BitLocker on Windows 11 Home Device Encryption What You Actually Get

On supported hardware — TPM 2.0, Secure Boot, Modern Standby class machines, which covers most laptops sold in the last several years — Device Encryption encrypts all internal drives automatically once you sign in with a Microsoft account. The encryption strength is the same as BitLocker's. A thief who removes your drive still gets nothing readable. For the single job of stopping data theft from a lost laptop, Home's version genuinely does it.

1. No per-drive control: internal drives are in; you cannot manage them one by one
2. No BitLocker To Go choices for managing external drives with the full toolset
3. No pre-boot PIN: you cannot add the extra PIN layer that Pro allows on top of the TPM
4. No encryption choices: no used-space-only vs full-drive decision, no cipher strength selection
5. Key goes to one place: the recovery key is saved to your Microsoft account — convenient, but it is the only automatic destination

Device Encryption only completes its key backup when a Microsoft account signs in. A laptop set up with a local account only can sit in a half-armed state where encryption is waiting for that sign-in. If you deliberately avoid Microsoft accounts, understand the trade honestly: your key backup becomes your own manual job, and if it is not saved somewhere else, the recovery screen becomes a dead end.

Upgrade when you need any one of these: a pre-boot PIN, encrypting and managing external drives your way, company-style key escrow, or per-drive control on a desktop with several disks. For a personal laptop that simply must not leak files if stolen, Home's Device Encryption with the key confirmed in your Microsoft account is honestly enough — spend nothing.