Drive Encryption Password Prompt Won't Stop? Try This

Yeah, I know—you boot up your machine and bam, that encryption password screen pops up again. You type it in, it works, but next boot it's right back. Infuriating. Let me save you the headache.

The Quick Fix (Works 90% of the Time)

Most of the time, this is a TPM (Trusted Platform Module) issue. The encryption software—whether BitLocker, VeraCrypt, or something else—uses the TPM to store a key that auto-unlocks the drive at startup. If that key gets corrupted or the TPM loses sync, you're stuck typing the password every single time.

Here's what you do:

1. Clear and reinitialize the TPM. Reboot, enter BIOS/UEFI (usually F2, Del, or Esc during startup), find the TPM settings (often under Security or Advanced), and select "Clear TPM" or "Reset TPM." Accept any warnings—yes, it resets the hardware security chip.
2. Reboot into Windows. If you have BitLocker, it'll prompt you for the recovery key on first boot. Type it in. Then the TPM will re-initialize and re-grab the key from the drive.
3. Suspend and resume BitLocker. Open a command prompt as admin, type manage-bde -protectors -disable C: (replace C: with your encrypted drive letter), reboot, then re-enable with manage-bde -protectors -enable C:. This forces the TPM to re-sync the auto-unlock key.

For VeraCrypt users: go to System > Settings, check "Use TPM" if it's unchecked, then reboot. If it's already checked, uncheck it, reboot, then re-check and reboot again. That re-triggers the TPM registration.

Why This Works

The TPM and the encryption software rely on a handshake at startup. The TPM holds a hash of the drive's encryption key. When the TPM's internal data gets slightly out of sync—maybe from a BIOS update, a sudden power loss, or a failed Windows update—the handshake fails. Instead of a silent unlock, you get the password prompt. Resetting the TPM and re-suspending BitLocker re-establishes that handshake from scratch. Had a client last month whose entire print queue died because of this after a faulty driver update.

Less Common Variations

If the TPM fix doesn't work, check these:

• BIOS/UEFI boot order changed. If you recently added or removed a drive, the BIOS might be trying to boot from a different disk that doesn't have the encryption key. Go into BIOS and set the correct boot drive as first priority.
• Secure Boot is disabled. Some encryption implementations require Secure Boot to be enabled to trust the TPM. If it's off, the TPM might not release the key. Re-enable Secure Boot in BIOS.
• Corrupt encryption metadata. Rare, but the drive's encryption header (the first few sectors) can get damaged. Run chkdsk C: /f first, then try manage-bde -repair C: for BitLocker. For VeraCrypt, use Tools > Repair Volume.
• USB drive interference. If you have a USB stick plugged in, some encryption tools might mistake it for a boot device and prompt for a password. Unplug all external drives and reboot.

Prevention So It Doesn't Happen Again

Once you fix it, do these three things:

1. Always have your recovery key backed up. Print it, save it to a USB, and store it in a safe place. BitLocker gives you a 48-digit key; VeraCrypt has a rescue disk. If the TPM fails completely, without that key you're locked out.
2. Update BIOS and TPM firmware carefully. BIOS updates often reset TPM state. After a BIOS update, run manage-bde -protectors -enable C: even if you don't see a problem. It's a cheap insurance step.
3. Avoid sleep/hibernate with encryption. It's fine most of the time, but some laptops have buggy TPM drivers that lose state when waking from deep sleep. Disable fast startup in Windows power settings—it's a common trigger.

Last piece of advice: if you're still stuck after all this, don't keep hammering the password. Each wrong attempt can delay the TPM or trigger a lockout. Better to pull the drive and mount it externally on a known-good PC to access the recovery key. Saved my bacon more than once.