A Recall encryption error stops the feature cold: snapshots pause, the timeline may refuse to open, and Windows warns that something is wrong with how snapshots are protected. It sounds alarming, but the error is actually Recall doing its job — it would rather stop than store your screen history unprotected. The task is to restore the encryption chain so Recall can run safely again.

Encryption errors almost always trace back to identity or hardware security: a changed PIN, a Microsoft account switch, a TPM hiccup, or an update that interrupted key storage. Because snapshots are encrypted to your specific sign-in state, anything that breaks that binding breaks Recall until it is repaired. The fixes below move from the least destructive to the most, so you only lose old snapshots if nothing else works.

Related NPU and driver health matters here too, since the secure pipeline involves several components. If you have seen a DirectML error on the NPU or own an Asus Vivobook S14 with AI issues , check those alongside this guide. And if Copilot itself is misbehaving, our guide to Copilot app crashing covers the account-side checks that overlap with encryption problems.

Why this happens

  • PIN or password changed: Snapshots are encrypted to your sign-in credentials, so changing them without a clean handover can break key access.
  • Microsoft account switched: Signing in with a different account orphans snapshots encrypted to the previous one.
  • TPM problem: The Trusted Platform Module stores key material, and a TPM error, reset, or firmware issue breaks the chain.
  • Windows Hello reset: Removing and re-adding Windows Hello without clearing old state can leave Recall pointing at stale keys.
  • Interrupted update: An update that stops midway can corrupt the key store or the snapshot database’s encryption metadata.
  • BitLocker or device encryption changes: Altering disk encryption settings can interfere with the keys Recall depends on.
  • Corrupted snapshot database: Damage to the snapshot store’s encryption headers makes existing snapshots unreadable even when keys are fine.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Confirm you are signed in with the original account

The fastest explanation is an account mismatch. If you recently switched accounts or changed sign-in methods, returning to the original account often restores key access immediately, with no data loss at all.

  1. Open Settings, go to Accounts, and confirm the signed-in Microsoft account.
  2. If it differs from the account used when snapshots were created, switch back.
  3. Sign out and back in to refresh the session.
  4. Open Recall and check whether the error clears.
  5. If you must keep the new account, accept that old snapshots may need clearing.
  6. Confirm new snapshots begin saving under the current account.

Fix 2: Re-establish Windows Hello cleanly

Windows Hello is the front door to Recall’s encryption. Removing and re-adding your PIN or face cleanly — rather than layering a new credential over a broken one — can restore the key binding Recall needs.

  1. Open Settings, go to Accounts, then Sign-in options.
  2. Remove your PIN and Windows Hello face data.
  3. Restart your PC.
  4. Re-add your PIN first, then face recognition.
  5. Sign in with the new credentials.
  6. Open Recall and check whether the encryption error is gone.

Fix 3: Check TPM health

The TPM holds the keys, so a TPM error will block Recall even when everything else looks right. A quick check in the TPM management console or Device Manager tells you whether the TPM is ready or needs attention.

  1. Press Windows + R, type tpm.msc, and press Enter.
  2. Check the TPM status — it should report ready for use.
  3. If it shows an error, note the exact message.
  4. Open Device Manager and check the Security devices section for warnings.
  5. Restart and enter your firmware settings to confirm the TPM is enabled.
  6. Return to Windows and retest Recall.

Fix 4: Install pending Windows updates

Encryption pipeline bugs are fixed in cumulative updates, and an update that previously failed midway may have left key components in a half-updated state. Bringing Windows fully up to date repairs those components and often clears the error without further action.

  1. Open Settings, go to Windows Update.
  2. Select Check for updates and install everything offered.
  3. Restart when prompted, even if the update seems minor.
  4. Re-check Recall settings after the restart.
  5. Confirm the encryption error is gone and snapshots resume.
  6. See the official Windows support pages for known encryption issues.

Fix 5: Clear the TPM only if advised and prepared

Clearing the TPM is a bigger step: it wipes stored keys, which means old Recall snapshots become permanently unreadable. Only do this when the TPM is confirmed faulty and you have accepted losing old snapshots — and back up BitLocker recovery keys first, since TPM clearing can affect disk encryption too.

  1. Back up your BitLocker recovery key if BitLocker is enabled.
  2. Open tpm.msc and choose Clear TPM, following the prompts.
  3. Restart when asked and confirm the clear in firmware if prompted.
  4. Sign in and re-establish Windows Hello.
  5. Open Recall and allow it to initialise fresh encryption.
  6. Confirm new snapshots save without errors.

Fix 6: Reset the snapshot store as a last resort

If keys are unrecoverable, the snapshot store itself must be reset so Recall can start with fresh encryption. This deletes old snapshots, but it is the only path back to a working Recall when the old key material is gone for good.

  1. Accept that existing snapshots will be lost.
  2. Close the Recall app completely.
  3. Open Settings, go to Privacy & security, then Recall & snapshots.
  4. Choose the option to delete all snapshot data.
  5. Confirm and wait for the reset to complete.
  6. Reopen Recall and verify new snapshots save without encryption errors.

Fix 7: Check BitLocker and device encryption state

Disk encryption changes can ripple into Recall’s key chain. Confirm BitLocker or device encryption is in a healthy, unlocked state, and suspend and resume protection once if it reports errors — this re-syncs the encryption stack Recall depends on.

  1. Open Settings, go to Privacy & security, then Device encryption or BitLocker.
  2. Confirm protection is on and shows no errors.
  3. If errors appear, suspend protection, restart, then resume it.
  4. Confirm Windows Hello still works after the cycle.
  5. Open Recall and test snapshot capture.
  6. If errors persist, contact your PC manufacturer’s support with the exact error text.

Closing

A Recall encryption error feels serious because it involves security, but it is usually a broken key binding, not a breach. Work through account, Windows Hello, and TPM checks before accepting snapshot loss, and only reset the store when the old keys are genuinely unrecoverable. Once Recall is encrypting cleanly again, your timeline is protected the way it was designed to be — private, local, and accessible only to you.

Frequently asked questions

What causes a Recall encryption error?
The error usually means Recall cannot access the encryption keys tied to your sign-in, often after a PIN change, account change, TPM issue, or interrupted update. Because snapshots are encrypted by design, Recall refuses to run rather than store them unprotected.
Will fixing the encryption error delete my snapshots?
It can, in some cases. If the old keys are unrecoverable, existing snapshots cannot be decrypted and must be cleared before Recall can start fresh. Back up anything important first, but expect that old snapshots may be lost in severe cases.
Is my data at risk when this error appears?
No — the error means Recall is refusing to proceed without valid encryption, which is the safe behaviour. Your snapshots remain encrypted on disk and are not exposed by the error itself.
Can I turn off Recall encryption to avoid the error?
No, and you should not try. Encryption is a core protection for Recall snapshots and cannot be disabled. The correct fix is restoring healthy keys and sign-in, as described in this guide.