BitLocker PIN recovery

Starting with version 2026.3, Passware Kit provides a decryption solution for devices where a BitLocker PIN is also set: in such cases, the PIN should be recovered prior to acquiring the VMK. This feature is available in Passware Kit Ultimate and Device Decryption Add-on.

The BitLocker startup PIN can be 4 to 20 characters long. It is numeric by default and typically consists of either 4 or 6 digits. When the "Allow enhanced PINs for startup" group policy is enabled, an enhanced PIN can be alphanumeric, containing uppercase and lowercase letters, numbers, symbols, and spaces.

The BitLocker startup PIN is protected by the TPM's authorization lockout: after a number of failed attempts, the TPM stops accepting guesses, then restores one PIN attempt after each lockout interval. This interval is either 10 minutes or 2 hours, depending on the device configuration, forcing a wait between each PIN attempt and limiting how many PINs can realistically be tried within a given time window. Passware Kit detects the lockout interval and calculates the estimated recovery time for the chosen wordlist.

Ready-made Dictionaries

On the Recover PIN step, Passware Kit offers two options for the PIN wordlist:

• Popular 4- and 6-digit PINs (built-in). 
  This is the default ready-to-use list, ordered by real-world frequency, so the most probable PINs are tried first: sequences (`1234`, `123456`), repeated digits (`0000`, `111111`), years, and keypad patterns are at the top. The list consists of 2,016 candidates, so for a 10-minute lockout the estimated brute-force time is 2 weeks.
• Custom wordlist. 
  • Use a custom TXT file — either a single known PIN or a list of candidates. Prepare it as a plaintext file in UTF-8 encoding with one PIN per line. Passware Kit preserves the original order of the entries.  
  • Use one of the ready-made dictionaries listed below. Each dictionary is trimmed to a specific lockout-interval and time-budget combination and holds the most-probable PINs that can be tested within that window, with 4- and 6-digit PINs alternated (4, 6, 4, 6, ...) so both lengths are covered.

The same PIN dictionaries also work as custom dictionaries for mobile device screen-lock PIN recovery in Passware Kit Mobile.