This guide explains how to use the Foundation Devices Passport Batch 2 hardware wallet for securing and mixing your bitcoin.
The Passport Batch 2 is the second-generation Bitcoin hardware wallet from Foundation Devices. Passport is built in the U.S., air gapped and utilizes open-source code. In this guide, you will see how simple self custody can be with a device like this, the differences between the Founder’s Edition and Batch 2 of the wallet and a walkthrough of select, advanced features.
“Self custody” means that you are in control of your private keys: this is how you maintain unrestricted access to your bitcoin. By extension, unrestricted access to your bitcoin means that you can send or receive bitcoin with anyone in the world for any reason at any time. You don’t need anyone’s permission, you won’t be held against any financial institution’s moral standards and nobody can stop you from making the transactions that you want to make.
With great power comes great responsibility, however, and self custody also means that you are taking radical responsibility for your bitcoin. You and you alone are responsible for managing your private keys in a way that allows you to access them, but not your adversaries. There is no 1-800 help line, there is no reversing of transactions and there is no one who can help you recover lost or forgotten information. This may sound intimidating or complicated, but tools like Foundation’s Passport make self custody very simple and relatively easy to manage.
Passport makes it possible to self custody your bitcoin on a cold-storage device; this way, your private key is kept on a device that never makes a connection to the internet. Through the use of QR codes to sign transactions and the accompanying Envoy app, using the Passport to receive, secure and send bitcoin is easy and intuitive, even without an internet connection directly to the device.
Passport is shipped in a nondescript white box. There will be a shipping label (peeled off for privacy reasons in this demonstration) and a blue, tamper-evident seal on the outside of the box. The tamper-evident seal will be placed over the opening flap of the box and the seal will have a number on it that starts with “B799,” “B862” or “B863.” The full-length unique numbers are not saved by Foundation Devices, but the prefix is used to identify the production batch that the device was manufactured in. You can find a maintained list of these prefixes here.
Privacy tip: Consider using a P.O. Box and an alias to avoid connecting your personally-identifiable information to Bitcoin-related items.
Security Tip: If the security seal shows any signs of tampering, contact hello@foundationdevices.com.
Inside the shipping box is the device box, it should be wrapped in bubble packaging.
Inside the device box you will find:
Envoy is an open-source companion app for Passport. This app is available for iPhone or Android and enables a secure, guided setup experience for your Passport. While it makes for a convenient companion app, it is not required to use the Passport. You can use any wallet you want to monitor balances, build transactions or generate receive addresses.
With Envoy, you can also install the latest firmware updates from your mobile device using the included micro SD adapters. The security validation to ensure that your Passport has not been tampered with in transit can also be completed from the Envoy app. There is a beginner-friendly Bitcoin wallet built into Envoy that enables you to easily receive bitcoin to your Passport. You can also create transactions in Envoy, ready to sign with your Passport using the QR code communications, all while your private keys remain secured on the Passport. Envoy connects to the internet via Tor by default.
This guide will cover how to download Envoy from the F-Droid repository on an Android mobile device. The cool thing about F-Droid is that you can get apps from it without the need for a Google Play store account. The F-Droid security model enforces that all apps have a valid signature over the entire contents of the Android package (APK file), so you know you are getting the app intended for you by the developers who control the signing key of the repository you are using.
The first step is to complete the supply chain validation. This ensures that your device has been delivered to you as the manufacturer intended, authentic and unmodified.
A PIN code on the Passport can be between six digits and 12 digits in length. Using a PIN that is easy to guess is not recommended. There is no way to recover a lost PIN. In the event that an incorrect PIN is entered into the Passport Batch 2 21 times, the device will self destruct and become permanently useless. If that occurs, your bitcoin is still safe, so long as you have your seed phrase (covered in the next section), it just means the device itself is ruined.
You can also enable security words which add a layer of protection in the event that your device is ever tampered with. If you enable security words, you will enter your PIN in two parts, a prefix and suffix. After entering the prefix, you will be presented with two English words, for example “moment auction.” Because of the way that these words are generated, if anything has been tampered with on your Passport hardware or software, then these words will be different than the ones you were expecting. If the words are the ones you were expecting, then you enter your PIN suffix and complete the login process.
Next time you turn on your Passport, you should be prompted for your PIN before being able to use the device.
The seed phrase is a human-readable representation of the initial entropy used to generate your Bitcoin private keys. Most commonly, seed phrases will be a list of 12 or 24 words. Backing up your seed phrase in a safe and secure way will enable you to access your bitcoin in the event your wallet is lost, stolen, destroyed, etc. So long as you have your seed phrase, you have access to your bitcoin. That also means that anyone else who gains access to your seed phrase has access to your bitcoin.
