Passport Prime: Complete Setup, Airgapped Transactions, and Review

Unboxing and Initial Setup

The Passport Prime ships in a discreet, secure package. Inside, you will find the device itself, which features a camera on the back, a button on top, and a USB-C port at the bottom. The box also includes a USB-C cable, three smart cards for backups, lined protective cases to prevent scanning, and a booklet for writing down your seed phrase.

To begin the setup:

1. Power on the device. It contains a battery but can also be plugged in.
2. Press "Get Started" to view a QR code.
3. Scan the QR code with your phone to download the official Envoy app (available on Google Play or F-Droid).
4. Open Envoy and pair it with your Passport via secure Bluetooth.
5. Create and record a 6 to 12-digit PIN.

Master Key and Magic Backups

Once your PIN is set, the device generates your master key. Foundation uses a system called "Magic Backup" that splits your master key into three parts:

• Two parts are stored on the provided NFC smart cards.
• The third part is encrypted and backed up to your phone via the Envoy app (and your cloud account).

To set this up, place the key cards near the device to use the short-range NFC. I found the NFC reader to be slightly sensitive, so placing the cards firmly against the upper back of the device worked best. If you prefer a traditional backup, you can view your 12-word seed phrase in the Passport's settings under Backups > Advanced Backups > View Seed Words.

Sending and Receiving with Envoy

Receiving Bitcoin is straightforward using the Envoy app. Simply navigate to the Receive tab, copy your address, and send funds. To send Bitcoin out:

1. Initiate the transaction in the Envoy app by pasting the destination address and amount.
2. Select "Sign with Passport". The app transfers the unsigned transaction to the device via encrypted Bluetooth.
3. Carefully verify the destination, amount, and fee on the offline Passport screen.
4. Slide to sign. The signed transaction is sent back to the Envoy app, which then broadcasts it to the Bitcoin network.

Creating a Passphrase (Hidden Wallet)

For enhanced security, you should add a strong passphrase. This creates a hidden wallet, effectively combining your seed phrase with a custom password. If an attacker finds your seed phrase or backup cards, they still cannot access your funds without the passphrase.

To create one, click the wallet button on the Passport's homepage, select the three dots at the top right, and choose Apply Passphrase. Once applied, the device provides a unique fingerprint identifier so you can verify you are in the correct wallet. Remember to store your passphrase in a separate physical location from your seed phrase backup!

Fully Airgapped Transactions with Sparrow Wallet

While Envoy is convenient, you can use the Passport Prime in a fully airgapped manner with Sparrow Wallet on your computer:

1. On your Passport, go to your desired wallet (default or passphrase), select Connect Wallet, choose Sparrow, and generate a QR code.
2. In Sparrow, select Import Wallet, choose Passport, and scan the QR code with your computer's webcam.
3. To send Bitcoin, construct the transaction in Sparrow and select Show QR Code.
4. Use the Passport's built-in camera to scan the transaction QR code on your computer screen.
5. Verify the details on the Passport, slide to sign, and a series of QR codes will display on the device.
6. Use Sparrow to scan the signed QR codes from the Passport, then broadcast the transaction.

Final Review and Thoughts

Overall, the Passport Prime is an excellent hardware wallet. The camera works flawlessly for airgapped QR code scanning, far outperforming the finicky scanners on some older hardware wallets. The user interface is clean, and the integration with Sparrow is seamless.

My main criticism is the initial setup. I would prefer to initialize the device in a completely airgapped fashion, rather than being forced to use the Envoy app and Bluetooth for the initial pairing and updates. However, once set up, you can disable Bluetooth, NFC, and USB connections, relying entirely on the camera for secure, airgapped signing.