On This Page
Recovery has two parts: restoring the right wallet key, and restoring any separate secrets or data. A Master Key backup is not a complete backup of everything stored on Passport Prime.
This guide reflects KeyOS 1.4.x and Envoy 2.3.x. See Lost or Replaced Devices for common scenarios.
What Each Backup Restores
| Item | What you need | Important limit |
|---|---|---|
| Prime Master Key and its Bitcoin wallet | Seed words or SeedQR, or two parts from one backup set (two Keycards, or one Keycard plus the part stored by Envoy) | Also keep any wallet passphrase and your account details. Foundation's server never holds any part of the Master Key. |
| Bitcoin account labels and multisig configurations | A matching Magic Backup of your app data; also export each multisig configuration separately | A seed alone does not record the other cosigners or the wallet policy. |
| Generated Vault items | The Master Key, plus the item's type, index and options | These are regenerated from the Master Key. Keep a note of the details, such as password length. Imported items are different. |
| Imported Vault seeds and passwords | A matching Magic Backup of your app data, or a separate backup of each imported secret | These cannot be regenerated from the Master Key alone. |
| Legacy Mode seed made with Create new Seed | The Master Key | This seed is derived from your Master Key, so it comes back with it. Writing down its own words is optional. Imported Legacy Mode seeds need app data or their own backup. |
| 2FA codes and security key registrations | A matching Magic Backup of your app data, plus each service's recovery codes or a second registered factor | Restoring the Master Key alone does not bring these back. Test that you can still log in after a recovery. |
| Wallet passphrases | Your own record of each passphrase | Passphrases are never stored in any backup. |
| Installed third-party apps | The original app files | App data is included in Magic Backups, but the apps themselves are not. Keep the app files in case you need to install them again. |
| Internal and Airlock files | Separate copies outside Passport Prime | Files contents are not included in Settings & Data backups or Magic Backups. |
| Envoy mobile-wallet seed | Envoy's Magic Recovery on the same phone platform, or Envoy's own seed words | This seed is separate from Passport Prime and Passport Core. |
| Envoy settings and labels | The Envoy Backup File or a matching Envoy Magic Backup | Restoring the seed rebuilds transaction history, but not every label or setting. |
| Passport Core wallet | Seed words, or the encrypted microSD backup plus its backup code | Keep any BIP39 passphrase and multisig configuration separately. |
Prime Local-File Recovery Limitation
Not available yet on KeyOS 1.4.x: a Settings & Data backup file (settings-YYYY-MM-DD_HH-MM-SS.tar) saved from Settings > Backups > Advanced Backups > Settings & Data Backup cannot be verified or restored on Passport Prime. Only a matching Magic Backup can restore app data, through Envoy.
Keep your local files, but do not erase a device on the assumption that a saved file can be loaded afterwards. If imported Vault items, 2FA codes, security key registrations or other app data depend on that file, contact support before erasing. Never send your Master Key, seed words or imported secrets to support.
Before Erasing or Replacing a Wallet
- Confirm which wallet and device you are recovering. Envoy, Passport Prime, Passport Core and Legacy Mode imported seeds can all be different.
- Check that you hold the required key backup. For Keycards, use Settings > Backups > Verify Keycards . A Magic Backup check needs an active QuantumLink connection to Envoy plus both Keycards. A manual 2-of-3 check needs all three Keycards.
- Write down the details you will need to check the recovery:
- Master Fingerprint: on Passport Prime, open Settings > Settings > About .
- Account numbers and fingerprints: in the Bitcoin app, tap each account, then Account Details .
- First receive address of each account: in your wallet software (or Envoy's Receive screen), note the first address you used. Passport Prime can show its own addresses with Verify Address > Explore Addresses (Verify Address ).
- Passphrases: write down every passphrase you use, and the fingerprint Passport Prime shows for it when you apply it. A lost passphrase cannot be recovered from any backup.
- Multisig configurations: tap the multisig account, then Export Config, and save it to a file you keep off the device.
- If you use Magic Backups, connect to Envoy and tap Settings > Backups > Back up now . The time of the last backup is shown at the top of the Settings screen . If you rely on a local file, read the limitation above first.
- Copy important Internal and Airlock files to a USB drive or microSD card. Disconnect Passport Prime from any computer first, then in the Files app select the files, choose Copy, open the External tab and tap Copy Here (see Moving Files ). Then open the copies on a computer to check they work.
- Keep your own record of each imported Vault seed or password, and save each service's recovery codes (usually in that service's security settings) or register a second login method.
- If anything is uncertain, stop and contact support before erasing.
You do not need to erase a working device to check its backup. Use Verify Keycards and, where practical, rehearse the full recovery on a spare device with test data only.
After Recovery
Work through these checks before you rely on the recovered device:
- Fingerprint: open Settings > Settings > About and check that the Master Fingerprint matches the one you wrote down. If it doesn't, you have restored a different wallet. Stop and check which backup you used.
- Passphrases: if you used a passphrase, apply it again from the Bitcoin app's three-dot menu (Apply Passphrase ). Before you confirm, Passport Prime shows the fingerprint for that passphrase. Check it matches your notes. A different fingerprint means a typo, and the passphrase opens a different, empty wallet.
- Accounts: in the Bitcoin app, check that each account you need is listed with the right account number. Add any missing account with Create Account , setting the same account index under Advanced Options.
- Receive addresses: reconnect your wallet software and let it synchronize. The balance and transaction history should match what you expect. Then pick an address shown by your wallet software, and on Passport Prime tap the account, then Verify Address, and scan it. Passport Prime should confirm it belongs to the account. In Envoy, use Verify Address with Passport on the Receive screen.
- Multisig: tap each multisig account and open Account Details to check the policy (for example 2 of 3) and every cosigner against your coordinator. If a configuration is missing, add it again with Import Multisig before signing anything.
- Vault, 2FA and security keys: open each app and check your items are listed. Then log in to at least one service with a 2FA code, and one with a security key. If any are missing, re-import them (2FA imports ) or use that service's recovery codes to register again.
- Files: plug in the drive holding your copies, select the files on the External tab, choose Copy and tap Copy Here in Internal or the Airlock.
Keep the old device and backups until these checks are complete. See Passport Prime Backups , Passport Core Backups and Envoy Backups for device-specific instructions.