Take precautions to ensure you save your seed phrase in a safe and secure way. There are several methods, ranging from encrypted micro SD cards, to paper backups, to QR codes to steel plates or washers. Whichever method you choose, your seed phrase will work with a wide range of Bitcoin wallets. Many industry participants have implemented the BIP39 standard, which defines how seed phrases work. This allows users to recover their bitcoin on a number of mobile, desktop or hardware wallets, regardless of which wallet they used to generate the seed phrase. Taking a picture or screenshot of your seed phrase is not recommended.
For a more in-depth article on encrypted backups, check out this resource.
Now you have an encrypted backup of your seed phrase to keep safe and secure in case you need to recover your wallet on another Passport in the future. Ensure that you keep the backup code safe and secure as well because it is required to decrypt your backup. The encrypted backup also includes all device settings, accounts, account labels, etc. You can see all of the details here.
Storing the micro SD card and the backup code in the same location kind of defeats the purpose, since if they are found then an adversary could steal your bitcoin. If you want to save a plain-text copy of your seed phrase so that you have the option to recover your wallet using the BIP39 word entry on a number of other wallets, you can fill it in on the included notecard as well.
Having your Passport connected to your Envoy app enables you to retrieve the latest firmware, watch your account balances, connect to your own instance of an Electrum server, communicate over Tor and more. Your private key information never leaves the Passport, only the public information is shared with the Envoy app so that it can calculate receive addresses and monitor balances.
Keeping the firmware up to date ensures that your Passport has the latest bug fixes, improvements, features and security patches. However, updating the firmware is not mandatory, your Passport will still work but just won’t have any updates.
There are a few different ways to get the latest firmware, from the Foundation website, from its GitHub repository or from the Envoy app. This guide will demonstrate the Envoy app method.
As a security precaution, the Passport will only install firmware signed by two out of four possible Foundation developer keys. Whichever method you choose, you will be saving the firmware file to the micro SD card and loading the update onto your Passport from there. This helps keep the device air gapped.
Make sure you have your micro SD card and included adaptor ready to plug into your mobile device. Also, you can always double check which firmware version your Passport has currently installed when you power the device on, it will show the firmware version number at the bottom of the screen during boot up.
This completes the initial set up for your Passport. From here, there are a number of features and configurations you can make that suit your unique needs best. The following section will compare the differences between the Passport Founder’s Edition and Passport Batch 2. Then the final section will demonstrate select advanced features.
The Passport Batch 2 offers many upgrades over the Passport Founder’s Edition. The following section describes these upgrades:
The Passport Founder’s Edition measures 100 millimeters (mm) long by 35 mm wide by 23 mm thick. The Passport Batch 2 measures 110 mm long by 39 mm wide by 19 mm thick.
The Passport Founder’s Edition features a single port, the micro SD card port. The Passport Batch 2 features a micro SD card plus a USB-C port to charge the battery. The USB-C port is power-only and cannot transmit data. The micro SD card port in the Passport Batch 2 has more depth so that the micro SD card can be inserted further, whereas the micro SD card port on the Passport Founder’s Edition leaves roughly half of the micro SD card sticking out.
The keypads on both Passports are similar in that they both feature alphanumeric keys. However, the Passport Founder’s Edition keys have more of an oval shape and the keys on the Passport Batch 2 version have more of a rectangular shape.
The navigation keys on the Passport Batch 2 are copper in color, rectangular for the power and select controls, and square for the up/down/left/right controls. Whereas on the Passport Founder’s Edition, the power button shares the same key as the delete button. The key to the left of the up/down/left/right controls is dedicated to the shutdown function. The navigation controls on the Passport Founder’s Edition are more rounded in shape.
The screen on the Passport Batch 2 is a high-resolution, color, IPS display, bounded to ultra-strong glass. The display on the Passport Founder’s Edition has a plastic screen and it is not a color display. The brightness can be adjusted on both Passports. The display when measured diagonally is 43 mm on the Passport Founder’s Edition and 50 mm on the Passport Batch 2.
The Passport Batch 2 features a rechargeable and removable lithium-ion battery with a 1,200 milliamp hour (mAh) rating. The Passport Founder’s Edition features two AAA batteries. The lithium-ion battery has a much greater battery life and an industry standard form factor known as “BL-5C” and it can be obtained from many different online vendors for less than $10. Both Passports feature a removable magnetic back piece to quickly access the batteries.
Both Passports use the Omnivision CameraCube but the camera housing is a little different between the two. The Founder’s Edition is pictured on the left and the Batch 2 is pictured on the right.
Most of the menu options available on the Passport Founder’s Edition version 1.1.0 are also available on Passport Batch 2. Some of the folder configurations are a little different but most of the options are there with the exception of signing a text file. Passport Batch 2 also introduces extensions for Casa and Whirlpool, which add additional accounts in Passport that you can connect to. Both Passports can be connected to the Envoy app to make monitoring balances, generating receive addresses and building transactions easier. The next firmware release for the Founder’s Edition will be identical to the Batch 2 firmware.
