Foundation Passport vs Coldcard: Open-Source Hardware Wallet Showdown

Passport Prime vs Coldcard Q Overview

Foundation Passport Prime and Coldcard Q are two of the most prominent open-source Bitcoin hardware wallets on the market. Both target security-conscious Bitcoiners who demand verifiable firmware, air-gapped signing, and full sovereignty over their keys. They take fundamentally different approaches to achieve those goals: Passport Prime offers a smartphone-like touchscreen experience with a compact aluminum body, while Coldcard Q provides a full QWERTY keyboard, dual secure elements, and a multi-method air-gap workflow.

This comparison covers hardware specs, security architecture, PSBT workflows, multisig support, firmware auditability, and the critical question of community trust after Coldcard's 2026 entropy incident. For a broader overview of the signing device landscape, see our Bitcoin hardware wallet comparison.

Hardware Specifications

The two devices target different form factors and interaction models. Passport Prime resembles a credit-card-sized smartphone; Coldcard Q is closer to a BlackBerry-style device with a physical keyboard.

Security Architecture

Both devices are designed to protect private keys from extraction, but their architectures differ in meaningful ways. For a deeper analysis of threat models, see our research on Bitcoin hardware wallet attack vectors.

Secure Element Design

Passport Prime uses a single Microchip ATECC608C secure element. The master seed is split between the SAMA5D2 processor and the 608C, then XORed with a hash of the user's PIN. This means neither the processor nor the secure element alone can reconstruct the seed.

Coldcard Q uses two secure elements from different vendors: a Microchip ATECC608 and a Maxim DS28C36B. The wallet secret is split across the main microprocessor and both secure elements. The dual-vendor approach provides defense-in-depth: a vulnerability in one vendor's silicon does not automatically compromise the seed.

Tamper Detection and Supply Chain

Passport Prime ships without firmware installed. Users download and install the latest authenticated firmware during first boot, eliminating the risk of supply chain firmware tampering. The device includes active anti-tamper circuitry that factory-resets the device if it detects attempts to remove the screen or access the PCB. Foundation assembles in the USA in an ITAR-compliant facility and uses tamper-evident packaging.

Coldcard Q ships in a numbered, tamper-evident bag with VOID seals. A tear-off tab carries a serial number matching the device and bag exterior. On boot, firmware signature and nearly every byte of flash memory are verified. A dedicated hardware circuit connected to a secure element controls a green/red LED that software cannot override: green confirms genuine firmware.

The 2026 Coldcard Entropy Incident

In July 2026, researchers discovered that a build configuration error introduced in Coldcard firmware v4.0.1 (March 2021) routed seed generation to a weak software PRNG instead of the STM32 hardware random number generator. A macro (MICROPY_HW_ENABLE_RNG) was set to zero, but the supporting library checked whether the macro existed rather than whether it was enabled.

Seeds generated on Coldcard Mk4, Mk5, and Q between March 2021 and July 31, 2026 had approximately 72 bits of entropy instead of the expected 128 bits. Starting July 30, 2026, attackers exploited this weakness and drained roughly 1,816 BTC (approximately $116 million) from over 5,200 addresses in four waves. The first wave alone moved approximately 1,082 BTC from 1,196 addresses in 41 minutes.

Coinkite released emergency patches (Mk4/Mk5 v5.6.0, Q v1.5.0Q), but installing updated firmware does not repair existing weak seeds. Affected users must generate new seeds and migrate funds. Users who generated seeds using manual dice rolls were not affected, as the external entropy source bypassed the flawed PRNG.

Note: This incident underscores the importance of deterministic builds and third-party security audits. Even open-source code can harbor subtle bugs for years if the review process does not catch build configuration errors.

Air-Gap Methods and PSBT Workflows

Both devices support fully air-gapped PSBT signing, but they use different primary transport methods. The choice of air-gap method affects workflow speed, transaction size limits, and operational security.

Passport Prime: QR-First Workflow

Passport Prime's primary air-gap method is QR code scanning via its integrated camera. The typical workflow: create a transaction in the Envoy companion app or a third-party coordinator (Sparrow, Nunchuk), display the unsigned PSBT as a QR code, scan it with Passport Prime, review and sign on device, then display the signed PSBT as a QR code for the coordinator to scan back. The device also supports NFC and QuantumLink Bluetooth (post-quantum encrypted, running on an isolated chip) as alternative transport methods.

Coldcard Q: Multi-Method Workflow

Coldcard Q supports four PSBT transfer methods: microSD, QR codes, NFC, and USB. The microSD workflow has historically been Coldcard's signature approach: save the unsigned PSBT to a microSD card from your coordinator, insert it into the Coldcard, sign, save the signed PSBT back to the card, and return it to the coordinator. For QR-based workflows, Coldcard Q uses BBQr format for large transactions, splitting data across animated QR frames. NFC-V support enables tap-to-transmit for PSBTs, addresses, and XPUBs.

BIP Standard Support

Both devices support the full range of modern Bitcoin standards required for self-custody. The table below compares supported BIPs.

Multisig Support

Both devices work as cosigners in multisig configurations. Passport Prime supports multisig with up to 15 signers and exports output descriptors for coordinators including Sparrow, Nunchuk, Specter, Electrum, and Blue Wallet. Coldcard Q has native multisig support built into firmware, requiring multisig configuration import before signing. Coldcard's encrypted BBQr codes enable remote multisig signing over video calls for geographically distributed key holders.

