This guide walks you through setting up Passport Prime with manual backups. Unlike the default Magic Backup setup, with this manual setup, your Master Key is split across all three physical Keycards with no data stored on Envoy or your personal cloud account. This setup is for advanced users who prefer full, self-sovereign control over their backup strategy with zero cloud support.
Users who would prefer the simpler Magic Backup approach should follow the setup guide on this page .
If you have any questions, please email us at hello@foundation.xyz
Step 1: Unboxing
Let's unbox your Passport Prime!
Passport Prime ships in a plain outer overpack box.
The device box is sealed with a layer of adhesive bubble wrap followed by a layer of shrink wrap. It contains:
- Passport Prime
- Setup card
- 3x Keycards + Faraday sleeves
- USB-C charge cable
If the seal is broken, the packaging has been unexpectedly opened, or the device appears altered, pause setup and contact Foundation support at hello@foundation.xyz . Do not open the device yourself or assume it is safe to use because a software check passes.
Customs officials may open a package for inspection. Passport Prime's Security Check helps verify its cryptographic identity, but does not establish the absence of every physical modification or implant. Unexpected packaging or device changes still need review by Foundation support.
Step 2: Envoy
If you don't already have Envoy installed, download it, then follow the on-screen prompts to begin pairing with Passport Prime.
You do not need to change any Envoy settings to run Passport Prime with a manual backup. The Magic Backups toggle in Envoy controls backups of the Envoy mobile wallet only, so leave your existing Envoy setup exactly as it is, including its own Magic Backup if you use one.
You opt out of Magic Backups for Passport Prime on the device itself, later in this guide. On the first Create Magic Backup screen during onboarding, tap Advanced in the top right. If you tap Continue by mistake, use the back arrow on the second screen to return to the screen with Advanced. The Magic Backup only starts once you tap Confirm on the NFC Tip screen. Prime Magic Backups cannot be turned on or off after onboarding yet, so make this choice during setup.
Step 3: Initial Setup
First Power On
After turning on Passport Prime for the first time, you will arrive at the welcome screen where you'll have an opportunity to read the device Terms of Use. Tap Get Started and you will be met with a QR code.
Open your phone's built in camera app, scan this QR code and tap the link that is shown. If Envoy is installed, it opens and begins the Passport Prime onboarding connection flow. If not, you are taken to your phone's app store to download it. If you are setting up Envoy for the first time, you can instead tap Set Up a Passport Device in Envoy and scan the QR code being displayed by Passport Prime.
Back on the setup screen, tap Continue, then tap Connect with QuantumLink.
After granting Bluetooth permissions, Envoy's camera will open and Passport Prime will now be showing a new animated QR code series for you to scan.
Once Envoy has scanned the QR code from Passport Prime, the secure QuantumLink tunnel has been established and both devices will continue the rest of the setup process in sync.
If you get stuck at any point during setup, you can restart the initial setup flow by tapping the home button, then Restart Now in the Restart Setup? dialog. If a QR scan does not work as expected, Passport Prime will guide you through what to try next.
Want to learn more about QuantumLink? Tap the 'Learn More' button in Envoy, or follow this link .
Security Check
Passport Prime is provisioned with a device identity key in its secure element. Foundation records the corresponding public key. The validation server checks a signature from the device against that record to help establish authenticity. A passing result is not a guarantee that every part of the device is unmodified or that no physical implant is present.
During this step, Passport Prime will automatically carry out a security check with the Foundation validation server, via Envoy, using QuantumLink.
If your device fails this Security Check, it may have been tampered with or swapped out with a malicious device during shipping. In the unlikely event that this occurs, please contact us via email .
Firmware Update
Passport Prime will then automatically check if there is a new firmware version available for your device. If there is, you will be prompted to start the install.
After starting the install, Passport Prime will use its secure QuantumLink connection with Envoy to automatically download, verify, and then install the new update. Once the update has been installed, Passport Prime will automatically restart.
Step 4: Set a PIN
A 6-12 digit PIN is used to protect unauthorized physical access to your device. The default PIN is numerical, but you have the option to Switch to Password to set a longer, more complex alphanumeric password.
Please ensure you do not set a PIN that is easily guessable (eg 123456). We recommend that you write it down during this step and store it in a safe, secure location.
Passport Prime will erase the Master Key after 10 consecutive incorrect PIN/Password attempts. After which point you must reinitialize the device with a new PIN and recover the Master Key from a backup.
Step 5: Master Key
Creating a new Master Key
Next Passport Prime will securely generate a brand new Master Key using multiple sources of randomness from its internal hardware. This includes the MCU, Secure Element and Avalanche Noise Source . Advanced users who would rather supply their own randomness can read about User Added Entropy .
For those users starting with a new Passport Prime and requiring a new Master Key, simply tap Create Master Key.
Restoring a Master Key
For those users wanting to Restore an existing Master Key from a previous Passport or other compatible wallet, tap Restore from Backup. From the next screen, users can restore via:
- Scan Seed QR, for a SeedQR or Compact SeedQR
- Enter Seed Words, for BIP39 seed words
- Migrate from Passport Core, for a Passport Core encrypted backup (microSD + 20 digits) - COMING SOON
- Restore from Keycards, using Keycards from this, or another Passport Prime
If you choose Scan Seed QR or Enter Seed Words, Passport Prime first shows a We Recommend a New Master Key dialog. Tap Restore to continue, or Back to return.