This completes the comparisons section. In the next section, you will see how to use select features of the Passport.
Whirlpool is a zero-link CoinJoin implementation supported by Samourai Wallet on Android mobile devices and by Sparrow Wallet on Linux, Mac and Windows desktops. Zero-link CoinJoin means that there are no deterministic links between the inputs and outputs of the CoinJoin transaction. Because multiple entities are involved with each CoinJoin, there cannot be any certainty as to which entity owns which transaction output. CoinJoins can be used as a technique to gain anonymity on a public blockchain, putting the decision to selectively reveal details about yourself back in your hands, thus giving you a layer of privacy separating your real-world identity from the transactions on a public ledger.
Passport supports Whirlpool accounts and this section will demonstrate how to setu p and use this feature on Bitcoin’s testnet. All the steps are the same for Bitcoin’s mainnet. There will be two wallets used in this demonstration; the first is Sparrow Wallet, acting as the hot wallet which is the wallet where the CoinJoin transactions will originate from, and the second is Passport, acting as the cold wallet where the outputs from the hot wallet CoinJoins will be deposited.
Using this technique offers a couple benefits. First, each deposit to the Passport will look like every other CoinJoin output to external observers on chain and, therefore, no one except for you will know that those unspent transaction outputs (UTXOs) are now in cold storage. So, as other CoinJoin participants continue mixing the other UTXOs from your CoinJoin transactions, the forward-looking anonymity set of your UTXOs in cold storage continues to grow.
Another benefit is that the Whirlpool account on Passport was designed in such a way that you can import it to a hot wallet at any time in the future and continue mixing those UTXOs as free-riders in Whirlpool, thus saving yourself from paying the coordinator fees a second time. Additionally, you won’t pay any additional miners fees when importing this account to a hot wallet in the future as opposed to sweeping UTXOs. Understand, though, that importing the Whirlpool account to a hot wallet exposes the seed to an internet-connected device and therefore it is recommended to use a separate seed on your Passport for any accounts you plan on doing this with.
This guide assumes you have already installed Sparrow Wallet on your preferred desktop. If you haven’t done so already, navigate to the Sparrow download page for detailed instructions. Consider your options for connecting to a public node, your own Bitcoin Core node or your own private Electrum server carefully.
Once you have your Sparrow Wallet application installed, open it and navigate to “File,” then “New Wallet”:
Then, name your new wallet and click on “Create Wallet”:
Next, you will have the opportunity to adjust a few settings. Unless you have a good reason to change these settings and you know exactly what you are doing, then it is probably a good idea to just leave the policy type, script type and script policy descriptor in their defaults, as demonstrated here. Then, click on “New or Imported Software Wallet”:
A window will pop up, — click on the drop-down menu in the upper right-hand corner to select the number of words you want to use for your hot wallet’s seed phrase (also known as the “mnemonic phrase”):
A 12-word seed phrase was chosen for this demonstration. Once you have made your selection, the corresponding number of blank boxes will appear in the pop-up window. Click on “Generate New” and Sparrow Wallet will generate a random seed phrase:
You can add a passphrase or leave that field blank. This is kind of like having a 13th or 25th word added to your seed phrase that only you know. There is no way to recover a lost or forgotten passphrase and this will be necessary to access your bitcoin going forward if you decide to use it.
Make sure to write down your seed phrase words in order and keep them safe. Also write down your passphrase if you decided to use one. Consider keeping your seed phrase and passphrase separate from each other to help prevent loss of funds in the event that your secrets are discovered. Writing this information down in a notebook or stamping it into metal to protect it against environmental hazards are common ways that Bitcoiners keep their backups safe and secure. Anyone who gains access to this information will be able to steal your bitcoin, so make sure you keep it safe. Double checking your backup information is a good way to ensure you have copied it all down correctly.
Once you are ready, click on “Confirm Backup…,” then you will be asked if you have written this information down. When you click on “Re-enter Words…” you will then prove you have written your seed phrase down correctly by entering the words in order.
If you make a spelling mistake while entering your words, the dialog box will turn red to get your attention, for example, “word #9” below should be “metal”:
Once everything looks good and you see the green check mark indicating a valid checksum, then click on “Create Keystore”:
Then click on “Import Keystore” in the upper right-hand corner:
Then you will be presented with a summary of your new wallet’s settings. If you used a passphrase, make sure you write down the master fingerprint along with your passphrase so you can confirm that you entered it correctly in the future. If everything looks good, then click on “Apply.”
You will then be asked if you want to add a password. This password is optional but it will encrypt your wallet file so that if anyone gains access to your desktop computer and they attempt to open your wallet file, then they will need this password.
