Product-line change (2026-07-17)
Foundation discontinued the classic Passport. The 349 Passport Prime** — a multi-function “security platform” (Bitcoin + 2FA + passkeys + encrypted files + a KeyOS app store), not the minimal Bitcoin-only air-gap signer the classic Passport was. The classic-Passport detail below remains accurate for existing owners; current buyers get Prime (see the dedicated section). Prime’s honest trust profile: Bitcoin-only and air-gap are now partial (first-party wallet is Bitcoin-only but the platform runs altcoin apps; it adds Bluetooth + NFC); reproducible builds are not yet available; but it’s open-source (GPLv3), independently audited (Keylabs), and exports a standard BIP-39 seed.
Foundation Passport (the classic device, made by Foundation Devices, Boston) was the hardware wallet most strongly associated with strict QR-only air-gap signing — no USB, Bluetooth, or NFC bidirectional channel; transactions moved exclusively via QR codes scanned through the built-in camera. It shipped as the Passport Batch 2 / "Passport Core" (349), keeps the polished UX and QR/microSD air-gap option but pivots to a broader, connected multi-function platform — a different value proposition, weaker on the minimal-Bitcoin-only-verifiable axes (loses Bitcoin-only purity, strict air-gap, and reproducible builds) while gaining an independent audit, SLIP-39 keycard backup, and stronger BIP-85/multisig. Passport was the canonical choice for the air-gap-disciplined holder who valued UX polish — often the right "second key" in a vendor-diverse multisig paired with Coldcard.
What this is
Vendor: Foundation Devices (Boston, Massachusetts, founded 2020). The company was founded by Zach Herbert and a small Bitcoin-focused team with an explicit Bitcoin-only and open-source-first orientation. Foundation has a distinctive aesthetic — the Passport’s industrial design is more polished than most competitors — that has built a substantial user community.
Product line as of 2026-07-17:
- Passport Prime ($349) — the only current device. A multi-function “security platform” (see the dedicated section below). This is what a buyer gets today.
- Passport Batch 2 / “Passport Core” ($199 historical) — the classic QR-only, Bitcoin-only flagship. Renamed “Passport Core” in Mar 2025 and discontinued (no longer sold; warranty still honored for existing units). Colour touchscreen, full Taproot support, removable rechargeable Li-ion cell (Nokia BL-5C, USB-C charge). Still firmware-supported for existing owners; the operational detail throughout this note describes this device.
- Passport Batch 1 (2020–2022; ~$259 historical) — original. Still firmware-supported; holders who own one need not upgrade urgently.
Passport Prime (current device)
Added 2026-07-17. Sourced from foundation.xyz, the Keylabs audit, and independent reviews (WalletInsights, The Bitcoin Hole).
Passport Prime ($349, launched 2025) is Foundation’s pivot from a single-purpose Bitcoin signer to a programmable “Human Authority Hardware” security platform. One device secures Bitcoin plus FIDO/passkey security keys, TOTP/2FA codes, and ~50 GB of encrypted files, running third-party apps on a KeyOS Rust microkernel (app showcase includes a password manager, a Nostr event signer, and a Cake Wallet signer — the latter is how altcoins become possible).
- Hardware: 3.5” IPS Gorilla Glass colour touchscreen + QWERTY keyboard, anodized aluminium body, integrated (non-removable) rechargeable Li-ion, assembled in the USA. ATECC608C secure element + SAMA5D2 security processor with secure boot.
- Bitcoin capability: the first-party wallet is Bitcoin-only — PSBT, multisig up to 15 signers, output-descriptor export for Sparrow/Specter/Nunchuk. BIP-85 child seeds and a BIP-39 passphrase (hidden wallets) are supported; the on-device keyboard makes passphrase entry easy.
- Backup: default is a 2-of-3 Shamir (SLIP-39) split across three tamper-evident NFC keycards (any two reconstruct; losing one isn’t fatal) — but standard BIP-39 12/24-word export/import is supported, so there’s no lock-in.
- Connectivity: QR (animated UR2.0), microSD, NFC, and post-quantum-encrypted “QuantumLink” Bluetooth; pairs with Envoy (iOS/Android) + desktop coordinators. It can run fully air-gapped over QR/microSD, but the added Bluetooth + NFC mean it is not strictly air-gapped like the classic Passport was.
