How to create your own USB startup key from scratch on Windows 11

5 min readMay 20, 2022

Did you know you can use just about any USB drive as a “startup key” on Windows 11? When you enable BitLocker on newer PCs, Windows automatically unlocks your system drive every time you start up your computer using Trusted Platform Module (TPM).

The ability to add an extra level of security with the convenience with using a USB startup key on a BitLocker enabled PC is indispensable. It effectively adds two-factor authentication to BitLocker encryption. Now, your PC won’t even start without the USB startup key inserted for your drive to be decrypted and Windows to start.

It is important to point out the difference between a USB startup key and a USB security key. A USB security key, like the Yubikey 5 Series from Yubico, offer FIDO2 (Fast Online Identification) authentication, which is also offered by Microsoft’s Windows Hello.

A USB startup key prevents a PC from booting into Windows on a BitLocker-enabled drive unless the startup key is present. It’s not quite the same level of protection, but still more secure than just a password, for example.

In this guide, we will show you how to create one from scratch on Windows 11.

Create your own USB startup key

Bitlocker is a built-in full disk encryption tool available on Windows 11, that was first introduced in Windows 7. You can create a USB startup key using BitLocker on Windows 11.

However, it’s important to note that this BitLocker method will only work for Windows 11 Professional and Windows 11 Enterprise versions. Windows Home does not come with BitLocker, it uses a different security feature called Device Encryption.

Here’s how to use BitLocker on Windows 11 Pro to create a USB startup key from scratch.

1. Open File Explorer, right click your PC’s system drive (where Windows is installed) and click Turn on BitLocker. In my case, it’s the C: drive.