Foundation Passport

Foundation Passport is a Bitcoin-only hardware wallet made by Foundation Devices. It is designed to operate air-gapped: the device has no WiFi, Bluetooth, or NFC, and its USB-C port is wired for charging only, with no data lines to the host. Transaction data moves between Passport and companion software as QR codes — read through the device's built-in camera and displayed on its screen — or via a microSD card, so private keys never share a live data channel with an internet-connected machine.

Open source, hardware included

Foundation Devices publishes Passport's firmware under the GPL and its hardware design under the CERN Open Hardware License, which means the device meets common definitions of open-source software and open-source hardware — schematics and design files can be independently inspected, not just the code. That is rarer than firmware openness alone and matters for the same reason reproducible builds do: the fewer sealed layers between the user and the silicon, the less blind trust the custody model requires. The hardware includes a Microchip secure element used to protect key material — configured so the user's PIN is part of the key derivation rather than a gate the chip alone enforces — alongside a dedicated hardware noise source for entropy generation. Passport's firmware lineage also reflects the ecosystem's shoulders-of-giants pattern: it began as a fork of open Bitcoin wallet firmware and credits that heritage, building refinement on top of audited prior work rather than starting from zero.

Workflow and compatibility

Passport pairs with Foundation's Envoy mobile application for setup, balance viewing, and transaction construction, and it also works with third-party coordinators such as Sparrow, BlueWallet, Nunchuk, and Specter Desktop. The common interchange is the PSBT standard carried over its air-gapped QR and microSD channels: the coordinator builds the unsigned transaction, Passport signs after on-device verification of addresses and amounts, and only the signed result travels back. It supports BIP-39 passphrases for hidden wallets and serves cleanly as one cosigner in a multisig quorum.

Where it fits

Day-to-day, Passport behaves like the category at its best. Receive addresses are verified on the device's own color screen against what the coordinator shows; firmware updates arrive signed, delivered by microSD, and are verified by the device before installation; and the security model assumes the paired phone or laptop is compromised, which is the correct default posture. The microSD slot doubles as an encrypted-backup channel, giving users a second recovery path alongside the written seed — with the usual caveat that any backup stored beside the device protects against hardware failure, not against fire or theft at the same address. For multisig practitioners, Passport's QR-first design makes it an ergonomic cosigner: quorum signing sessions that shuffle SD cards between three devices are workable, but camera-and-screen rounds are faster and less error-prone. As with all hardware in this category, purchase through official channels and verify the device's supply-chain checks at first boot before trusting it with a seed.

Passport aims at the same deep-cold-storage territory as other air-gapped signers, but with a consumer-hardware sensibility — a keypad, a color screen, and a phone-first companion app — that lowers the ceremony for users intimidated by more austere devices. The honest trade-offs are the usual ones for the category: air-gapped workflows are slower than plug-and-sign USB devices, and a secure element adds hardened-but-closed silicon to an otherwise open design, a compromise Foundation mitigates through its PIN-derivation architecture and published schematics. As always, the device is only half the system; a durable seed phrase backup, tested recovery, and sensible storage discipline complete it. See hardware wallet for the wider category.