- Trust posture: open-source hardware + software (GPLv3); independently audited by Keylabs (the wallet.fail team) with no critical/high findings. Reproducible builds are not yet available — you can read the source but can’t yet confirm the shipped firmware matches it.
- Honest take for a self-custody audience: an audited, polished, US-assembled platform that consolidates several security devices — but at $349 it’s more device (and cost) than a first Bitcoin wallet needs, and on the exact axes a minimalist values (Bitcoin-only, strict air-gap, reproducible/verifiable firmware, smallest attack surface) it is a step sideways. Best for a Bitcoin-first power user who genuinely wants the 2FA/passkey/file consolidation; a purist wanting the smallest verifiable Bitcoin-only signer should look at Coldcard, BitBox02, or a Trezor Safe.
Foundation has also developed companion products (Envoy mobile app, the eventual full Foundation Passport platform); the hardware-wallet product remains the core.
Firmware: Fully open-source under Apache 2.0 (OSI-approved). Reproducible builds; independent reviewers can verify.
Secure element: Microchip ATECC608A. Standard for the modern hardware-wallet architecture; physical-attack resistance comparable to Coldcard, BitBox02, and Trezor Safe series.
Air-gap posture: The Passport’s defining design choice. The device has no USB data connection (USB-C is power-only — it charges the device’s removable rechargeable battery — and carries no data). All transaction transfer happens via QR codes: the coordinator displays a PSBT QR (possibly animated, for large PSBTs); the Passport camera scans it; the holder verifies on-screen; the Passport displays the signed PSBT as a QR; the coordinator scans it back. No bidirectional digital channel exists between the Passport and the network-connected host.
This is structurally stronger air-gap than any device with USB connectivity. The trade-off is workflow speed.
Who this is for
Passport is a strong fit for:
- Strict air-gap holders — the principal use case; the only mainstream hardware wallet with no USB data connection
- Multi-vendor multisig users — Passport pairs cleanly with Coldcard or BitBox02 as the air-gap key in a 2-of-3 or 3-of-5
- Holders who value UX polish — Foundation’s design quality is the cleanest in the market; the device feels like a well-made consumer product
- Open-source-aligned holders — Apache 2.0 firmware, reproducible builds
- Bitcoin-only purists — the firmware excludes altcoin code
- Long-horizon holders — the removable rechargeable battery (a standard Nokia BL-5C cell) means a worn cell can be swapped rather than bricking the device — a small detail that matters for 20+ year cold-storage horizons
Passport is less appropriate for:
- Frequent signers — the QR workflow adds steps; for active spending, USB-connected devices are operationally lighter
- BIP-85 power users — Passport’s BIP-85 support is more limited than Coldcard’s; for serious child-seed workflows, Coldcard is structurally better
- SLIP-39 users — no SLIP-39 support; use Trezor instead
- Very budget-constrained holders — Blockstream Jade at 199 reflects the design quality and air-gap engineering
Features and capabilities
Passport Batch 2 specifics (current)
- Colour touchscreen — large, legible, gesture-friendly
- Camera — 8MP for QR code scanning; the input side of the air-gap workflow
- MicroSD slot — for firmware updates and as a backup signing channel
- Removable rechargeable battery — a swappable Nokia BL-5C lithium-ion cell charged over USB-C; eliminates battery-failure-as-device-failure modes (a worn cell can simply be replaced)
- USB-C — power-only; no data; charging-only USB by design
- NFC — for tap-to-receive in some workflows (still no signing channel)
Common to Passport line
- Bitcoin-only firmware — no altcoin code paths
- Native multisig — multi-vendor friendly; pairs cleanly with Coldcard and BitBox02
- PSBT v2 — full handling, including animated QR codes for large PSBTs
- BIP-380 output descriptors
- Taproot support (Batch 2)
- BIP-39 passphrase support — entered on the touchscreen
- BIP-85 — supported but with limited variants compared to Coldcard
- The Envoy mobile app — Foundation’s companion app for mobile workflow
Passport-specific quirks
- No USB data connection — the air-gap is genuine, not just optional. This is the defining design choice.
- Animated QR codes for large PSBTs — when a transaction is too large for a single QR code, Passport scans an animated sequence of QR frames. Works well in practice but is slower than reading a single QR.