Now that you have your hot wallet created, the Whirlpool accounts will automatically be added once you initiate your first CoinJoin. Alternatively, you can initiate the Whirlpool accounts manually from the settings tab where it says “Add Account…”:
You will be presented with a list of accounts you can add; at the bottom of that list select “Whirlpool Accounts”:
Then select “OK”:
You will notice now that several tabs have appeared along the left-hand side of the user interface. These are the four accounts used to make Whirlpool work. The first one is the deposit account where you will want to send bitcoin that you want to CoinJoin. From the deposit tab, you can click on the receive sub-tab to display a QR code for one of your receiving addresses and you can send bitcoin to it.
Once you have made one or more deposits to your hot wallet, you can click on the UTXOs sub-tab to see your available outputs. Select the ones you want to CoinJoin or use the “Select All” option to use them all. Just keep in mind that selecting all will link all of these UTXOs together on chain in the next step, prior to them being CoinJoined. If you don’t want them linked on chain, then just mix one at a time.
Once you have your selection made, click on “Mix Selected”:
A window will pop up and, if you have an SCODE for reduced coordinator fees, then you can enter it here. Then you can select your transaction priority or, in other words, the amount you are willing to spend on mining fees. Once you have these options set, click on “Next”:
Then you can choose the pool size you want to join. There are four sizes to choose from, the 100,000 sat pool size was used in this demonstration which will create 20 UTXOs that are all 100,000 sats each. The coordinator fee for this is 5,000 sats. Click on “Preview Premix” once ready:
Then you will see a summary of the transaction you just constructed. This transaction is called “tx0” and you will notice that all of the selected inputs of various sizes and from various addresses are consumed in this transaction and 20 like-sized outputs are created. These like-sized outputs from tx0 will be used as eligible inputs to Whirlpool CoinJoin transactions. There are three other outputs in a tx0 as well; the coordinator fee, the toxic change and the miners’ fee. If everything looks good, then click on “Broadcast Premix Transaction”:
Then your wallet will send your transaction to the Bitcoin network:
From the deposit tab and the transactions sub-tab, you will be able to see that the bitcoin you deposited to this account has been sent out:
Then, if you click on the premix tab and the transactions sub-tab, you will see the bitcoin from your deposit account is now in your premix account:
So long as your wallet is connected to the internet, then your available like-sized outputs in your premix account will be registered as eligible inputs for the coordinator to use in CoinJoin rounds. As more participants add liquidity, more of your premix outputs will be CoinJoined. After going through a CoinJoin round, each UTXO will appear in your post-mix account, which you can view from the post-mix tab and the transactions sub-tab. So long as you leave your wallet open and connected, the UTXOs in your post-mix account will remain available as eligible inputs to CoinJoin rounds as free-riders, where they get mixed again and again with no added fees to you:
The toxic change from tx0 is sent to your “badbank” account, which you can view from the badbank tab and transactions sub-tab. You want to be cautious about how you handle these outputs because they are linked on chain to any inputs used in the related tx0 they came from. For example, don’t send some Whirlpool outputs and some toxic change to the same address because that would undo the anonymity benefits gained by using Whirlpool.
Now that you have your hot wallet established and some bitcoin being CoinJoined in Whirlpool, you can set up the cold wallet extension on your Passport. This will be the account you are sending your CoinJoined outputs to for long-term cold storage. Using a separate seed from your primary cold storage seed for this process is recommended. If you want to import it to a hot wallet at any time in the future and continue mixing those UTXOs as free-riders, it will expose the seed to an internet connected device.
Now you are ready to initiate the connection process in Sparrow Wallet.
Now, with both your hot wallet and watch-only wallet open in Sparrow Wallet, you can navigate back over to your hot wallet tab and point it to your watch-only wallet so it sends Whirlpool outputs there.
Once your UTXOs have gone through some CoinJoin rounds, they will start showing up in your watch-only wallet as they are deposited to cold storage. Make sure to leave your hot wallet open and connected to the internet to get continuous CoinJoin rounds.
You can also monitor your Passport post-mix account from the Envoy app. Just like with connecting your primary wallet, simply select “Connect Wallet” from the post-mix account page on your Passport and then go through the animated QR code connection process using your Envoy app.
You can create transactions to spend from your Postmix account using the Envoy app and then you can sign those transactions using the QR code method.
This concludes the selected features section.
In this guide you were introduced to Passport and shown the unboxing, supply chain validation, how to download the Envoy companion app, how to update the firmware, initial setup of your Passport, comparisons between the Passport Founder’s Edition and the Passport Batch 2, and how to use the Whirlpool feature to CoinJoin directly to your cold storage device.
This is a guest post by Econoalchemist. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc or Bitcoin Magazine.
