Do you need a TPM for BitLocker?

No, BitLocker can encrypt the OS drive without a TPM, but only with a startup key on a removable drive or a password. Both lose the boot integrity checks a TPM provides, and Microsoft discourages the password option and disables it by default.

What the TPM adds

A Trusted Platform Module is a common hardware component on Windows devices. Microsoft says BitLocker gives maximum protection when used with one, because the TPM helps ensure the device has not been tampered with while the system is offline.

On top of the TPM you can add a PIN or a startup key. That gives multifactor authentication at boot: the device cannot start or resume from hibernation until the right PIN or key is presented.

Without a TPM

There are two routes.

• Startup key. A file on a removable drive used to start the device or resume from hibernation. If no TPM is present, saving a startup key on a removable drive is mandatory when enabling BitLocker.
• Password. Microsoft calls this not secure, because there is no password lockout logic and it is open to brute force. It is discouraged and disabled by default.

Neither gives the preboot system integrity verification that BitLocker with a TPM offers.

Other hardware conditions

Microsoft lists a few more conditions that trip up older machines.

• For the TPM integrity check, TPM 1.2 or later is needed, plus TCG compliant BIOS or UEFI firmware.
• Firmware must support the USB mass storage class and read files from a USB drive before the OS starts.
• TPM 2.0 is not supported in Legacy or Compatibility Support Module modes. Devices with TPM 2.0 must be set to native UEFI only, with Legacy and CSM disabled. Microsoft suggests enabling Secure Boot for added security.
• The disk needs a separate unencrypted system partition. A new Windows install creates the right partitions on its own.

If a machine runs in Legacy mode and you switch the BIOS to UEFI, the installed OS stops booting. Microsoft points to its mbr2gpt.exe tool to prepare the OS and disk before you change the mode.

A practical decision guide

1. Modern laptop with a TPM: use it, keep Secure Boot on, and consider a startup PIN for sensitive roles.
2. Older machine with no TPM: plan to replace it. If you cannot, use a startup key and store it away from the laptop.
3. Virtual machine or lab box: decide whether the data on it justifies the effort. For throwaway test VMs it may not. For a VM holding production credentials, it does.
4. Never choose the password option on a laptop that travels.

The cost of a laptop refresh is usually less than the cost of explaining why customer source code was readable on a lost machine.

Quick check

Sources

• BitLocker overview, Microsoft Learn

Last reviewed: 19 October 2026.