The Passport is air-gapped, fully open source, made in the USA, and comes with the best companion app of any hardware wallet. At $199 it's not cheap. But for what it delivers, it earns the price.
The Passport is for the Bitcoin holder who's ready to take air-gap security seriously but doesn't want to spend weeks learning Coldcard's deep configuration options. That's a specific and common position to be in: you've been through a Ledger or Trezor, you understand why air-gapping matters, and you want a wallet that does it properly without treating you like a developer.
It's also for people who care about open source. If you want to verify that your hardware wallet's firmware hasn't been tampered with and that the hardware itself isn't hiding anything, the Passport lets you do that in a way most wallets don't.
If you've never owned a hardware wallet, start with a BitBox02 or Trezor Safe 3. Those have gentler learning curves. The Passport rewards people who already understand how hardware wallets work and want to level up their security model.
An air-gapped device never connects to a computer or network via a data-carrying connection. The Passport takes this seriously. It communicates only through QR codes. You hold the Passport up to your phone's camera. The data flows one direction at a time. There's no USB cable, no Bluetooth, no WiFi, no NFC of any kind.
Why does this matter? USB connections have a history of being used in attack scenarios where a compromised computer pushes malicious code to a connected device. QR codes can only carry small payloads. They're one-directional. They're human-readable at a glance. You can see what's being communicated before confirming anything. The attack surface shrinks considerably.
The tradeoff is friction. Signing a transaction on a USB-connected wallet takes seconds. QR-based signing takes longer, and the scanning step can be annoying in poor lighting or with an older phone. Most users find the friction acceptable. If you're signing dozens of transactions daily, it might get old.
You're trusting this device with potentially life-changing amounts of money. Knowing that the firmware can be verified by independent security researchers, and that the hardware design itself is auditable, means you don't have to take Foundation's word for it.
Closed firmware means you trust the manufacturer completely. That might be fine for a $30 keyboard. For a device holding your Bitcoin savings, it's a meaningful limitation. Foundation, Coldcard, and BitBox02 are in the small category of hardware wallet makers that publish enough to allow independent verification. Ledger's firmware is closed. You can't verify what it's doing.
Passport goes further than most: they publish the hardware schematics, not just the firmware. You can see exactly what chips are in the device and how they're connected. That's unusual and worth noting.
It's the best companion app of any hardware wallet. That's not a close call. Most hardware wallet apps are functional but ugly, designed by engineers who care more about correctness than usability. Envoy looks like it was designed by people who actually use the product.
Setup walks you through seed phrase generation with clear instructions, checks that you've actually written it down correctly, and handles the pairing QR exchange step by step. Transaction signing is guided in a way that makes the QR workflow feel natural rather than fiddly. Firmware updates happen through the app with progress indicators.
Envoy is available on iOS and Android, it's open source, and it doesn't require creating an account or phoning home to Foundation's servers for basic wallet functions. That last point matters. Your balance and transaction history stay private.
Coldcard is for people who want every possible security feature and are willing to invest time learning how to use them properly. Duress wallets, deep PSBT customization, passphrase options, and a level of configurability that Passport doesn't approach.
Passport is for people who want the security of an air-gapped wallet without the Coldcard learning curve. The QR workflow beats microSD-based PSBT for accessibility. Envoy beats Coldcard's number-pad interface for anyone who didn't grow up writing firmware.
| Feature | Passport ($199) | Coldcard Mk4 ($148) |
|---|---|---|
| Air-gap method | QR codes only | microSD + QR (Mk4+) |
| Open source | Hardware + firmware | Firmware only |
| Companion app | Envoy (excellent, open source) | None — use Sparrow |
| Setup difficulty | Beginner-friendly | Steep learning curve |
| Advanced features | Solid | Exceptional |
| Duress wallet | No | Yes |
| Bitcoin-only | Yes | Yes |
| Made in | USA | Canada |
Yes, if air-gap security and open source are what you're looking for. The Passport delivers both in a package that doesn't make you feel like you need an engineering degree to use it. Envoy is genuinely excellent. The hardware feels premium. The security model is solid.