- The Envoy app integration — Foundation’s mobile companion handles the desktop-coordinator role for many users; pairs cleanly with the QR workflow
- The hardware itself is more durable than most — solid construction; the removable battery and rugged casing reflect a design philosophy of “build something that lasts”
Tradeoffs vs alternatives
| Dimension | Passport Batch 2 | Coldcard Q | Coldcard Mk4 | BitBox02 BTC-only | Trezor Safe 5 |
|---|---|---|---|---|---|
| Price | $199 | $249 | $150 | $137 | $129 |
| Bitcoin-only | Yes | Yes | Yes | Yes | No |
| Open-source | Yes (OSI Apache 2.0) | Source-available | Source-available | Yes (OSI) | Yes (GPL) |
| Secure element | Yes | Yes | Yes | Yes | Yes (EAL 6+) |
| Air-gap signing | Yes (QR-only, no USB data) | QR + MicroSD | MicroSD only | No | No |
| Native SLIP-39 | No | No | No | No | Yes |
| BIP-85 | Limited | Excellent | Excellent | Good | Good |
| Touchscreen | Yes (colour) | Yes (colour) | No | No | Yes (colour) |
| Removable battery | Yes (rechargeable Li-ion) | Yes (AA) | No | No | No |
| Lopp 100-input signing | Fast | Fast | Fast | Fast | Moderate |
Compared to Coldcard Q: both have QR signing; Passport is purer air-gap (no USB data at all); Coldcard Q has full QWERTY for passphrase entry and stronger BIP-85; Passport has the design polish.
Compared to BitBox02: BitBox is USB-only; Passport is strict air-gap. Both are fully open-source Bitcoin-only. The pairing of Passport (air-gap) + BitBox (USB-connected) is a clean multi-vendor multisig configuration.
Compared to Trezor: Trezor has SLIP-39; Passport has stronger air-gap and is Bitcoin-only. Different use cases.
Setup and operation
The setup flow:
- Verify packaging — Foundation ships with tamper-evident seals
- Power on — insert the charged battery (or charge via USB-C); the device boots; no USB data connection needed
- Configure — set PIN; the touchscreen makes this straightforward
- Generate seed — Passport displays 12 or 24 words; the holder records them
- Verify the seed — on-device check
- Optionally set up a passphrase — entered via touchscreen
- Pair with a coordinator via QR — Envoy app, Sparrow, Specter, Nunchuk all support Passport’s QR workflow. The coordinator displays the wallet-setup QR; Passport scans it; the coordinator now knows the wallet’s xpub for watch-only and address generation.
The signing flow:
- Coordinator builds the PSBT
- Coordinator displays the PSBT as a QR code (possibly animated for large PSBTs)
- Passport camera scans the QR code; touchscreen shows the parsed transaction
- Holder verifies destination addresses and amounts on the Passport’s screen
- Holder confirms via touch
- Passport displays the signed PSBT as a QR code on its own screen
- Coordinator scans the signed-PSBT QR back
- For multisig, the same QR-based flow with the next device
- Coordinator finalizes and broadcasts
The QR workflow is the central UX element. Once the holder is comfortable with it, the friction is modest. First-time users sometimes struggle with the camera-positioning and the QR-scan timing; this is operational familiarity rather than design flaw.
Security considerations
Strengths
- Strict QR-only air-gap — no bidirectional digital channel; structurally the strongest physical-isolation posture in mainstream hardware wallets
- Open-source firmware (Apache 2.0, OSI-approved); reproducible builds
- Bitcoin-only firmware — reduces attack surface
- Secure element — physical-attack resistance
- Removable batteries — eliminates “device dead” as a recovery failure mode
- Polished UX — the design quality reduces operational errors
Known concerns
- The camera as an attack vector — Passport’s camera is the input side of the air-gap. A malicious QR code can in principle exploit parser vulnerabilities. Foundation’s firmware is audited but the camera-parser code is unique attack surface that USB-connected devices don’t have.
- Animated QR reliability — for very large PSBTs, the animated QR can fail to scan reliably; the holder may need to retry. This is more annoying than dangerous but is a real friction point.
- Smaller company — Foundation has fewer engineers than Satoshi Labs or Ledger; firmware patches may take longer to ship. Track record so far has been reasonable.
- Less mature BIP-85 — for holders who run BIP-85 workflows, Passport is less complete than Coldcard.
- Envoy mobile app dependency — some Passport workflows assume Envoy; holders who use only desktop coordinators are fine but the Envoy-first marketing can be confusing.
