Foundation Passport Bitcoin Wallet Review 2026

TL;DR

The Foundation Passport is a premium, air-gapped hardware wallet built for Bitcoiners who care deeply about open source, privacy, and self-custody principles. It's beautifully designed, Bitcoin-only, and communicates exclusively through QR codes or microSD cards, meaning your private keys never touch the internet. At $199, it's not cheap, and it demands more effort than plug-and-play alternatives like Trezor or Ledger. But if you understand why air-gapping matters and you're willing to learn the workflow, the Passport is one of the most principled hardware wallets you can buy.

Our rating: 8.4/10 — Excellent for its target audience, but the learning curve and price keep it from being a universal recommendation.

Quick Specs

What Is the Foundation Passport?

The Foundation Passport is a hardware wallet made by Foundation Devices, a company based in Boston, USA. It's designed around a single philosophy: your bitcoin should be completely isolated from internet-connected devices at all times.

Unlike most hardware wallets that connect to your computer via USB or Bluetooth, the Passport is air-gapped. It never physically connects to your phone or computer. Instead, you sign transactions by scanning QR codes back and forth between the Passport and its companion app, Envoy. You can also use microSD cards if you prefer.

Here's what makes it stand out:

• Bitcoin-only. No altcoin support. This is intentional; it keeps the codebase smaller and more auditable.
• Fully open source. Both the firmware and the hardware schematics are publicly available on GitHub. Anyone can inspect, verify, or fork the code.
• Air-gapped by design. No USB data connection, no Wi-Fi, no Bluetooth, no NFC. The only way data moves in or out is through the camera (QR codes) or the microSD slot.
• Made in the USA. Foundation assembles the devices domestically, which appeals to users concerned about supply chain integrity.

The current model is the Passport Core, which replaced the original Passport (Batch 2) in late 2024. It features a compact design with a color touchscreen display, a built-in camera for QR scanning, and runs on standard AAA batteries.

If you're new to the concept of air-gapped wallets, check out our guide to air-gapped hardware wallets for a deeper explanation of why this approach matters.

Real User Feedback

We dug through Reddit, Bitcoin forums, the Foundation website testimonials, and app store reviews to get a picture of what actual users think. Here's what we found.

What Users Love

Open source and verifiable. This comes up constantly. Users who've been burned by Ledger's closed-source firmware or controversial decisions (like the Ledger Recover debacle) specifically cite Foundation's transparency as the reason they switched. One Reddit user put it simply: "Passport gives what Ledger takes from me."

Build quality and design. Multiple users describe the Passport as feeling like a premium device. It's compact, solidly built, and doesn't look like a cheap USB stick. Users frequently contrast it favorably against competitors that "appear more toy-like and use inferior materials."

The air-gap workflow actually works. First-time users consistently express surprise at how smooth QR code signing is. One user noted: "Making bitcoin transactions was easier than I expected given the Passport's airgapped nature. I simply used the built-in camera to scan QR codes."

Envoy app quality. Foundation's companion app, Envoy, gets strong marks for clean design and ease of use. It handles wallet setup, firmware updates (via microSD), and transaction construction. Users describe the Passport + Envoy combo as a cohesive experience.

Bitcoin-only focus. For a certain type of user, the fact that Passport doesn't support altcoins is a feature, not a limitation. Less code means a smaller attack surface.

What Users Criticize

Price. At $199, the Passport Core costs significantly more than a Trezor Safe 3 ($79) or even a Ledger Nano S Plus ($79). Users on a budget often acknowledge the Passport is excellent but choose cheaper alternatives.

Small company concerns. Several Reddit threads raise a legitimate worry: Foundation Devices is a small startup. Some users question long-term viability and support availability compared to established players like Ledger or Trezor. One Reddit post titled "Is Foundation Passport secure?" noted the relative lack of discussion online compared to more popular wallets.

Learning curve for non-technical users. While enthusiasts love the air-gapped workflow, some users find the QR code scanning process confusing at first, especially compared to simply plugging in a USB device. The mental model of "construct transaction on phone, scan to device, sign on device, scan back to phone" requires a shift in thinking.

Limited multisig documentation. Advanced users setting up multisig configurations report that Foundation's documentation, while improving, still lags behind Coldcard's more mature guides.

No secure element (by choice). Foundation deliberately chose not to include a dedicated secure element chip, relying instead on the STM32 microcontroller's built-in security features. This is a philosophical choice; some security researchers consider it a tradeoff worth discussing (more on this in the security section).

Sources: Reddit r/Bitcoin, Foundation website testimonials, Bitcoin Talk forums, app store reviews for Envoy.

Pricing and Comparison

The Passport Core retails for $199 directly from Foundation Devices. They ship internationally, though shipping costs vary by region.

