The Passport Core is no longer sold (updated 7 November 2026). Foundation announced in March 2026 that it had discontinued it, and says it remains fully supported, with security updates and all warranties honoured. Foundation now sells only the Passport Prime (€388.95 on foundation.xyz, November 2026), a different device that we have not reviewed. This review is for people who already own a Passport. If you are buying a hardware wallet today, start with Ledger vs Trezor and Beyond, which compares the devices on sale now.
Foundation Passport Core Review: The Bitcoin-Only, Air-Gapped Signing Device
The Passport Core is a hardware wallet that never connects to anything. It exchanges data only through QR codes and a microSD card, and Foundation publishes its firmware and circuit designs for anyone to inspect. This guide shows how that works, which parts of the design protect your bitcoin, and what to do with one now that Foundation no longer sells it.
If you are choosing a hardware wallet for the first time, our hardware wallet buying guide covers the devices you can buy today and helps narrow down what matters most for your situation.
Product Specifications
| Feature | Specification |
|---|---|
| Price | No longer sold (it launched in 2022 at $199) |
| Manufacturer | Foundation Devices (USA) |
| Coins Supported | Bitcoin only |
| Connectivity | Air-gapped (camera + microSD), USB-C for charging only |
| Secure Element | Microchip ATECC608 |
| Processor | STM32H753 |
| Screen | 2-inch colour IPS display under cover glass |
| Battery | Removable BL-5C lithium-ion (a standard phone battery format) |
| Body | Copper-plated zinc alloy frame, plastic front |
| Open Source | Yes — firmware (GPLv3, with some parts under MIT and other compatible licences), circuit designs (CERN-OHL-S v2) |
Unboxing and First Impressions
In the box you get the device with its removable battery, a microSD card, microSD adapters for iPhone and Android phones (so your phone can read and write the card), and a USB-C charging cable. Have paper ready: when it creates your wallet, the Passport shows your recovery words. Write them down by hand and keep them only on paper or metal, never in a phone or a photo.
The Passport feels solid in the hand: its frame is die-cast zinc alloy plated with copper, with a plastic front. The form factor is unusual — tall, narrow, almost like a small remote control — but it fits comfortably in a single hand, and the physical buttons have a satisfying tactile click.
The IPS display is noticeably better than what you find on most competing devices. Text is sharp, QR codes render cleanly for scanning, and viewing angles are wide enough that you do not need to hold the device at an awkward angle to read it.
Design and Build Quality
Foundation leaned hard into industrial design with the Passport. Its published bill of materials lists a frame of die-cast zinc alloy, plated with copper and clear-coated, and a plastic front housing. There is a camera module on the back for scanning QR codes, a microSD card slot on the side, and a USB-C port on the bottom that is wired for power delivery only — no data lines are connected.
The removable battery is a standout feature. Most hardware wallets either use a sealed internal battery or no battery at all. The Passport’s lithium-ion battery, a standard BL-5C phone battery, is user-replaceable, which matters for a device you might store for years. Batteries degrade over time, and being able to swap one out without opening the case or voiding any security guarantees is a practical advantage.
The physical keypad uses a directional pad and labeled buttons rather than a touchscreen. This is a deliberate security choice — touchscreens increase the attack surface and add complexity to firmware. The tradeoff is slower text entry, but for a device where you primarily confirm transactions and scan QR codes, the keypad works well.
Setup Process
Foundation’s Envoy companion app, available on iOS and Android, is the easiest way to set up the Passport, though Foundation also documents a manual setup without it, and you can pair the Passport with another wallet such as Sparrow. Envoy walks you through the process step by step, and communication between the phone and the Passport happens entirely through QR codes — no Bluetooth, no WiFi, no USB data transfer.
During setup, you can either generate a new seed phrase on the device or import an existing one. The Passport supports standard BIP39 seed phrases (12 or 24 words) as well as SeedQR, which encodes your seed as a compact QR code for faster backup and restore. If you import a seed, you can type it in using the keypad or scan a SeedQR.
The device also supports BIP39 passphrases: a secret of your choice that, together with your words, opens a separate wallet. The Passport never stores it and cannot reject a wrong one, which simply opens a different wallet. For a deeper explanation of how passphrases work and when they make sense, see our guide on cryptocurrency wallet passphrases and recovery best practices.