Supply-chain integrity
Buy directly from foundationdevices.com. Tamper-evident packaging; the Boston-based assembly provides some supply-chain transparency.
The 2020 Ledger leak does not affect Foundation; the customer database has not had a public leak. Foundation’s small size means the customer base is smaller and less of a target.
Pricing and acquisition
As of 2026-07-17 (prices reverified; prior review 2026-07-15):
- Passport Prime: $349 USD — the only current device (multi-function platform; see the dedicated section)
- Passport Batch 2 / Passport Core: discontinued (was $199) — no longer sold; existing holders supported
- Passport Batch 1: not actively sold; existing holders supported
- Replacement battery (Batch 2/Core only): a standard Nokia BL-5C lithium-ion cell; readily available. (Prime’s battery is integrated / non-removable.)
Authorized channels: foundationdevices.com directly. Some authorized resellers (Bitcoin-focused stores). Avoid generic marketplaces.
Common pitfalls
Buying Passport for the wrong use case. Passport’s strict air-gap is a workflow trade-off. Holders who want USB-speed signing should not buy Passport; the friction will lead to under-use of the device.
Skipping the wallet-setup QR pairing. The coordinator needs the Passport’s xpub to operate as a watch-only wallet. The setup-time QR exchange is essential.
Treating the camera as a privacy risk. The camera is for QR scanning only; it doesn’t transmit images anywhere. The privacy concern is misplaced.
Forgetting to keep the battery charged (or a spare). The removable-battery design is a feature, but the holder must keep the rechargeable cell charged or have a charged spare available. Some Passport users keep a spare Nokia BL-5C cell near the device storage location.
Animated QR codes for very large transactions. Some 100+ input PSBTs produce animated QR sequences that take time to scan reliably. For holders signing very large multisig transactions, Coldcard’s MicroSD option is faster.
Three Passports in multisig. Defeats vendor diversity. Pair Passport with Coldcard, BitBox02, or Trezor.
Buying Batch 1 in 2026. Batch 2 has been the current product since late 2023; Batch 1 is supported but the UX is meaningfully better on Batch 2.
Tooling and resources
Foundation documentation (as of 2026-05-14):
- foundationdevices.com — official site
- Passport user manual — comprehensive
- Foundation Devices blog — release notes, firmware advisories
- Zach Herbert’s writing — running commentary on Foundation’s positioning
Coordinator software supporting Passport:
- Envoy (Foundation’s official app) — desktop and mobile; designed for Passport
- Sparrow Wallet — strong multi-vendor support
- Specter Desktop — multisig-focused
- Nunchuk — desktop and mobile
The synthesis document: Bitcoin Self-Custody & Security (LegacyCipher, April 2026) — Passport treated as the canonical strict-air-gap choice with a clean UX.
As of 2026-07-17: the classic Passport (Batch 2 / Passport Core) is discontinued; firmware is still updated for existing owners. Foundation now sells only the Passport Prime ($349), a multi-function security platform running KeyOS (see the dedicated section above). (Prior review 2026-07-15.)
Open questions for further development
- The camera-parser attack surface is unique to QR-signing devices. Has the empirical record validated this as a real concern, or is it primarily theoretical?
- Foundation’s smaller engineering team is a structural concern for long-term firmware support. Are there contingency arrangements (open-source community continuity, alternative firmware paths) that would protect existing holders if Foundation were to wind down?
- Passport’s design polish is genuine but the marketing emphasis sometimes overstates the security implications. How much weight does UX quality actually carry against the realistic threat models? The synthesis treats it as a real but modest factor.
Related notes
The framing context:
- Hardware wallets overview — the framework
- Self-custody configuration ladder — Passport fits across Configurations 1, 2, 4, 5
Per-device alternatives:
- Coldcard — the power-user complement; canonical multisig pairing with Passport
- BitBox — the USB-connected Bitcoin-only alternative
- Trezor — the SLIP-39 alternative
- Blockstream Jade — the budget alternative
- Bitkey
- Ledger considerations and tradeoffs
Relevant capabilities:
- BIP-85 child seeds — Passport’s support is more limited than Coldcard’s
- PSBT and wallet descriptors
- Passphrases and the 25th word
- Seed phrases and BIP-39
- Hot vs cold storage — Passport sits in strict-cold
Custody configurations:
- Multisig setups — Passport as the air-gap key
- Collaborative custody services
Operational practice:
The principal practitioners:
The sub-MOC home: