🛡️ Be aware: Foundation will NEVER ask for your seed words, device PIN, or call you unexpectedly. If anyone does, it's a scam.

On This Page

Updating the firmware on Passport Prime ensures your device benefits from the latest features and security updates. Firmware should only ever be downloaded from Envoy, our GitHub or this support site.

The easiest way to update Passport Prime is via Envoy and the QuantumLink connection. Advanced users that prefer to manually download, verify and install their firmware can follow the instructions further down this page.


Update with Envoy

The easiest and fastest way to update the firmware on Passport Prime is via Envoy and the QuantumLink connection.

  1. Open the Settings screen on Passport Prime by tapping the gear icon in the dock at the bottom of the home screen
  2. Tap Update, then tap Check for New Version
  3. If an update is available, tap Update with Envoy
  4. Passport Prime will use its secure QuantumLink connection with Envoy to automatically download, verify, and install the update
  5. Once installed, Passport Prime will automatically restart

Passport Prime's battery level must be above 20% before it will start a firmware update, whether you update with Envoy or manually. Firmware Recovery needs at least 50%.

KeyOS 1.4.1 made firmware updates significantly faster, using faster compression, hardware-accelerated verification and quicker writes to storage.


Manual Updates

The steps in this section require an already accessible Settings screen. If initial onboarding has not reached that stage, use Initial manual firmware transfer below instead. Avoiding Bluetooth for the firmware transfer does not remove Envoy from the current initial connection and security-check process.

Some users may prefer to manually download and verify their own firmware before installing on Passport Prime. Manual Update is available on KeyOS 1.4.0 and later and does not need Envoy. If your Passport Prime is running an earlier version, use Initial manual firmware transfer below instead.

Every KeyOS release publishes an update file named KeyOS-v<current>-to-v<new>-Update.tar. Each one moves the device from one specific version to the next, so download the file whose starting version matches what you are running now. You can check your current version under Settings > Update.

  1. Download the .tar update file from the link below, or directly from GitHub
  2. Optionally verify the file using the steps below
  3. Get the file onto Passport Prime, using either of these routes:
    • External storage. Copy the .tar onto a USB drive or microSD card, then insert it into Passport Prime's USB-C port
    • Airlock. Set the Airlock to Airlock Read & Write from the three dot menu in the Files app, connect Passport Prime to your computer over USB-C, copy the .tar across, then safely eject the Airlock and disconnect the cable. Passport Prime can't open files from the Airlock while it is connected to a computer, so disconnect before the next step
  4. On Passport Prime, open the Settings screen, tap Update, then tap Manual Update
  5. Select the .tar file from the file picker. Verification and installation start as soon as you select the file

The update file has to be on external storage or in the Airlock. Passport Prime does not offer files held in its internal storage when you choose Manual Update.

Manual Download (Latest Release)

Once the update has been installed, Passport Prime will automatically restart.

Initial manual firmware transfer

If Manual Update is not available yet (onboarding has not reached Settings, or Passport Prime is running a version earlier than KeyOS 1.4.0), use Firmware Recovery with the signed KeyOS-v<version>-Recovery.bin from the latest release (currently KeyOS-v1.4.1-Recovery.bin). The latest Recovery.bin installs from any earlier version. This is a different file and workflow from a version-specific Update.tar.

If your Passport Prime is already running KeyOS 1.4.x and onboarding shows the Update Available screen, you can instead tap the file icon at the top right of that screen and select the matching Update.tar from a USB drive or microSD card connected via USB-C.

  1. Ensure Prime has at least 50% battery charge and preserve any existing Master Key and data backups. If recovery or backup safety is uncertain, contact Foundation support before continuing.
  2. Copy the Recovery.bin file to a USB-C drive, or a microSD card used with a USB-C reader. Firmware Recovery cannot read files from the Airlock.
  3. Power Prime off, then turn it on with one press of the power button.
  4. While the Foundation logo is displayed, press the power button repeatedly to open the boot menu.
  5. Select Recovery > Firmware Recovery.
  6. Connect the external storage and select the Recovery.bin file.
  7. Let the installation finish and Prime restart. Do not disconnect storage or interrupt power during installation.

Use Firmware Recovery, not an erase or factory-reset option. Do not substitute CoreSystemRecovery.bin or an Update.tar. If the file is unavailable or your recovery situation is different, contact Foundation support. Envoy is still needed to finish the current initial onboarding process.

Verifying the Firmware

Passport Prime will only install firmware that has been signed by 2-of-4 Foundation Devices keys. This check happens automatically during installation, regardless of the update method used.

Advanced users who wish to independently verify the firmware before installing can follow the steps below.

Source Verification

To verify the firmware was published by a legitimate source, we sign all firmware releases with our PGP key. The public key can be imported from our website or downloaded directly below.

Foundation_Key.pgp Download

Once downloaded, import the key using:

gpg --import foundation_key.pgp

The key ID should be CFE1890AB7FC8B64 and the fingerprint is 5DBE 7F18 5293 9353 15E5 6E31 CFE1 890A B7FC 8B64.

Next, download the signature file (.sig) published alongside the update file on GitHub. Place it in the same folder as the update file and run:

gpg --verify KeyOS-v1.4.0-to-v1.4.1-Update.tar.sig

Amend the file name to match the version you are verifying. For this step to be considered successful, look for the term Good signature.

WARNING: This key is not certified with a trusted signature means that PGP doesn't place a high level of trust in the key downloaded from the internet. For this to be a fully trusted key, it would need to be verified in person. Due to practicalities, most people do not do this and instead look to verify a key from multiple different online sources.

Contents Verification

Advanced users can verify the integrity of the firmware contents prior to installing by using the sha256 function in their terminal.

shasum -b -a 256 KeyOS-v1.4.0-to-v1.4.1-Update.tar

Every release publishes a matching .sha256 file alongside the update, so compare the hash your terminal prints against the contents of that file. An .md5 file is published too if you prefer to check that instead.

Amend the file names to match the version you are verifying.


Check Version

To see which firmware version your device is currently running, open the Settings screen by tapping the gear icon in the dock at the bottom of the home screen, then tap Update. This screen shows the currently installed firmware version. Tapping Check for New Version will tell you whether you are already up to date.


The installed version is also listed under Settings > Settings > About, alongside your device serial number, Master Key fingerprint and board revision. The Software section there also shows the Bootloader, BLE Firmware and BLE Bootloader versions.


You can also see the installed version in Envoy on the Devices screen, where a small red dot appears next to the firmware version when an update is available.

A full list of what changed in each release, including any security fixes, is published with every version on our GitHub .