Envoy shows the balance and history only of the accounts you pair with it. Each extra account you create on the Passport, and each account in a passphrase wallet, has to be paired separately. If you restored an existing seed and older transactions are missing, use Rescan Account in Envoy. The entire setup takes about 10 to 15 minutes, which is reasonable given the air-gapped workflow.
Security Architecture
Security is where the Passport makes its strongest argument. The air-gapped design means the device has no mechanism for direct digital communication with any other device. There is no Bluetooth radio, no WiFi module, no NFC chip, and the USB-C port carries power only. Every piece of data that enters or leaves the device goes through QR codes (read by the camera, shown on the screen) or the microSD card slot.
This approach eliminates entire categories of remote attacks. There is no wireless protocol to exploit, no USB stack to compromise, and no network connection to intercept. The tradeoff is convenience — you need to physically scan QR codes or shuttle a microSD card to sign transactions — but for cold storage of meaningful amounts of Bitcoin, that tradeoff is usually worth making.
The Microchip ATECC608 secure element is a chip built to guard secrets: it runs no code of its own and keeps sensitive data in protected storage slots. The STM32H753 general-purpose processor runs the firmware, the display and the buttons. Foundation splits the work between them: the processor encrypts your seed with a secret that only it keeps, and the secure element stores the encrypted copy, so the data stored on either chip reveals nothing on its own. The processor still holds your keys in its memory while it signs.
For a broader discussion of how hardware wallets defend against physical extraction techniques, our article on side-channel attack risks in cryptocurrency hardware provides detailed technical context.
Supply chain security gets attention too. Foundation publishes the bill of materials, the PCB layout, and the firmware source code. You can compile the firmware yourself and verify that what runs on your device matches the published source. The Passport also checks firmware signatures before applying an update: it installs only firmware signed by 2 of Foundation’s 4 keys. The one exception is a developer key you add yourself, after entering your PIN, to run firmware you built; while it runs that firmware, the Passport warns at every start that the firmware is not signed by Foundation.
Software and Firmware
The Envoy app serves as the primary interface for managing your Passport. It displays your balance, generates receive addresses, constructs transactions, and presents QR codes for the Passport to scan and sign. The app is open source and available on both major mobile platforms.
Envoy has a clean, focused interface that reflects the Bitcoin-only philosophy. There are no token swap features, no DeFi integrations, no NFT galleries. You get a Bitcoin wallet with coin control, fee estimation, and transaction history. It also serves as a firmware update channel — new firmware versions are downloaded through Envoy and transferred to the Passport via microSD card.
Foundation says the Passport Core still receives security updates and usability improvements after its discontinuation, so keep installing them. The update process is straightforward: download the update file to a microSD card through Envoy, insert the card into the Passport, and confirm the update on the device. Understanding why keeping firmware current matters is covered in our piece on firmware updates and hardware wallet security best practices.
Foundation released the firmware under GPLv3 (with some parts under MIT and other compatible licences) and published Passport’s circuit designs under the CERN-OHL-S v2 open hardware licence. This level of openness is rare in the hardware wallet space and allows independent security researchers to audit the full stack without NDA restrictions.
Compatible Wallets
While Envoy is the default companion app, the Passport works with a broad range of Bitcoin wallet software. Supported options include:
- Sparrow Wallet — Full-featured desktop wallet with excellent coin control and privacy tools. One of the most popular pairings with the Passport.
- Electrum — The long-standing Bitcoin desktop wallet with advanced scripting support.
- Specter Desktop — Designed for multisig setups and Bitcoin Core integration.
- Bitcoin Core — For users running their own full node. The Passport has no USB data connection, so it pairs and signs with Bitcoin Core by microSD card.
- Nunchuk — Mobile and desktop wallet with strong multisig support and collaborative custody features.
- Blue Wallet — Mobile Bitcoin wallet with watch-only wallet support for PSBT signing.
- BTCPay Server — For merchants accepting Bitcoin, the Passport can sign payouts from a BTCPay instance.
- Casa — Managed multisig service that supports the Passport as a signing device.
This broad compatibility means you are not locked into Foundation’s software ecosystem. If Envoy ever stops being developed, or if you simply prefer a different interface, your keys remain accessible through any of these alternatives. This works because the backup follows open standards: our lesson Seed Phrases Explained shows how one BIP39 seed rebuilds the same wallet in any compatible software.
