Passport Core pioneered modern QR-based air-gapped self-custody and helped bring offline signing into the mainstream. Today, we’re taking the next step forward with Passport Prime and QuantumLink, a new device and communication architecture designed to preserve the core security principles behind Passport Core, while unlocking an entirely new class of secure, real-time interactions.
As part of this transition, production of Passport Core is coming to an end, while full support for existing devices continues.
Pioneering the QR
Passport Core was built around a very specific idea: maximum security through QR-code air-gapping.
No cables. No Wi-Fi. No active connection of any kind.
Information is shared between Passport and your phone or computer via animated QR codes or by transferring files on a microSD card. From a security perspective, this model is excellent, and it remains one we strongly believe in.
Passport Core didn’t just adopt QR air-gapping; it helped define how modern QR-based signing works across wallets and devices today. When Passport Core launched, QR-based air-gapping wasn’t new, but it was rarely done well. We focused heavily on making the experience approachable by pairing strong security with an intuitive interface and thoughtfully designed hardware. We collaborated closely with open-source wallet teams and groups like Blockchain Commons to help advance shared standards, ensuring compatibility with the tools people already used.
The result was a QR air-gap that was both highly secure and usable.
But building and supporting QR air-gapped systems at scale also gave us a deep understanding of their practical limits, and also gave us a front-row seat to the model’s limitations.
The UX Constraints of QR Air-Gapping
With QR-based air-gapped workflows, devices operate asynchronously.
One device prepares data. Another device waits to scan it. The user manually coordinates the entire process.
For many users, especially those new to self-custody, this introduces friction and uncertainty:
- Where do I begin the process?
- Which device should I be using right now?
- Did I miss a step?
- How do I know when it’s complete?
- How do I safely update the firmware?
Even with strong UX design, QR-based air-gapping inherently requires users to manage complex workflows between disconnected devices. This creates unavoidable cognitive overhead.
Beyond usability, the broader trajectory of Bitcoin and digital security is also evolving. New script constructions, emerging output types, and early work toward quantum-resistant cryptography point toward more expressive and interactive security models. These increasingly benefit from devices that can coordinate state, intent, and policy in real time, something QR-based systems naturally struggle to support without heavy user involvement.
Bridging the Gap with QuantumLink
QR air-gapping gave us a clear, security-first foundation, but it also locked the experience into a single way of working. For users willing to invest the time, that model can be extremely effective. For many others, the rigidity itself became the barrier.
That led us to a different question:
Can we combine the security properties of an air-gap with the convenience of wireless communication — without compromising security?
The answer is QuantumLink.
QuantumLink is a secure Bluetooth-based protocol designed from the ground up for Passport Prime. It is not generic wireless connectivity layered on top of a hardware wallet, but a purpose-built communication architecture that maintains the isolation properties central to air-gapped security, while also enabling real-time interaction.
Here’s what makes it different:
- Dedicated hardware separation: Passport Prime includes a separate Bluetooth chip, fully isolated from the main security processor running KeyOS.
- Quantum-resistant encryption: All communication uses modern cryptography, including CRYSTALS-Kyber key exchange and ChaCha20-Poly1305 encrypted messaging.
- Untrusted wireless layer: The Bluetooth chip handles only encrypted data. It never has access to plaintext information.
This means Passport Prime can stay securely in sync with companion apps like Envoy, enabling real-time onboarding, transaction signing, firmware updates, and policy interactions, without exposing private data or weakening isolation.
Within KeyOS, every app runs inside its own isolated sandbox. Each app is issued its own per-app private keys, with no access to the device’s master key, no ability to influence the operating system, and communication between apps handled only through signed, encrypted OS-managed channels.
Physical confirmation is required for all sensitive actions, connections, and disclosures.
Even if a companion device or app were compromised, KeyOS’s architecture prevents it from affecting Passport Prime or accessing private keys.
Passport Prime also supports multiple interaction methods. Users can continue to leverage QR codes, NFC, or USB if they prefer, all within the same secure framework.
What This Means for Passport Core Users
Passport Core is no longer for sale – but it remains a fully supported, secure, air-gapped hardware wallet.
- You can continue using it normally with Envoy and open-source wallets like Sparrow or Nunchuk
- Its QR-based air-gap security model remains unchanged
- We will continue providing security updates and usability improvements
- All warranties are fully honored
Looking Ahead
Passport Core established QR-based air-gapped signing as a practical, open, and secure standard for self-custody.
The lessons learned from building it, both its strengths and its limits, help to shape Passport Prime.
For those who prefer strict air-gapping, later this year we’ll be exploring an “air-gap only” KeyOS configuration option for Passport Prime that completely disables the Bluetooth chip, allowing Prime to operate entirely without wireless communication.
If you have questions or want to discuss the transition further. You can reach us at [email protected] or join us in the Foundation community forum
Thank you for sharing this journey with us.
— The Foundation Team
