Foundation Passport: first-time setup

Passport's core idea has not changed: a camera on the front, a screen on the back, and no data path to your computer at all. Transactions arrive as QR codes and signatures leave as QR codes. Nothing is ever plugged in.

Two things around that core have changed with Passport Prime, and both are setup decisions rather than details. The backup system moved from a microSD card to NFC Keycards and SeedQR. And the device is no longer bitcoin-only — its firmware also runs 2FA codes, security keys, and encrypted file storage. Whether you use any of that is up to you, and worth deciding deliberately.

A Passport held in one hand with its camera aimed at a laptop screen showing a QR code, the device's own screen lit with a transaction summary.

Image to come

1Check the packaging

Inspect the packaging for cuts, re-glued seams, or a second seal laid over the first, and the case and screen edges for scratches suggesting it has been opened. Foundation ships with tamper-evident measures — check them against the current instructions on Foundation's own site rather than assuming what they should look like.

• A device that arrives already set up, already holding a wallet, or supplied with a printed recovery phrase is an attack. Stop and contact the vendor.
• Install firmware only through the official process. A firmware file offered by an email, a message, or a support agent is the attack, not the fix.

2Set it up air-gapped from the beginning

The camera is the reason to own this device, so use it from the first step rather than treating it as an advanced mode to graduate to later. Habits formed during setup are the ones you keep.

• Pair with Envoy, or with Sparrow, Nunchuk, or Specter, using the QR option.
• Export the wallet's public keys by QR so your software can watch the wallet without ever touching a private key.
• Run one complete transaction over QR before relying on the setup: scan the unsigned transaction out, approve on the device, scan the signature back, broadcast.
• Keep using the QR path even when something quicker is offered. An air gap you step around when convenient is not an air gap.

3Create the wallet and write the words down

Choose to create a new wallet rather than restoring one. The device generates the seed itself and shows the words on its own screen.

• Write the words in order, by hand, on paper or metal.
• Complete the confirmation step the device runs afterwards — it catches transcription errors while they are still fixable.
• Store the backup away from the device, so one theft or one fire cannot take both.
• Do this even if you intend to rely on Keycards or SeedQR. Handwritten words are the format that restores into anything, years from now, with no hardware in between.

4Understand the newer backup options before choosing one

Prime replaces the old microSD workflow with NFC Keycards and SeedQR, and Envoy offers an automated backup arrangement on top. These are genuinely convenient. They are also, every one of them, an object or a file that can reconstruct your wallet — so the question for each is the same one: who could use this if they had it?

• Keycards are physical cards you tap to the device. Treat one exactly as you would treat a seed card: stored away from the device, never photographed, never left in a laptop bag.
• SeedQR encodes your seed as a QR code you can print or stamp. Restoring is a two-second scan instead of typing twenty-four words, which removes a real source of error.
• Envoy's backup features automate part of this. Before enabling any of them, read Foundation's description of exactly what is stored, where it goes, and what is needed to restore it.

5Decide what else this device is going to do

Prime's firmware also handles 2FA codes, FIDO security keys, and encrypted file storage. That is a real convenience — one device, one set of habits, one thing to keep safe.

It is also more code, more interfaces, and more reasons to pick the device up and connect it to things. A single-purpose signer that sits in a drawer between uses has a small attack surface partly because it does so little.

• If this device holds meaningful savings, consider leaving the extra apps unused and keeping it boring.
• If you do want one device for everything, that is a legitimate choice — make it knowingly rather than by enabling features as you meet them.
• Either way, do not let the convenience features change how often the device is handled, connected, or carried around.

6Turn off the radios you are not using

Prime adds Bluetooth and NFC alongside the camera. If your signing happens over QR — and it should, because that is what this device is for — then the radios are capability you are not using.

This is not a claim that they are broken. It is the ordinary principle that a signer's job is to be boring, and every enabled interface is one more thing that has to be correct.

7Verify an address, then check the backup

• Generate a receive address and display it on the Passport screen. Compare the whole string against what your computer shows, not just the first and last few characters.
• Review the recipient and the amount on the device before approving any send.
• Send a small test amount, confirm it arrives, and send it back out.
• Restore your words onto wiped hardware and confirm the same wallet appears, before the amount gets serious.

What you are trading

Being specific about this makes the choice an informed one rather than a brand preference.

• You gain a genuine air gap. Whatever is wrong with your computer stays on your computer. Very few devices offer this as the default rather than an advanced option.
• You gain open-source firmware, so the design is examined publicly rather than asserted.
• You give up single-purpose simplicity. Prime is no longer bitcoin-only, and the extra apps and radios add surface a dedicated signer avoids. If that matters more to you than the convenience, the earlier bitcoin-only Passport is a different trade worth looking at.
• You take on a newer backup system. Keycards and SeedQR are faster than transcription and are also newer, less universal formats. Handwritten words remain the thing that will still work with anything in a decade.

Passport Prime is a recent and substantially redesigned device, and backup features in particular are still evolving. Confirm the current setup flow, the tamper-evidence checks, and exactly what any automated backup stores against Foundation's own documentation before following any step here that does not match what your device shows.