Command Prompt.

Step-by-Step Guide

• Method 1: The "Device Encryption" Path (Home & Pro)
  
  1. Open Settings (Win + I).
  2. Navigate to Privacy & security > Device encryption.
  3. Toggle the switch to On.
  4. Windows will silently encrypt the drive in the background. It may take hours, but you can keep working.
• Method 2: The "BitLocker" Path (Pro Only - Superior)
  
  1. Press Win Key and type "Manage BitLocker". Open the Control Panel result.
  2. Click Turn on BitLocker next to the C: drive.
  3. Select Backup: Choose "Save to a file" (store on a separate USB) and "Save to your Microsoft Account". Do both.
  4. Encryption Mode: Select "New encryption mode" (XTS-AES) for fixed drives.
  5. System Check: Check "Run BitLocker system check." The PC will restart to verify the TPM can unlock the drive before it actually encrypts data.

How It Works & Hidden Details

Windows 11 uses the TPM (Trusted Platform Module) chip on your motherboard to store the "Master Key." When you boot up, the TPM checks the hardware. If the motherboard, BIOS, and boot order look untouched, it releases the key to Windows, and your PC unlocks automatically without asking for a PIN (unless you configured a Pre-Boot PIN via Group Policy).

The "24H2" Update Rule:
In the latest 2025/2026 builds (24H2), Microsoft has started enabling Device Encryption by default during fresh installations, even on Home edition. If you reinstall Windows, check your encryption status immediately—you might be encrypted without realizing it, and if you lose that MS Account, the data is gone.

Things to Watch Out For

• Risk 1: The BIOS Update Lockout
  If you update your BIOS/UEFI firmware, the TPM fingerprint changes. BitLocker will think the device has been tampered with and demand the 48-digit Recovery Key on the next boot. Always suspend BitLocker before updating BIOS.
• Risk 2: The "Microsoft Account" Trap
  On Windows Home, the key is strictly tied to your online Microsoft Account. If you get locked out of your email and your laptop simultaneously, there is zero recourse. Print the key out on paper and put it in a fireproof box.

Frequently Asked Questions

• Q: Does encryption slow down my PC?
  A: Negligible impact on modern CPUs (Intel 10th Gen+ / Ryzen 3000+). They have dedicated "AES-NI" instruction sets to handle the math instantly.
• Q: Can I encrypt a USB drive on Windows Home?
  A: No. Windows Home can read an encrypted USB (BitLocker To Go), but it cannot create one. You need Pro for that.

Update: Additional Details & Recent Changes

• Eligibility Expansion (24H2 Update):
  As of the Windows 11 2024/2025 updates (version 24H2), Microsoft has removed the strict "Modern Standby" (S0) and HSTI hardware requirements for Device Encryption. The feature is now available on standard desktops and DIY builds that were previously unsupported, provided they have TPM 2.0 and Secure Boot.
  
• Automatic Encryption on Fresh Install:
  If you perform a clean install of Windows 11 (Home or Pro) using 24H2 media and sign in with a Microsoft Account, BitLocker/Device Encryption is now enabled automatically by default during the setup (OOBE) phase. It no longer waits for you to manually toggle it in Settings.
  
• Hardware-Accelerated BitLocker (2026):
  Newer builds utilize "Hardware-accelerated BitLocker" which offloads the encryption work to dedicated engines on the CPU/SoC (different from the older, insecure SSD-based "eDrive" standard). This significantly reduces the performance impact on Gen 5 NVMe SSDs, which previously suffered throughput drops under software encryption.
  

The Hidden Requirement: Your device must support "Modern Standby" (S0 Low Power Idle). If you built your own PC... the "Device Encryption" option might be missing

Update: This restriction was lifted in the 24H2 build. Device Encryption now appears in Settings for almost all TPM 2.0-compliant PCs, regardless of their sleep state configuration.