Multisig Support
The Passport works well as a signing device in multisig configurations. It exports xpubs via QR code or microSD, supports PSBT (Partially Signed Bitcoin Transactions) workflows, and integrates with the coordinator software you would use to manage a multisig quorum — Sparrow, Specter, Nunchuk, and Casa all handle this smoothly.
In a typical 2-of-3 multisig setup, the Passport holds one key and devices from two other makers hold the others, for example a Coldcard and a Trezor, so a flaw in one maker’s devices reaches only one key. The air-gapped QR workflow actually makes multisig signing more ergonomic than you might expect — you scan the partially signed transaction, review it on the Passport’s screen, approve it, and display a QR code containing your signature for the coordinator to collect. Before you fund the wallet, register it on the Passport (Settings, Bitcoin, Multisig, then import it by QR code or microSD) so it can check addresses and change itself, and keep a copy of the wallet’s descriptor with every seed backup: with one key lost, two seeds alone cannot find your coins. Our lesson Multisig Wallets Explained covers what to back up.
If you are considering moving from a single-key setup to multisig, our technical guide on transitioning from single signature to multisig wallets walks through the process and tradeoffs involved.
Pros and Cons
Pros
- Fully air-gapped with no wireless connectivity of any kind
- Solid build: copper-plated zinc alloy frame and a display under cover glass
- Fully open-source firmware and hardware schematics
- Removable, replaceable battery for long-term storage
- Bitcoin-only focus eliminates unnecessary attack surface
- Excellent companion app (Envoy) with clean UX
- Wide third-party wallet compatibility
- Strong multisig support via PSBT and QR workflows
- USA-based company with transparent supply chain
- SeedQR support for fast seed backup and restore
Cons
- No longer sold: if yours breaks, you replace it with another model (your 12- or 24-word BIP39 backup restores on most brands)
- No multi-chain support — Bitcoin only, which limits utility for altcoin holders
- Physical keypad makes text entry slower than touchscreen alternatives
- Unusual form factor may not appeal to everyone
- MicroSD-based firmware updates require more steps than USB-connected devices
- Camera quality can struggle in low-light conditions when scanning QR codes
- No passphrase entry on a full keyboard — limited to on-device keypad
If You Own a Passport Core
The Passport was built for a specific type of Bitcoin user: someone who holds bitcoin as long-term savings, cares about open-source verifiability, and wants no wireless link at all. If that is you and you already own one, there is no reason to replace it while Foundation keeps supporting it.
- Keep the firmware current. Install updates through Envoy or from Foundation’s website, following the steps above.
- Check your backup. Your 12 or 24 words are what matter, not the device. A BIP39 backup restores on most other hardware wallets if the Passport ever fails.
- Use it as one key among several. For large savings, a Passport Core works well as one key in a 2-of-3 multisig with devices from two other manufacturers.
Open-source advocates will find the GPLv3 firmware and CERN-licensed circuit designs meaningful — this is not “open source in spirit” but genuinely auditable top to bottom. Our article on open source values in Bitcoin hardware security covers why this matters beyond marketing.
If you are buying today, the Passport Core is no longer an option. Air-gapped devices on sale in November 2026 include the Coldcard Mk5 and Q, the Keystone 3 Pro and the Blockstream Jade; Ledger vs Trezor and Beyond compares them with current prices.
Comparison with Alternatives
Passport Core vs Coldcard Mk5
Both are Bitcoin-only and can work fully air-gapped. The Coldcard Mk5, which replaced the Mk4 in March 2026, costs $269 ($219 on sale) in Coinkite’s store as of November 2026. It uses a more utilitarian design with a numeric keypad, supports NFC for PSBT transfer (which can be disabled), and protects the seed with two secure elements from different vendors. Its code is public, but under the MIT licence with a “Commons Clause” that forbids selling it, so it is source-available rather than open source in the strict sense. Coldcard has a long track record, and in July 2026 a firmware flaw left some Coldcard seeds far weaker than intended (see our Coldcard advisory). The Passport Core wins on build quality, screen and the companion app experience; the Coldcard is the one you can still buy.
