Foundation Passport Review 2026: Open-Source, US-Made Bitcoin Cold Storage

🟢 Trust Rating: High

Foundation publishes the whole stack: hardware schematics, firmware, and the Envoy companion app. The Passport Core signs Bitcoin transactions over QR codes only, with no USB data and no radios in the loop. It is assembled in the United States, the firmware was third-party reviewed, and Envoy ships with a built-in Tor mode. This is one of the few wallets that earns the openness it markets. The catch: the new Passport Prime is a very different, more expensive, more connected device, and you should know which one you are buying.

What is Foundation Passport?

Foundation Devices is a US company that makes Bitcoin self-custody hardware. Their two current products are the Passport Core, a stripped-down air-gapped Bitcoin signer, and the Passport Prime, a touchscreen security platform that runs a custom operating system. Both live at foundation.xyz (the company moved off its old foundationdevices.com domain).

The Core is the one privacy people have trusted for years. It talks to the outside world through a camera and a QR screen, or a microSD card, and nothing else. No Bluetooth, no wifi, no USB data path. If you want your signing device to be genuinely offline, that design is the point.

Critical Privacy Concerns

⚠️ Important Considerations

Two very different products, one brand - The Passport Core is a pure air-gapped Bitcoin signer. The Passport Prime is a Bluetooth-equipped, app-running, multi-function device (Bitcoin plus FIDO keys, 2FA, encrypted file storage). Do not assume the Prime shares the Core's minimal attack surface. It does not.
The Prime has radios - The Prime ships with NFC and an encrypted Bluetooth link Foundation calls QuantumLink. Encryption is not the same as air-gapped. Every wireless interface is attack surface a QR-only device simply does not have.
Envoy is mobile-only - The Envoy companion app runs on iOS and Android only. Linux desktop users have to fall back to Sparrow Wallet. If your threat model rules out running a wallet app on a phone, that is a real gap.
The Prime is a bigger bet - A custom Rust operating system with sandboxed third-party apps and a coming app store is ambitious, and ambition means more code and more ways to be wrong. The Core's boring simplicity is a feature.

Passport Core: The Air-Gapped Signer

The Core is the wallet to reach for if you want to verify what your device is doing. The Core talks to the world through QR codes and a microSD card only: no USB data, no Bluetooth, no wireless of any kind, and per Foundation's documentation the USB-C port carries power only, with no data pins present. You approve transactions by scanning QR codes back and forth between the Passport and your phone. The signing device never touches the network.

It runs on a removable Nokia BL-5C lithium-ion battery, a cheap standard-format phone battery you can swap in seconds, and charges over a USB-C port whose data pins simply are not present. Assembly happens in the United States, and Foundation documents its supply chain publicly.

Openness: better than most, and it matters

Foundation publishes hardware schematics, firmware, and the Envoy app source. That is the full set. For comparison, the same review notes that Ledger publishes nothing, Trezor publishes firmware only, and Coldcard publishes firmware and schematics. Passport is in the top tier of "you can actually check our work." That is not a marketing line here; the code and the board files are out in the open.

Envoy and Tor by default

Envoy is Foundation's companion app for setup, firmware updates, and account management. Envoy has a built-in Tor mode (the "Improved Privacy" option offered at setup); per Foundation's own documentation, when it is enabled, Foundation "has no way of knowing who you are or even your approximate geographical location." You can also point it at your own Bitcoin node (Umbrel, Start9, myNode, RaspiBlitz and other Electrum-server setups are supported) so you are not trusting Foundation's servers for your balance either.

Passport Prime: The New, Different Device

Announced in December 2024 and generally available as of May 2026, the Passport Prime is not a Bitcoin-only cold-storage device. It is a security platform. It runs KeyOS, a from-scratch Rust microkernel operating system that Foundation built for the device, with app sandboxing and process isolation. Foundation says KeyOS is open source.

The Prime carries a 3.5-inch color touchscreen, 50GB of encrypted storage, NFC, and QuantumLink, a post-quantum encrypted Bluetooth link described as using ML-KEM and ChaCha20-Poly1305 over a dedicated isolated Bluetooth chip. Beyond Bitcoin, it stores FIDO security keys and 2FA codes, holds a secrets vault, and supports third-party KeyOS apps. It began shipping to pre-order customers in March 2026.

