Find Bluetooth Authorization Keys in Regedit

This article outlines the exact Windows Registry locations where system-wide Bluetooth device authorization caches, pairing records, and cryptographic link keys are stored. It details the primary registry paths used by the Windows Bluetooth driver stack, explains the role of each subkey, and describes the permissions required to access protected authorization data.

Primary Registry Path for Bluetooth Authorization

Windows manages system-wide Bluetooth pairing and authorization data within the BTHPORT service parameters. You can locate these configuration keys under the following paths in the Registry Editor (regedit):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters

Inside this directory, two primary subkeys handle authorization and device cache data:

1. Device Authorization and Link Keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys

• Purpose: Contains the actual authentication link keys and encryption pairing records for authorized devices.
• Structure: Organized by local Bluetooth adapter MAC address as a subkey, containing individual entries for each paired remote device’s MAC address.
• Access Note: By default, this key is restricted to the SYSTEM account. Standard administrators must take ownership or launch regedit using PsExec -s -i regedit.exe via Sysinternals to view or edit the values.

2. Device Property and State Cache

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices

• Purpose: Stores cached configuration attributes, service flags, and connection states for authorized peripheral devices.
• Structure: Listed by the MAC address of each connected device. Values inside include device classes, authorization timestamps, and supported Bluetooth profiles.

How to Navigate to the Keys

1. Press Win + R, type regedit, and press Enter.
2. Paste HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters into the address bar at the top and press Enter.
3. Expand Keys to view paired device authorization secrets, or expand Devices to view cached device attributes.