Microsoft's New Hardware-Accelerated BitLocker Promises to Double NVMe Speeds, But Requires Unreleased CPUs

For nearly two decades, Microsoft's BitLocker has been the built-in solution for full-disk encryption on Windows, offering security at the cost of performance. As storage technology has leaped forward with blisteringly fast NVMe SSDs, the computational overhead of software-based encryption has become a significant bottleneck. Microsoft is now addressing this long-standing issue head-on with a new hardware-accelerated version of BitLocker, promising to restore lost performance and improve efficiency, though its rollout is tied to future, unreleased processor hardware.

Microsoft Aims to Fix a Self-Inflicted Performance Problem

The performance issue with BitLocker is particularly acute because, on new installations of Windows 11 Pro, Microsoft enables software-based encryption by default. This choice forces the main CPU to handle all encryption and decryption tasks, which can reduce SSD performance by up to 45% according to internal testing. While most modern SSDs have built-in, performance-neutral hardware encryption (TCG Opal), accessing it on Windows requires complex, often undocumented configuration steps. Microsoft's new initiative effectively creates a new, CPU-based hardware acceleration path to solve a performance penalty that its own default settings helped create.

How Hardware-Accelerated BitLocker Works

The core of the new technology is the offloading of cryptographic operations from the software running on the general-purpose CPU cores to a dedicated, fixed-function "crypto engine" embedded within the System-on-a-Chip (SoC). This specialized hardware is designed specifically for encryption tasks, making it far more efficient. Furthermore, the feature includes hardware-wrapping of BitLocker's encryption keys. This process shields the keys from potential exposure through CPU or memory-based vulnerabilities, adding a tangible security improvement alongside the performance gains.

Significant Performance and Efficiency Claims

Microsoft has shared compelling data on the expected benefits. In a demonstration using CrystalDiskMark, a drive using software-based BitLocker achieved sequential read speeds of 1632 MB/s. The same drive with hardware-accelerated BitLocker enabled reached 3746 MB/s—more than double the performance. Write speeds showed a similar dramatic improvement, jumping from 1510 MB/s to 3530 MB/s. Beyond raw speed, Microsoft claims the new system can reduce the CPU cycles required for BitLocker workloads by up to 70%. This reduction in computational overhead directly translates to lower power consumption, which should result in measurably improved battery life for laptops.

Performance Comparison (CrystalDiskMark Sequential Workloads):

Limited Initial Availability and Requirements

The major caveat to this promising technology is its immediate availability. As of late December 2025, the feature is only supported on devices with Intel vPro platforms based on the upcoming Intel Core Ultra Series 3 "Panther Lake" CPUs, which are not yet on the market. Microsoft has stated it is looking to extend support to other vendors and platforms in the future. The feature also has specific technical prerequisites: it will only function when volumes are encrypted using the XTS-AES-256 algorithm (or others later supported by the SoC vendor) and is already integrated into Windows 11 versions 24H2 and 25H2 for when compatible hardware arrives.

Key Technical Requirements & Availability:

• Core Technology: Offloads encryption to a dedicated crypto engine in the SoC.
• Default Algorithm: XTS-AES-256.
• Windows Version: Available in Windows 11 24H2 (Sept 2025 Update) and 25H2.
• Initial Hardware Support: Intel vPro platforms with upcoming Intel Core Ultra Series 3 ("Panther Lake") CPUs.
• Additional Benefit: Up to 70% reduction in required CPU cycles for BitLocker workloads.
• Management: Configurable via enterprise group policies.

A Step Forward, But a Slow Rollout

The introduction of hardware-accelerated BitLocker represents a meaningful, if belated, acknowledgment by Microsoft that encryption must evolve to keep pace with modern storage. By leveraging dedicated silicon, it promises to make robust security virtually invisible in terms of performance impact for tasks like professional video editing, large-scale code compilation, and gaming. However, its dependency on next-generation CPU hardware means most users will not benefit from these improvements for some time. For enterprise IT administrators, the feature will be configurable via group policy, allowing organizations to customize or disable it as needed. While the wait for compatible hardware may be frustrating, the direction is clear: the future of performant, full-disk encryption on Windows lies in dedicated hardware acceleration.