Passport's defining trait is that its air-gap is not a mode you have to remember to use — it is baked into the hardware. There is no USB data connection and no wireless of any kind; the USB-C port is power-only. Everything moves in and out via QR codes or a microSD card. That means you cannot accidentally undermine the isolation, which is a meaningfully stronger guarantee than a device that merely offers an air-gapped option alongside USB and NFC. For a purist threat model, that design decision is the whole ballgame.
The openness is comprehensive. Foundation publishes the hardware schematics, the firmware (open-source MicroPython), and the Envoy companion app, making Passport one of the most completely open-source wallets you can buy. It pairs an STMicroelectronics STM32H753 microcontroller with a Microchip ATECC608A secure element used purely for secure key storage, and adds an avalanche-noise circuit as a true random number generator — an open, provable entropy source rather than a black box. The firmware has also been third-party reviewed, and the hardware is assembled in the USA under the team's supervision.
In the hand, Passport is the anti-cryptic wallet. Where many secure devices feel like puzzle boxes, Passport's numeric keypad and color screen feel like using a familiar phone. Reviewers who have lived with it for months consistently describe the interface as intuitive even for relative newcomers, which is rare in the air-gapped category. Design here is not vanity; a signer you understand is a signer you use correctly, and that reduces the human errors that cause most real-world losses.
The honest trade-offs are mostly about positioning. Passport uses a single secure element, whereas Coldcard hedges with two from different vendors — a defensible difference in defense-in-depth philosophy that stricter buyers will weigh. The MicroPython firmware optimizes for readability and auditability over speed, so it is not the snappiest device. And the QR/microSD-only workflow, while a security virtue, is more deliberate than plugging in a cable; you trade a little convenience for isolation on every transaction.
Then there is price and scope. At $199 for the Core (with a $349 Prime above it), Passport sits at the premium end, and it is Bitcoin-only. For someone who holds a range of assets or wants the cheapest workable wallet, that is a poor fit. For someone who has decided Bitcoin cold storage is worth doing properly and wants every layer verifiable, the premium buys real things: a truly air-gapped design, full openness, domestic assembly and a genuinely nice interface.
We rate it 4.4. Passport Core is close to the top of its class for air-gap purists who value design and openness, and the marks it loses are about cost, the single secure element, and the deliberate-by-nature workflow rather than any real weakness. If you want a beautiful, fully open, no-radios Bitcoin signer and the price does not scare you, it is one of the easiest recommendations in the category.