You're paying for US manufacturing, full hardware transparency, and the best companion app in the hardware wallet space. Cheaper wallets exist. None of them offer this exact combination.
If you're protecting a meaningful amount of Bitcoin and you've outgrown basic USB wallets, the Passport is worth serious consideration. The cold storage guide covers how a device like this fits into a complete self-custody setup.
$199 from Foundation Devices. Ships from the US with open-source firmware and full air-gap via camera.
Affiliate Disclosure: Bitcoin.diy may earn a commission if you buy through our links. This doesn't affect our ratings.
Yes. The Passport communicates exclusively via QR codes. No USB data, no Bluetooth, no WiFi, no NFC. Your private keys never touch a device that has an internet connection, even indirectly through a cable. This puts it in the same security category as the Coldcard Mk4 for air-gap purity, and ahead of USB-connected wallets like the Trezor Safe 3 or Ledger Nano X.
Foundation publishes the hardware schematics, firmware source code, and the Envoy companion app on GitHub. All of it. You can audit the code yourself, build from schematics if you want, and verify that the firmware running on your device matches the published source. This level of transparency is rare. Most hardware wallet companies publish their firmware but not their hardware designs. Foundation does both.
Both are serious Bitcoin-only air-gapped wallets. Coldcard has more advanced features: duress wallets, deep PSBT configuration, and a level of paranoia-friendly options that Passport doesn't match. Passport is more approachable: the Envoy app guides you through setup step by step, QR-based signing is more intuitive than microSD PSBT workflows, and the overall experience feels like a consumer product rather than a developer tool. Security is comparable. Choose Coldcard if you want maximum control and are comfortable with a steep learning curve. Choose Passport if you want genuine air-gap security with far less friction.
Strictly speaking, no. Passport works with Sparrow Wallet, Specter Desktop, BlueWallet, and any PSBT-compatible software. But Envoy makes the experience dramatically better. It was designed specifically for Passport, handles firmware updates cleanly, and walks you through the QR-based signing workflow in a way that's far more intuitive than configuring Sparrow from scratch. For most users, Envoy is the right starting point.
Batteries are a deliberate security and usability choice. Running on 4x AA cells means no power cable connects the Passport to your computer during signing, removing one potential attack vector. It also means you can use the device anywhere, check balances while traveling, and never get stuck because you forgot a cable. AA batteries are available everywhere. When one dies, you replace it in 30 seconds.
Compared to other air-gapped wallets, yes. Compared to a Trezor Safe 3, no. The Envoy app simplifies setup significantly, but you're still dealing with seed phrase generation, watch-only wallets, and QR-based PSBT transaction signing. If you've never used a hardware wallet before, start with a Trezor Safe 3 or BitBox02. They have gentler onramps. Come back to Passport once you understand how hardware wallets work and why air-gapping matters.
The Passport Batch 2 is $199, sold at foundationdevices.com. Foundation accepts Bitcoin. No subscription, no ongoing fees. The Envoy app is free. Replacement batteries cost a few dollars. At $199 it sits above the BitBox02 ($149) and Trezor Safe 3 ($79) but below the Coldcard Q ($219). You're paying for US manufacturing, open hardware, and a better companion app than any competing device has.
Yes. Foundation publishes signed firmware releases with detailed verification instructions. You check the GPG signature, verify the hash, and confirm it matches the open-source code on GitHub. This is the same level of firmware verification that Coldcard and BitBox02 offer. For a device protecting serious amounts of Bitcoin, being able to verify what's running on it matters. Closed-source firmware wallets require you to take the manufacturer's word for it.
In the United States. Foundation is a US-based company that assembles the Passport domestically and publishes information about its supply chain. This matters for tamper-evident security. Knowing where your hardware wallet was assembled and by whom reduces the risk of supply chain attacks. Foundation is one of the few consumer hardware wallet companies that's transparent about this.
Envoy (Foundation's own app, iOS and Android) is the recommended option for most users. Sparrow Wallet is the best desktop pairing for users who want full control over transaction construction. Specter Desktop, BlueWallet, and Nunchuk also work. Any PSBT-compatible software that supports QR-based signing can work with Passport. Sparrow plus Passport is the most popular combination for serious Bitcoin holders.