For a detailed walkthrough of PSBT-based multisig workflows, see our PSBT workflow guide and the research article on Bitcoin PSBT multisig workflows.

Open-Source Firmware and Audit History

Both wallets publish their firmware source code on GitHub, a critical requirement for trust in a signing device. The depth of third-party verification differs.

Foundation Devices has published two independent security audits by Keylabs (the team behind wallet.fail research). The 2021 audit covered the original Passport Core firmware, and the 2025 audit covered Passport Prime and KeyOS. The 2025 audit found no critical or high-severity issues. Both audit reports and Foundation's responses are publicly available.

Coinkite publishes a security disclosure history documenting 30 security-relevant events from 2019 to 2026, including 13 with public evidence of coordinated disclosure. The firmware supports reproducible builds, enabling community verification. However, Coinkite has not published a comparable named third-party audit from an independent security firm.

UX: Touchscreen vs Physical Keyboard

Passport Prime's touchscreen interface mimics a smartphone experience. Foundation's KeyOS runs sandboxed apps (Bitcoin wallet, FIDO2 security key, encrypted storage) with a declarative permissions model. Beginners find the interface intuitive; address verification and transaction review benefit from the larger, higher-resolution display.

Coldcard Q's QWERTY keyboard excels at entering long BIP-39 passphrases. The physical keypad eliminates touchscreen input errors and is faster for users who frequently switch passphrases. The menu-driven interface requires more button presses for basic operations but gives experienced users precise control. Coldcard is Bitcoin-only with no additional apps.

Which Wallet Should You Choose

Choose Passport Prime if you prioritize polished UX, third-party audit transparency, active tamper detection, and a compact form factor. The QR-first workflow is fast and eliminates the need to handle microSD cards. The Keylabs audit track record and Foundation's ship-without-firmware approach strengthen the supply chain security story.

Choose Coldcard Q if you prefer dual secure elements, removable battery power (AAA batteries leave no internal energy source when stored), physical keyboard input for passphrase-heavy workflows, and the flexibility of four air-gap methods. Be aware that seeds generated between March 2021 and July 2026 without manual dice rolls are potentially compromised and must be migrated.

For maximum security, consider using either device as one signer in a multi-vendor multisig setup coordinated through Sparrow or Nunchuk. This eliminates single-device risk entirely. Once you have your cold storage configured, you can use a spending wallet like Spark for day-to-day Bitcoin and stablecoin transactions while keeping the bulk of your holdings in cold storage.

Frequently Asked Questions

Is Foundation Passport Prime better than Coldcard Q?

Neither is categorically better. Passport Prime offers superior UX, published third-party audits, and active tamper detection. Coldcard Q offers dual secure elements, removable battery power, and more air-gap transport options. The 2026 Coldcard entropy incident is a significant consideration: seeds generated on Coldcard between March 2021 and July 2026 without dice rolls may be compromised. Evaluate based on your threat model and workflow preferences.

Are Passport Prime and Coldcard Q fully open source?

Yes. Both devices publish their firmware source code on GitHub. Foundation publishes KeyOS, firmware, schematics, and hardware designs. Coldcard publishes firmware with support for reproducible builds. Open source does not guarantee security on its own: the 2026 Coldcard bug persisted in open-source code for over five years before discovery. Independent audits and community review are necessary complements.

Can I use Passport Prime or Coldcard Q for multisig?

Yes. Both devices support multisig and work with coordinators like Sparrow, Nunchuk, and Specter. Passport Prime supports up to 15 cosigners. Coldcard Q requires importing multisig configuration before signing and supports encrypted BBQr for remote signing. Many security-conscious users combine both devices in a multi-vendor multisig setup to eliminate single-device risk.

What happened with the Coldcard seed generation bug?

A build configuration error in Coldcard firmware v4.0.1 (March 2021) routed seed generation to a weak software PRNG instead of the hardware RNG. Seeds generated on Mk4, Mk5, and Q had approximately 72 bits of entropy instead of 128. Attackers exploited this in July 2026, draining roughly 1,816 BTC (~$116 million) from over 5,200 addresses. Users who generated seeds with manual dice rolls were not affected. Coinkite released emergency firmware patches, but affected users must generate entirely new seeds and migrate funds.

Does Passport Prime support Taproot?

Yes. Passport Prime supports BIP-86 Taproot (P2TR) addresses, including standard derivation paths and PSBT signing for Taproot transactions. Coldcard Q also supports Taproot. Both devices are compatible with modern address types including Legacy, Nested SegWit, Native SegWit, and Taproot.

Can I use Passport Prime or Coldcard Q without ever connecting to a computer?

Both devices support fully air-gapped operation. Passport Prime uses QR codes as its primary air-gap method: scan and display QR codes to transfer PSBTs between the device and a companion app on your phone. Coldcard Q can operate entirely on AAA batteries with microSD cards or QR codes for data transfer, never requiring a wired connection. Both devices allow USB to be used optionally but do not require it.

Which hardware wallet is better for entering long passphrases?

Coldcard Q has a clear advantage here. Its full QWERTY keyboard allows rapid entry of long BIP-39 passphrases without the slower character-by-character input of a touchscreen. If you regularly use complex passphrases to access hidden wallets, the physical keyboard saves significant time and reduces input errors.

This tool is for informational purposes only and does not constitute financial advice. Specifications, prices, and security assessments are based on publicly available information as of September 2026. Hardware wallet features and firmware change with updates. Always verify current specifications on the manufacturer's website and review the latest security disclosures before purchasing a signing device.