A modern BitLocker toolkit for Windows — validate and repair recovery keys (including reconstructing missing digits from a partial key), and manage encrypted volumes end-to-end: unlock, lock, encrypt and decrypt drives from one clean desktop app.
The entire Windows build — including Recovery Lab — is free forever. No license key, no gate, no phone-home. Just download and use it.
A future macOS build will be a paid product when it works reliably on real Mac hardware. Not sold today.
BitLockPick is beta software. It talks directly to Windows BitLocker via PowerShell / WMI and performs real, potentially destructive operations (enabling/disabling encryption, locking/unlocking volumes). Use it on test machines and non-critical drives first, and always keep an independent backup of your recovery keys. No warranty — see LICENSE.
- Validates every 6-digit block against BitLocker's rules (divisible by 11, quotient within 16 bits).
- Fixes single-digit typos automatically using the mod-11 checksum and suggests the correct digit.
- Reconstructs a partial key — replace up to 3 unknown digits per block with
?(or_) and BitLockPick fills them in. A single missing digit per block is recovered deterministically (exactly one valid solution). - One-click "clean key" output, copy to clipboard, or hand it straight to the drive manager.
- Live overview of every volume with accurate encryption/lock status (using
VolumeStatus+LockStatus). - Unlock a locked drive with a password or a recovery key — including the repaired/reconstructed key from the validator.
- Lock, encrypt (with generated recovery key) and decrypt volumes.
- Works on Windows Home too (via WMI
Win32_EncryptableVolume), where the native BitLocker manager is missing.
Lost an entire block of your recovery key (e.g. the last one)? Recovery Lab enters the known blocks, marks the unknown ones, and tries only the mathematically valid candidates (65 536 per block, not a million) against a locked drive until it unlocks — then shows you the full recovered key.
- Realistic scope: BitLocker recovery keys have no lockout, so brute-forcing candidates is possible. 1 missing block ≈ 65 536 tries (hours) — feasible. 2 missing blocks ≈ 4.3 billion — not feasible online; use an offline GPU tool such as
bitcracker. All blocks missing (2¹²⁸) is mathematically impossible — no tool can do it. - Live candidate count, time estimate and a feasibility verdict before you start; runs in the background with a progress bar and is fully stoppable.
- For recovering your own drives only.
- Frameless, modern translucent title bar with custom window controls.
- Single-instance lock and a system-tray presence.
- During a critical operation (encrypting/decrypting) the app minimizes to the tray instead of dying, keeps showing progress, and warns you before you quit mid-operation.
- Full EN / PL interface — toggle instantly from the header; your choice is remembered. Tray, dialogs and number formatting are localized too.
| Dashboard | Recovery Lab (experimental) |
|---|---|
 |
 |
| Key Validator |
|---|
 |
- rustyrat.it (primary): rustyrat.it/downloads/BitLockPick-1.0.0-beta.5.2-x64.exe
- GitHub Releases (mirror + source code): github.com/lobrzut/BitLockPick/releases
Windows 10 / 11 (x64), Home & Pro. Run the installer as Administrator to manage drives; the validator itself works without elevation.
Some antivirus engines flag the installer because the exe is:
- Unsigned (no Authenticode certificate yet — code-signing certs are pricey for indie apps),
- An Electron app that talks to BitLocker via WMI / PowerShell — legitimate but atypical for a "regular" app.
This is a false positive. The full source is in this repository — build it yourself with npm install && npm run dist and compare the hash if you want zero trust.
If you get a warning:
- Symantec / Norton: send the file to Symantec Security Response as a false-positive submission.
- Windows SmartScreen: click More info → Run anyway.
- Microsoft Defender: use Windows Security → Virus & threat protection → Protection history → Allow.
See docs/ANTIVIRUS-FALSE-POSITIVE.md for the long version, root causes, and the roadmap towards a signed release.
In preparation — not included in this release, not sold yet. See docs/MAC-BUILD.md for experimental dev builds. macOS will become a paid product only when it actually works on real Mac hardware.
git clone https://github.com/lobrzut/BitLockPick.git
cd BitLockPick
npm install
npm start # run in dev
npm run dist # Windows installer -> dist/
npm run dist:mac # macOS .dmg (+ .zip) -> dist/ (build on a Mac)Stack: Electron 31, vanilla JS renderer, cross-platform backend — PowerShell / WMI on Windows (Get-BitLockerVolume, Unlock-BitLocker, Win32_EncryptableVolume, …) and dislocker on macOS (backend-macos.js), invoked from the main process over a contextIsolation bridge.
A BitLocker recovery key is 8 blocks × 6 digits. Each block, read as a number, is divisible by 11, and the quotient encodes 16 bits of key material (so value / 11 ≤ 65535). That redundancy is what lets BitLockPick:
- flag a block that can't be right,
- pinpoint a single wrong digit and correct it,
- and fill blanks: for one unknown digit there is exactly one value that satisfies the checksum, so the digit is recovered with certainty.
- macOS support (unlock & mount BitLocker volumes via
dislocker) — same codebase,.dmgbuild. (experimental — needs on-Mac testing, see docs/MAC-BUILD.md) - macOS: verify dislocker mount pipeline & recovery brute-force on real hardware → then ship as paid SKU.
- Authenticode code-signing for Windows installer (removes SmartScreen prompt and most AV false positives).
- Encryption progress bar sourced from live
EncryptionPercentage. - Export/print recovery keys to a secured file.
MIT © 2026 lobrzut. Provided as-is, without warranty of any kind. You are responsible for your own data and drives.