Losing access to a wallet or device doesn’t need to mean panic. We’ve built Magic Backups into both Envoy and Passport Prime to make backup and recovery seamless, without compromising on privacy. No accounts. No emails, and most importantly, no access to your seed or data by Foundation. Ever. Just strong encryption, smart design, and a bit of cryptographic magic.
Let’s walk through what makes our backups so Magic.
🔐 Magic Backups in Envoy
When you set up an Envoy mobile wallet, it generates a Bitcoin seed and stores it securely in your phone’s secure element, a hardware-protected environment isolated from apps and the operating system.
From there, Magic Backup kicks in behind the scenes to keep your wallet recoverable.
📁 What We Actually Store (and what we don’t)
When Magic Backup is enabled in Envoy, the app automatically creates a secure, encrypted backup of your wallet’s non-sensitive data, things like account labels and settings, so you can restore your wallet exactly how you left it. This backup is created and stored in a way that keeps your seed and personal information completely private.
Here’s exactly what happens when that backup is created:
- Secure seed sync via Apple or Google
Most users have iCloud Keychain or Android Auto-Backup enabled. This means your encrypted seed, stored in the secure element, is automatically backed up across your devices, fully end-to-end encrypted by your operating system.
✅ Foundation never sees your iCloud or Google account, never sees your seed, and doesn’t need permission to back it up.
- Encryption with your seed: Your Envoy settings, labels, and connected Passport accounts (if you have any) are encrypted using your mobile wallet seed as the encryption key. This means only someone with access to your seed can decrypt the backup.
- Stored as a secure file: The encrypted backup file is uploaded to Foundation’s servers as a file of data. We have no access to the contents, no ability to decrypt it, and no knowledge of what’s inside.
- Private identifier: To allow Envoy to retrieve your backup later, your encrypted metadata is stored alongside a SHA256 hash of your mobile wallet seed. This lets our server verify that a restore request is legitimate without ever knowing your actual seed.
🔄 Recovery in Seconds
If you ever lose your phone or reinstall Envoy, getting your wallet back is quick and effortless:
- Make sure you’re signed in to your Apple or Google account.
- Install Envoy and create a new mobile wallet.
- Set up with Magic Backups.
- Done, your wallet is automatically restored!
👩🏻💻 What’s Happening Behind the Scenes
Here’s how Magic Backup works in the background:
- Envoy checks the secure element on your phone to see if a mobile wallet seed already exists.
a) If it finds one, it creates a SHA256 hash of the seed (like a digital fingerprint) and sends it to Foundation’s servers.
b) This hash proves you know the seed, but doesn’t reveal the seed itself. - If no seed is in the SE, Envoy checks your device’s iCloud Keychain or Android Auto-Backup and restores the seed to the secure element.
a) It then hashes the newly restored seed and sends that hash to the server. - Our server uses the hash to verify that the request is legitimate. If it matches a stored record, the server sends back your encrypted backup file.
- Envoy then uses the seed it has stored on the phone to decrypt the backup file directly on your device, restoring your wallet settings, labels, and preferences, exactly how you left them.
🔐 Why It’s Secure
- Your seed is never sent to our servers.
- Your backup is encrypted before it ever leaves your phone.
- We store only a blind, encrypted file and a hash, nothing identifiable.
- Only you can decrypt your data, and only with your seed.
🎬 Ready to see the magic for yourself?
We’ve made setting up Magic Backups in Envoy as smooth as it gets, but seeing is believing.
Watch our step-by-step tutorial below and get set up in minutes.
🛡️ Magic Backups in Passport Prime
We’ve seen how Magic Backups in Envoy make recovering your mobile wallet effortless, with your seed secured by your device, backed up to your cloud and your settings backed up as an encrypted file.
Passport Prime takes that to a whole new level, as a personal security platform, it protects not only Bitcoin, but also 2FA credentials, encrypted files, security keys, extra seeds and more.
Magic Backups work differently here, and it’s important to note:
🔁 Passport Prime and Envoy each have their own separate Magic Backups.
- Envoy Magic Backup secures your mobile wallet seed and app data.
- Prime Magic Backup securely stores your Passport Prime app data and part of your Master key.
- These are two distinct encrypted files, stored on the Foundation server.
🔐 How Your Master Key Is Secured with Passport Prime
When you set up Passport Prime, your Master key isn’t just stored in one place, and you’re never asked to write it down, but you can, of course, choose to do so by retrieving your seed words from the Backups screen.
By default, Prime uses a secure, privacy-preserving system called Shamir Secret Sharing to split your seed into three parts:
- The first part is saved onto the NFC Keycard
- The second part is saved onto the NFC Keycard
- The third part is encrypted and securely stored on your phone’s secure element and backed up to iCloud Keychain, just like the Envoy seed
You only need any two of the three parts to fully recover your Master Key.
This approach gives you the redundancy to lose a card or your phone and still recover, without ever exposing your complete master key to a single location.
🧩 Envoy’s Role in Prime’s Recovery
When you set up Passport Prime, the device doesn’t just split your master key; it also prepares a secure backup of your Prime-specific app settings and data. These actions are initiated by Prime and securely transmitted to Envoy using QuantumLink our end-to-end encrypted Bluetooth tunnel.
Want to know how it works? Learn more about QuantumLink here.
Here’s how it works:
- Prime creates a dedicated Prime Magic Backup file containing your app settings and data (like account labels and configuration data). This file does not contain your master key.
- Prime also securely sends one of the three Shamir master key parts to Envoy as part of the 2-of-3 backup system.
- The Magic Backup file is encrypted using a key derived from your master key in Prime (which is only reconstructed during recovery).
- Prime sends the encrypted backup and associated metadata to Envoy via QuantumLink.
- Envoy then uploads the encrypted file to Foundation’s servers, and includes a cryptographic hash of the master key, allowing the server to recognize the backup without learning anything sensitive.
🛑 Reminder: This backup is completely separate from the Magic Backup for your Envoy mobile wallet. Each product manages its own backup file, using its own encryption.
Just like with Envoy’s mobile wallet backups, the master key never leaves Passport Prime also:
- Foundation can’t see your master key.
- Foundation can’t see your data.
🔁 Restoring Passport Prime
If your Passport Prime is ever lost, reset, or replaced, recovery is quick without needing to re-enter your master key.
Here’s how it works:
- Power up a new Passport Prime and connect it to Envoy.
- Tap one of your NFC Keycards to the device.
- Passport Prime receives both the Keycard’s part and the part stored in Envoy, then reconstructs the master key locally on Prime.
- Prime then requests your Prime Magic Backup from Foundation’s servers via Envoy, using a cryptographic hash of the master key to identify it.
- Once received, Prime decrypts the backup locally, restoring your account labels and settings.
💡 If the part stored in Envoy is missing or unavailable, you can still recover your Prime wallet using both NFC Keycards. Passport Prime accepts any two of the three Shamir parts, even if one part is lost.
🔚 Bitcoin and Beyond.
Magic Backups were built with one goal in mind: to make backup and recovery easy, seamless, and so private that you never have to think about it, until you need it.
Whether you’re backing up Bitcoin on Envoy, or securing your 2FA credentials and sensitive data with Passport Prime, the process is the same:
- Your data is encrypted before it ever leaves your device.
- Foundation never sees your keys or your settings.
- Recovery is in your hands, always.
Just simple, private, self-sovereign recovery, across your entire digital life.
Bitcoin, Simplified. Security, Upgraded.
