Find Bluetooth Pairing Keys in Windows Registry

This article explains the exact registry location where Windows stores system-wide Bluetooth pairing authorization keys, how these keys are structured by device MAC addresses, and the specific administrative permissions required to view or modify them in the Registry Editor (Regedit).

Registry Location for Bluetooth Pairing Keys

The system-wide Bluetooth pairing authorization data and link keys are stored under the following path in the Windows Registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys

Key Hierarchy and Structure

Within the Keys container, Windows organizes pairing data hierarchically:

  1. Local Adapter Subkey: Inside Keys, you will find subkeys named after the MAC address of your host machine’s Bluetooth adapter (e.g., 001a7dda7107).
  2. Paired Device Values: Inside the local adapter subkey, paired devices are listed as individual registry values. The value names correspond to the MAC address of each paired peripheral, and the binary data associated with each entry contains the cryptographic link key used for mutual authentication and pairing authorization.

Required Permissions to Access the Key

By default, standard Administrator accounts cannot open or view the contents of the BTHPORT\Parameters\Keys directory due to strict Access Control Lists (ACLs) set by the operating system. Attempting to open it in Regedit will result in an “Access is denied” error.

To view or export these configuration keys, you must elevate your access:

  1. Change Ownership and Permissions: Right-click the Keys folder in Regedit, select Permissions, click Advanced, change the owner to your Administrator account or Administrators group, and grant Full Control.

  2. Run Regedit as SYSTEM: Alternatively, launch Regedit under the NT AUTHORITY\SYSTEM account using Sysinternals PsExec with the command:

    psexec.exe -s -i regedit.exe

Running under the SYSTEM context grants immediate read and write access to all stored pairing records without modifying security permissions.