The vision is broad: Foundation raised a $6.4 million round (led by Fulgur Ventures, with Arche Capital) partly to extend self-custody hardware to authorizing AI agents. That is interesting. It is also a long way from a device whose only job is to keep a seed phrase off the internet. Buy the Prime because you want the platform, not because you think it is a fancier Core.

Technical Specifications

Passport Core

Air-gap: QR codes and microSD only, no USB data, no Bluetooth, no wifi
Bitcoin: signs via PSBTs, works with Sparrow, Nunchuk, Electrum, BlueWallet, BTCPay, Casa and others
Power: removable Nokia BL-5C lithium-ion battery (1200 mAh), USB-C charging with no data pins
Openness: open hardware schematics, open firmware, open Envoy app
Companion: Envoy (iOS and Android), built-in Tor mode, own-node support
Made in: United States

Passport Prime

OS: KeyOS, Rust microkernel, sandboxed apps, open source
Display: 3.5-inch color IPS touchscreen
Storage: 50GB encrypted
Radios: NFC and QuantumLink encrypted Bluetooth (ML-KEM, ChaCha20-Poly1305)
Beyond Bitcoin: FIDO keys, 2FA (TOTP), secrets vault, third-party apps

Pricing Structure

Product	Price	What you get
Passport Core	$199	Air-gapped Bitcoin-only signer, QR and microSD
Passport Prime	$349	Touchscreen KeyOS platform: Bitcoin, FIDO, 2FA, vault, 50GB

Foundation also lists a limited "America 250 Edition" of the Prime at a higher price. For most buyers the base configurations above are the ones that matter.

Foundation Passport vs. Alternatives

Passport vs. Coldcard

Passport Core: fuller open-source stack (hardware plus firmware plus app), QR-only air-gap, swappable phone-format battery, US-assembled, friendlier interface. An independent review scored it 8.5/10.
Coldcard: dual secure elements, duress and BIP-85 child wallets, a longer paranoia feature list, but a more restrictive source license and a steeper learning curve. Same review scored the Mk4 9/10. See our Coldcard review.

Passport vs. Trezor

Passport: air-gapped by design, no data cable in the signing path, Bitcoin-focused on the Core.
Trezor: multi-asset, open firmware but USB-connected, cheaper entry price, huge coin support. See our Trezor review.

Passport vs. Keystone

Passport: fully open hardware and firmware, US-assembled, swappable phone-format battery.
Keystone: also QR air-gapped and multi-asset, with a fingerprint sensor, but a less complete open-source story on the hardware side. See our Keystone review.

Sizing up several signers at once? Our hardware wallet comparison and open-source wallet guide put the tradeoffs side by side.

When to Use Foundation Passport

Good Fit

✅ You want a genuinely air-gapped Bitcoin signer and value QR-only signing over a USB cable. The Core is built for exactly this.

✅ You care about verifiable openness, meaning published schematics and firmware you or someone you trust can inspect.

✅ You want built-in Tor and your-own-node support so your wallet balance is not leaking to a company server.

✅ US assembly matters to your supply-chain threat model.

Not Recommended For

❌ Heavy altcoin users. The Core is Bitcoin-focused; a Trezor or Ledger covers far more assets.

❌ Linux desktop purists who will not run Envoy on a phone. You can use Sparrow, but the first-party experience assumes mobile.

❌ Anyone buying the Prime expecting a minimal air-gap. The Prime has radios and a large software surface. If you want the Core's simplicity, buy the Core.

The Bottom Line

Consider Foundation Passport if:

You want an air-gapped Bitcoin signer with a top-tier open-source track record
Built-in Tor and own-node support fit your privacy goals
You value US assembly and a documented supply chain
(Prime) you specifically want a multi-function KeyOS security platform, radios and all

Avoid Foundation Passport if:

You need broad multi-asset support out of the box
You refuse to run a companion app on a phone and want first-party desktop tooling
You are eyeing the Prime but actually want the Core's stripped-down attack surface

⚠️ Final Assessment

The Passport Core is one of the easier hardware wallets to recommend without caveats: air-gapped, fully open, US-made, and $199. It earns the high trust rating on receipts, not marketing. The Passport Prime is a genuinely interesting bet on a broader security platform, but it trades the Core's minimalism for touchscreens, Bluetooth, and a lot more code. Both can be good buys. Just know which product you are actually putting your keys on.

Visit Foundation →