Passport vs Blockstream Jade
The Jade costs $67 in Blockstream’s store as of November 2026 (the Jade Plus $149 to $169) and uses a virtual secure element model instead of a traditional hardware chip. It supports Bluetooth (which the Passport deliberately avoids) and can operate in an air-gapped QR mode. It is the cheapest way to sign by QR code today, and a good second key. The Passport Core was aimed at users willing to pay a premium for build quality, a dedicated secure element, and a fully air-gapped design with no wireless radios on the board.
Passport vs Keystone 3 Pro
The Keystone 3 Pro signs by QR code and features a large 4-inch touchscreen with fingerprint authentication. It costs $149 (on pre-order as of November 2026). Its default firmware supports many coins besides bitcoin, and Keystone offers a Bitcoin-only firmware; it publishes its firmware and hardware schematics on GitHub. The Passport Core was Bitcoin-only from the start, which some users prefer for its smaller attack surface; the Keystone, with its Bitcoin-only firmware, is the air-gapped option with a large screen that you can buy today.
Verdict for Owners
The Foundation Passport Core was one of the best hardware wallets for Bitcoin users who value open-source transparency, air-gapped security, and premium build quality. Its metal frame, quality display, removable battery and US-based manufacturing set it apart.
The security architecture is sound: no wireless connectivity, a proper secure element, open-source firmware with reproducible builds, and a supply chain you can actually verify. The Envoy companion app is polished and focused. The third-party wallet compatibility means your setup is not dependent on any single software vendor.
If you own one, keep using it with current firmware, as a single key or as one key in a multisig with other makers. It is no longer sold, so we no longer rate it as a purchase; for a new device, see Ledger vs Trezor and Beyond.
For guidance on how to properly store the seed phrase generated by your Passport or any other hardware wallet, see our comprehensive resource on seed phrase storage best practices and risk mitigation.
Frequently Asked Questions
Can the Foundation Passport be used completely without a phone or computer?
No. The Passport is a signing device, not a standalone wallet. It needs a companion application — either Envoy on a phone, or a desktop wallet like Sparrow — to construct transactions, broadcast them to the Bitcoin network, and display your balance. The Passport handles key generation, key storage, and transaction signing. Think of it as a secure vault for your private keys that approves transactions prepared by other software. The air-gapped QR workflow means the Passport never connects directly to the companion device, but it does depend on that software to function as a complete wallet.
Is the Passport compatible with multisig setups using devices from other manufacturers?
Yes. The Passport uses standard PSBT (BIP174) formatting and exports xpubs in standard derivation paths. You can combine a Passport with a Coldcard, a Jade, a Trezor, or a software signer in a multisig quorum managed by Sparrow, Specter, Nunchuk, or Casa. The QR-based signing workflow works with coordinator software that exchanges PSBTs as animated QR codes in Blockchain Commons’ UR format; the Passport does not read BBQr. For users building a multisig setup with mixed hardware, our article on hardware diversity in multisig security discusses why using devices from different manufacturers strengthens your security model.
Is the Passport Core still supported now that it is discontinued?
Yes. When Foundation announced in March 2026 that it had discontinued the Passport Core, it said the device “remains fully supported, with security updates, usability improvements, and all warranties honored.” Keep installing firmware updates through Envoy. If your device ever fails, your 12- or 24-word BIP39 backup restores on most other hardware wallets, so you can move to a current model without losing access.
What happens if Foundation Devices goes out of business?
Your Bitcoin remains fully accessible. The Passport uses standard BIP39 seed phrases, which can be restored on any compatible hardware or software wallet. The firmware and hardware designs are open source, so the community could maintain and build the software independently. Your keys are not locked to Foundation’s infrastructure in any way — there is no proprietary key derivation, no cloud dependency, and no licensing server. This is one of the strongest arguments for the fully open-source approach Foundation has taken.
How does the Passport handle firmware updates securely without an internet connection?
Firmware updates are downloaded through the Envoy app or from Foundation’s website and transferred to the Passport via microSD card. Before applying any update, the Passport checks the firmware’s signature: it installs only firmware signed by 2 of Foundation’s 4 keys, or by a developer key you have added yourself with your PIN to run your own builds. If the signature does not match, the update is rejected. This means even if someone modified a firmware file on the microSD card, the Passport would refuse to install it. You can also compile the firmware from source and compare hashes to verify that the official release matches the published code. The process adds a few extra steps compared to USB-connected updates, but it maintains the air-gapped security boundary at all times.