Here's how it stacks up against the main competition:

The pricing reality: The Passport is the most expensive option in this comparison, but it's also the only one that combines full open-source hardware, air-gapped operation, and a dedicated companion app. You're paying for a specific set of principles, not just silicon.

For a deeper dive into how these devices compare head-to-head, see our Coldcard vs Trezor vs Ledger comparison.

Safety and Security

This is where the Passport gets genuinely interesting, and where reasonable people can disagree.

Air-Gapped Architecture

The core security proposition is simple: your private keys exist on a device that has no way to connect to the internet. There's no USB data line (the USB-C port is power-only for charging), no wireless radios, and no Bluetooth. The only data channels are the camera (for QR codes) and the microSD card slot.

This means that even if your phone is completely compromised with malware, an attacker still can't extract your private keys. They'd need physical access to the Passport itself.

Open Source Everything

Foundation publishes both their firmware source code and their hardware schematics on GitHub. This is relatively rare; most hardware wallet companies keep at least their hardware designs proprietary. The benefit is that independent security researchers can audit the entire stack, from the circuit board design to the signing logic.

The firmware is written in MicroPython with critical cryptographic operations in C. It's been audited by independent firms, and the open nature means the community can (and does) review changes.

The Secure Element Debate

Here's where it gets nuanced. Most hardware wallets (Coldcard, Ledger, Trezor Safe 5) include a dedicated secure element chip. This is a tamper-resistant chip specifically designed to protect cryptographic secrets. Foundation chose not to include one.

Foundation's argument: Secure elements are proprietary black boxes. You can't audit the silicon. The Passport instead uses the STM32H7 microcontroller's built-in security features (unique device secrets, anti-tamper fuses) combined with their open firmware to protect keys. Everything is auditable.

The counterargument: Secure elements provide hardware-level protection against physical attacks (like decapping the chip and probing it with an electron microscope). Without one, a sophisticated attacker with physical access has a theoretically easier path to extracting keys from the MCU.

Our take: For most users, the air gap provides far more practical security than a secure element. The realistic threat for most people isn't a nation-state lab attack on their chip; it's malware on their computer or a phishing attack. The air gap defends brilliantly against those scenarios. If you're worried about physical attacks, use a strong passphrase (which the Passport supports) and secure physical storage.

Security Track Record

Foundation has not had any known security breaches or critical vulnerabilities exploited in the wild. Their firmware update process uses signed updates verified on the device, and the microSD-based update mechanism keeps the update process air-gapped as well.

UX and Practical Details

The Envoy Companion App

Envoy is Foundation's free, open-source companion app for iOS and Android. It serves as your wallet interface; you use Envoy to check balances, construct transactions, and manage firmware updates.

The app is genuinely well-designed. It's clean, intuitive, and doesn't try to do too much. Users consistently rate it as one of the better hardware wallet companion apps, and it's a major improvement over the "bring your own wallet software" approach that Coldcard takes.

Envoy also supports basic features like buying bitcoin through integrated partners (like Ramp) and a Magic Backup feature that simplifies seed phrase backup using encrypted cloud storage (optional, and you can skip it if you prefer traditional seed phrase backup).

App store ratings: Envoy holds a 4.5+ rating on both iOS and Android app stores, with users praising its simplicity and design.

The QR Code Signing Workflow

Here's what sending bitcoin actually looks like with a Passport:

1. Open Envoy on your phone and create a transaction (enter address, amount).
2. Envoy displays an animated QR code containing the unsigned transaction.
3. Pick up your Passport and use its camera to scan the QR code from your phone screen.
4. Review the transaction details on the Passport's display (address, amount, fee).
5. Approve and sign the transaction on the Passport.
6. The Passport displays a new QR code containing the signed transaction.
7. Scan that QR code with your phone's camera in Envoy.
8. Envoy broadcasts the signed transaction to the Bitcoin network.

Pros of this workflow:

• Your keys never leave the Passport
• No cables, no drivers, no compatibility issues
• Works with any phone (iOS or Android)
• You can visually verify every step

Cons of this workflow:

• More steps than USB plug-and-sign
• QR scanning can be fiddly in bad lighting
• Animated QR codes for large transactions take a few seconds to scan
• Unfamiliar to users coming from USB-based wallets

The Passport also works with other wallet software that supports PSBT (Partially Signed Bitcoin Transactions) via QR, including Sparrow Wallet, BlueWallet, and Nunchuk. You're not locked into Envoy.

Display and Physical Interface

The Passport Core features a color touchscreen display that's significantly larger and more readable than the tiny OLEDs on Coldcard or Ledger devices. You can clearly read full bitcoin addresses on screen for verification, which matters for security.

Navigation is intuitive with the touchscreen. The device runs on two AAA batteries, which last months with typical usage. Some users appreciate this over rechargeable batteries because AAA cells are universally available and replaceable.

Customer Support

Foundation offers email support and maintains an active community on Telegram and Twitter/X. Response times are generally reasonable, though some users note that as a small team, support can be slower during busy periods compared to larger companies like Ledger.

