BitLocker PIN recovery

Starting with version 2026.3, Passware Kit provides a decryption solution for devices where a BitLocker PIN is also set: in such cases, the PIN should be recovered prior to acquiring the VMK. This feature is available in Passware Kit Ultimate and Device Decryption Add-on.

The BitLocker startup PIN can be 4 to 20 characters long. It is numeric by default and typically consists of either 4 or 6 digits. When the "Allow enhanced PINs for startup" group policy is enabled, an enhanced PIN can be alphanumeric, containing uppercase and lowercase letters, numbers, symbols, and spaces.

Passware Tip: For Windows 10/11, the minimum BitLocker PIN length is 6 characters. Passware Kit detects whether the target uses a digits-only PIN.

The BitLocker startup PIN is protected by the TPM's authorization lockout: after a number of failed attempts, the TPM stops accepting guesses, then restores one PIN attempt after each lockout interval. This interval is either 10 minutes or 2 hours, depending on the device configuration, forcing a wait between each PIN attempt and limiting how many PINs can realistically be tried within a given time window. Passware Kit detects the lockout interval and calculates the estimated recovery time for the chosen wordlist.

Ready-made Dictionaries

On the Recover PIN step, Passware Kit offers two options for the PIN wordlist:

• Popular 4- and 6-digit PINs (built-in). 
  This is the default ready-to-use list, ordered by real-world frequency, so the most probable PINs are tried first: sequences (`1234`, `123456`), repeated digits (`0000`, `111111`), years, and keypad patterns are at the top. The list consists of 2,016 candidates, so for a 10-minute lockout the estimated brute-force time is 2 weeks.
• Custom wordlist. 
  • Use a custom TXT file — either a single known PIN or a list of candidates. Prepare it as a plaintext file in UTF-8 encoding with one PIN per line. Passware Kit preserves the original order of the entries.  
  • Use one of the ready-made dictionaries listed below. Each dictionary is trimmed to a specific lockout-interval and time-budget combination and holds the most-probable PINs that can be tested within that window, with 4- and 6-digit PINs alternated (4, 6, 4, 6, ...) so both lengths are covered.

NOTE: A PIN dictionary narrows the search to the most likely candidates; it does not guarantee recovery, especially if the actual PIN is longer than 6 characters.

The same PIN dictionaries also work as custom dictionaries for mobile device screen-lock PIN recovery in Passware Kit Mobile.