Step 6: Master Key Backup
Because you opted out of Magic Backups on the Create Magic Backup screen, Passport Prime will now prompt you to create a manual backup of your Master Key. You have two options:
- View Seed Words - Display and manually record the BIP39 seed word representation of your Master Key
- 2 of 3 Keycard Backup - Split the Master Key across all three provided Keycards using Shamir Secret Sharing
Both options are valid and can be used together for additional redundancy. This guide focuses on the recommended 2 of 3 Keycard Backup method. This approach splits your Master Key into three parts using the Shamir Secret Sharing protocol, with one part stored on each of your three Keycards. Any two of the three Keycards are required to restore the Master Key.
Irrespective of the option chosen during onboarding, you can complete additional backups from the Settings screen on Passport Prime at any time. For example, you may want to create a Keycard Backup now and also record your seed words as a secondary backup method.
If you choose to record your seed words, consider storing them in a Steel Backup Capsule for long-term protection against fire, water, and physical damage.
Viewing Your Seed Words
If you tap View Seed Words, Passport Prime first shows a Beware of revealing sensitive information warning. Tap Continue to see your seed words, and write them down on the backup sheet provided. Never take a photo of them.
To see the same Master Key as a QR code, tap the QR icon at the top right of the Seed Words screen. This shows a SeedQR and a Compact SeedQR. Tap the list icon to return to the words.
When you have recorded your seed words, tap Verify. For each word of your seed in turn, Passport Prime asks you to tap the correct word from a set of options. If you pick the wrong one, you can retry that word. Once every word is correct, Passport Prime shows Backup Created Successfully.
Keycard Positioning
Passport Prime uses short-range NFC for secure communication with the Keycards. For the best connection, center the Keycard over the camera area on the back of the device to form a "T" shape. See Keycards for more positioning tips.
Passport Prime will vibrate when the Keycard is in the correct position. Hold the card completely still during each write, as saving data takes a few seconds.
Tapping Your Keycards
After tapping 2 of 3 Keycard Backup, Passport Prime shows the Creating Keycard Backup screen and prompts you to hold each Keycard to Passport Prime, one at a time. The screen will guide you through each step:
Keycard 1 - Hold the first Keycard to the back of Passport Prime. Wait for the on-screen confirmation that Part 1 has been stored.
Keycard 2 - Remove the first Keycard and hold the second Keycard to the back of Passport Prime. Wait for confirmation that Part 2 has been stored.
Keycard 3 - Remove the second Keycard and hold the third and final Keycard to the back of Passport Prime. Wait for confirmation that Part 3 has been stored.
During this process, Envoy will display a simple progress screen confirming that the backup is being created on Passport Prime.
Backup Complete
Once all three Keycards have been written, Passport Prime will confirm that your Keycard Backup has been created successfully.
It requires a compromise of TWO Keycards for an attacker to restore your Master Key. We strongly recommend storing each Keycard in a separate, secure location for maximum resilience.
Importing a Settings & Data backup file during a manual recovery, to restore your previous device settings, accounts, and wallet configurations, is COMING SOON. It is not available on KeyOS 1.4.x.
Finally Passport Prime will use the new Master Key to create your Primary Bitcoin account, then share the public details of this account with Envoy via QuantumLink. You will then be taken to the home screen.
You're All Set! Your new Passport Prime is now ready to use.
Step 7: Data Backup
Because you are not using Magic Backups, your Settings & Data backup file is not automatically synced to the Foundation server. You must create and manage this backup manually from the Passport Prime Settings screen.
The Settings & Data backup file includes your user-defined settings and the data stored by each app (account labels, multisig configurations, 2FA codes, security key registrations, etc.). It does not include the installed app bundles themselves. The file is named settings-YYYY-MM-DD_HH-MM-SS.tar and is encrypted by the Master Key. It is not possible to access the data inside this file without knowledge of the Passport Prime Master Key.
The contents of files stored in the Files app (Internal and Airlock) are NOT included in this backup. Those files live only on the physical device, see the Files app docs for what this means for your stored documents.
Not available yet on KeyOS 1.4.x: a Settings & Data backup file cannot be verified or restored on Passport Prime. You can create and keep these files, but there is currently no way to load one back onto the device, so manual backup users cannot yet bring back app data such as imported Vault items, 2FA codes, security key registrations, or multisig and account configurations after an erase. If you rely on a local file, contact support before erasing or restoring your device. See the recovery checklist for what each backup restores.
Creating a Backup File
From the Passport Prime home screen, navigate to Settings > Backups > Advanced Backups > Settings & Data Backup. This opens the Create Backup File screen.
Tick I have saved my Master Key, then tap Save Device Backup. Choose a folder on external storage (eg a microSD card or USB thumb drive connected via USB-C) or the Airlock, and the backup file will be saved. If you choose the Airlock, disconnect Passport Prime from your computer first, as it can't save to the Airlock while connected by USB, then reconnect to copy the file off (see Airlock and USB Connections ). Avoid saving only to Internal storage, as a file saved there is lost if Passport Prime is erased.
Once saved, Passport Prime shows Backup File Saved and the file's location.
We strongly recommend creating a Settings & Data backup after any significant changes to your Passport Prime, such as adding new accounts, installing apps, or updating settings. Store the backup file on an external storage medium outside of Passport Prime.
Now that you've set up Passport Prime and paired it securely to Envoy via QuantumLink, be sure to dive into the rest of our detailed documentation to get the most from your new device.
Want to learn more about Passport Prime backups and recovery? Click here .
Stay tuned for more video tutorials featuring Passport Prime in the coming weeks and months!
Questions? Email us at hello@foundation.xyz