Foundation Passport:
a genuinely rare combination, a real secure element and fully open hardware, in one device.

The Passport pairs a real, dedicated secure element chip with fully open-source hardware and firmware, published under specific, real licenses, MIT for the firmware and the CERN Open Hardware License for the hardware design files. This combination is genuinely rare: most secure element vendors restrict publication under NDA, forcing competitors to choose between a certified chip and full transparency. The air-gap is enforced at the hardware level, not just in firmware: the USB-C port is physically wired for power delivery only, with no data lines connected at all, and signing happens exclusively via camera-scanned QR codes or an optional microSD card. A deliberate physical keypad instead of a touchscreen is explicitly chosen to reduce attack surface and firmware complexity. Real, independent third-party review of the firmware adds an additional layer of verification. We found no disclosed vulnerability or security incident specific to this device in our research.

Real, deliberate, narrow focus: Bitcoin only, with no other blockchains or altcoins supported at all. Real, broad interoperability partially offsets this: standard BIP39 seed phrases restore on any compatible wallet, and the device works in multisig setups alongside Coldcard, Jade, Trezor, or software signers through popular coordinators including Sparrow, Specter, Nunchuk, and Casa.

A genuinely readable small color IPS display paired with a physical directional keypad keeps the interface tactile and deliberately simple, a real, intentional choice to avoid the added complexity of a touchscreen. Both a camera (for QR codes) and a microSD card slot offer real, flexible air-gapped data transfer options. Real, honest acknowledgment from at least one favorable, detailed source: the QR workflow and seed-phrase concepts carry a genuine learning curve, and beginners are better served starting with a simpler device before returning to this one.

Real, genuinely premium build: a CNC-machined metal housing gives real rigidity and a premium feel. A genuinely distinctive user-replaceable battery avoids the long-term degradation risk of a sealed internal cell; sources describe this differently, with the most detailed technical source specifically citing a user-replaceable 1200 mAh lithium-ion cell, while at least one other source describes standard AAA batteries, a real discrepancy we couldn't fully resolve. A compact, discreet, phone-like form factor is independently described as small enough to pass through airport security without drawing attention.

Foundation Devices is a real but comparatively newer company, founded in 2020, with a real, honestly-acknowledged shorter track record than more established competitors like Ledger or Trezor. We found no disclosed security incident or vulnerability specific to this device in our research, a genuinely clean record. Real, independent third-party firmware review adds a meaningful trust signal.

At $199, this is a real, premium price point, independently and consistently described as "one of the more expensive hardware wallets," though multiple sources frame this as justified by the genuinely premium build and thorough open-source commitment. At least one detailed source is candid that this isn't the best first purchase for beginners specifically, recommending a Trezor Safe 3 or BitBox02 instead until you understand the fundamentals.

Real, built-in Tor mode in the companion Envoy app is a genuine, distinctive Bitcoin-privacy feature. Real, broad multisig compatibility across multiple coordinators and competing hardware brands is a genuinely useful interoperability feature. A real, distinctive microSD-based signing option supplements QR-code signing for additional air-gap flexibility.