TPM only gives you a smooth boot and tamper detection while the machine is offline. Adding a PIN or startup key makes the device ask for something you know or hold before Windows starts. Pick the PIN if a stolen laptop is a realistic threat for you and a boot prompt is acceptable.
What the TPM does
Microsoft says BitLocker gives its maximum protection when used with a Trusted Platform Module. The TPM works with BitLocker to make sure the device has not been tampered with while it was offline.
In plain terms: the disk key is only released if the boot chain looks the way it did when you set things up.
What a PIN adds
On top of the TPM, BitLocker can lock the normal startup until the user supplies a personal identification number or inserts a removable device holding a startup key. Microsoft calls these measures multifactor authentication. The device cannot start or resume from hibernation until the correct PIN or startup key is presented.
The trade is simple. You get a pre-boot prompt every time. You gain protection if someone has your laptop but not your head.
Devices without a TPM
BitLocker can still encrypt the OS drive without a TPM. Microsoft says the user must either use a startup key on a removable drive or a password. The password option is described as not secure, because there is no password lockout logic and it is open to brute force. Microsoft discourages it, and it is disabled by default.
Both of those options also lack the pre-boot integrity verification that you get with a TPM.
Requirements people trip over
- TPM 1.2 or later for the system integrity check.
- A TCG-compliant BIOS or UEFI.
- TPM 2.0 is not supported in Legacy or Compatibility Support Module modes. Devices with TPM 2.0 must be in native UEFI only, with Legacy and CSM disabled. Microsoft adds that enabling secure boot gives added security.
- The firmware must support the USB mass storage device class and reading files from USB in the preboot environment, which matters if you choose a startup key.
If an older machine is in Legacy mode, switching to UEFI can stop the OS from booting. Microsoft points to the mbr2gpt.exe tool, which you run before changing the BIOS mode.
A simple decision guide
- Do you travel with the laptop or work in shared spaces? Lean toward TPM plus PIN.
- Does the laptop sit in a locked office and need unattended reboots, for example after updates? TPM only may be the practical choice. Be aware an unattended reboot is not possible with a PIN prompt.
- Is your organisation setting policy? Follow it, and make sure recovery keys are backed up either way.
- Is there no TPM? Use a startup key on a removable drive rather than a password, and keep that drive separate from the laptop.
Whichever you choose, record the decision somewhere your team can find it.
What this does not solve
Disk encryption covers a device that is off or locked. Once you are signed in, malware you run can read what you can read. Keep secrets out of files in your home directory, and scan the projects on the machine. Safeguard's free scan at gold.safeguard.sh/scan covers the dependency side.
Quick check
Is a BitLocker password a good substitute for a TPM?
Microsoft says no. It has no lockout logic, is open to brute force, and is disabled by default.
Does BitLocker work with TPM 2.0 in Legacy BIOS mode?
No. Microsoft says TPM 2.0 is not supported in Legacy or CSM modes, so the device must use native UEFI only.
Sources
Last reviewed: 19 October 2026.