Foundation also publishes detailed setup guides and video tutorials. Their documentation has improved significantly over the past year, though it still doesn't match the sheer volume of community-generated content available for Trezor or Ledger.

Who Is the Passport For?

Ideal Users

• Self-custody advocates who want the most transparent, auditable hardware wallet available
• Privacy-conscious Bitcoiners who don't want their wallet connecting to any computer via USB
• Developers and tinkerers who want to inspect (or modify) both firmware and hardware
• Upgraders from Ledger who lost trust after the Ledger Recover controversy
• Users building multisig setups who want an air-gapped signing device alongside other hardware wallets
• People who appreciate good design and want a wallet that feels premium

Not Ideal For

• Complete beginners who are holding their first bitcoin. The QR workflow adds friction that could intimidate new users. Start with a Trezor Safe 5 and graduate to Passport later.
• Budget-conscious buyers. If $199 is a significant expense relative to your bitcoin holdings, a Trezor or Coldcard offers excellent security for less.
• Multi-coin holders. Passport is Bitcoin-only. If you hold other cryptocurrencies and want one device for everything, look elsewhere.
• Users who want maximum community support. Trezor and Ledger have much larger user bases, which means more tutorials, forum posts, and troubleshooting resources.

If you're still figuring out whether self-custody is right for you, start with our self-custody guide before picking a device.

Pros and Cons

Pros

1. Fully air-gapped with no wireless or wired data connections; your keys are physically isolated from the internet.
2. 100% open source firmware AND hardware, meaning the entire device can be independently audited.
3. Bitcoin-only focus reduces attack surface and keeps the codebase lean and auditable.
4. Excellent build quality with a premium feel that stands out from cheaper-feeling competitors.
5. Envoy companion app is polished, intuitive, and open source itself.
6. Color touchscreen makes address verification and navigation significantly easier than tiny OLED screens.
7. Made in the USA with full supply chain transparency for users who care about hardware provenance.

Cons

1. Expensive at $199, costing more than every major competitor in the comparison table above.
2. No secure element chip, which means physical attack resistance relies on MCU-level protections rather than dedicated tamper-resistant silicon.
3. QR code workflow has a learning curve and involves more steps than simply plugging in a USB cable.
4. Small company risk; Foundation Devices is a startup, and long-term support and survival aren't guaranteed the way they might be with larger, profitable companies.
5. Limited ecosystem size means fewer third-party tutorials, guides, and community troubleshooting resources compared to Trezor or Ledger.
6. International shipping costs can add meaningfully to the price for buyers outside the US.
7. Multisig documentation still trails behind Coldcard's more mature guides and tooling.

→ [Buy the Foundation Passport from Foundation.xyz](/go/foundation) — use our link to support Bitcoin.diy at no extra cost to you.

Frequently Asked Questions

Is the Foundation Passport safe?

Yes. The air-gapped design provides strong protection against the most common threats: malware, phishing, and remote attacks. The open-source firmware has been audited by independent security firms. The main point of debate is the lack of a dedicated secure element, but for most threat models, the air gap matters far more than the chip architecture.

Can I use the Passport without the Envoy app?

Yes. The Passport works with any wallet software that supports PSBT via QR codes or microSD. Popular alternatives include Sparrow Wallet (desktop), BlueWallet (mobile), and Nunchuk (multisig-focused). You're not locked into Foundation's ecosystem.

Does the Passport support multisig?

Yes. You can use the Passport as one of multiple signing devices in a multisig setup. It works well with coordinators like Sparrow Wallet and Nunchuk. Many security-conscious users pair a Passport with a Coldcard or other device for 2-of-3 multisig configurations.

How does the Passport compare to the Coldcard?

Both are Bitcoin-only, open-source, and air-gapped (Coldcard via microSD, Passport via QR codes and microSD). The Coldcard includes a secure element and costs less. The Passport has a better display, a companion app (Envoy), and uses QR codes for faster transaction signing. It comes down to priorities: Coldcard for maximum security features and lower price, Passport for better UX and full hardware transparency. See our full comparison for details.

What happens if Foundation Devices goes out of business?

Your bitcoin would be completely safe. The Passport stores your seed phrase (recovery phrase), which follows the BIP39 standard. You can recover your funds using any compatible wallet software or hardware wallet. The open-source firmware also means the community could continue maintaining the codebase independently.

Can I buy the Passport anonymously?

Foundation does accept bitcoin payments, which offers more privacy than credit card purchases. However, you'll still need to provide a shipping address. Some users order to a P.O. box or alternative address for additional privacy.

How long do the batteries last?

The Passport Core runs on two AAA batteries. With typical usage (a few transactions per week), batteries last several months. The device spends most of its time powered off, which is the whole point of air-gapped security; it's not always-on like a phone.