Envoy review: the Passport companion app
Envoy is the app Foundation built to set up and run its Passport hardware wallets, and it doubles as a simple phone wallet for spending money.
Envoy is the right app if you own a Passport, and Passport Prime owners need it for setup. As a standalone phone wallet it is easy to start with, thanks to Magic Backups, but it has no multisig, no Lightning, and works with no hardware wallet except Passport. Foundation fixed several Envoy flaws in 2026, so keep it updated.
I've used a Foundation Passport myself, the hardware Envoy was built to manage. The Envoy details below, from Magic Backups to the Tor and node settings, come from Foundation's docs, Envoy's source and release notes, and my incident tracker rather than from daily use of the app.
Disclosure: I work at Blockstream, the company that makes the Jade wallets mentioned here. I joined after many years as a satisfied user. There are no affiliate links on this site.
What Envoy is and who makes it
Envoy is Foundation Devices' mobile Bitcoin wallet and Passport companion app. It does two jobs. Paired with a Passport, it sets the device up, installs firmware updates, shows your cold storage balance, and prepares transactions for the Passport to sign. On its own, Foundation says Envoy is now a standalone Bitcoin mobile wallet that keeps a hot wallet on your phone.
Envoy runs on iPhone and Android. Foundation links App Store, Google Play, F-Droid, and GitHub downloads, and the App Store build requires iOS 18.0 or later. The code is on GitHub under GPL-3.0-or-later, and the latest release is v2.3.7, from October 29, 2026.
Foundation's Envoy page describes hot and cold Bitcoin accounts and nothing for Lightning. The App Store description still mentions buying bitcoin in the app, but Envoy 2.3.5 removed leftover code from the retired Buy Bitcoin feature, so plan to buy elsewhere.
Who Envoy is for
If you own a Passport Prime, Envoy is part of the device. Foundation's docs say QuantumLink is required for initial setup and for syncing with Envoy, and QuantumLink is Prime's encrypted Bluetooth link to the app. After setup, Prime can sign with QR codes or a file and leave Bluetooth off.
If you own a Passport Core, Foundation calls Envoy its mobile companion app for Passport Core, with a guided setup and a watch-only wallet.
If you do not own a Passport, a general phone wallet that signs with more hardware is a better fit. BlueWallet pairs with Jade, SeedSigner, Krux, and Passport. For multisig or an inheritance plan, use Nunchuk or Sparrow: Foundation's own connect guide lists multisig setups for those apps and others, and none for Envoy.
Magic Backups: what gets stored where
Magic Backups is Envoy's default setup. Envoy creates the seed for your phone wallet and stores it in the phone's secure storage. On iPhone, the seed then syncs through iCloud Keychain while Magic Backups is on, and on Android it goes into Android Auto-Backup. Envoy also uploads an encrypted file of settings and labels to Foundation's servers. Foundation says the file is end-to-end encrypted with your Envoy seed and does not contain the seed, and there is no Foundation account.
With Magic Backups on, your phone wallet's seed sits in your Apple or Google cloud backup, end-to-end encrypted, so the security of that account matters. Android users must also have a screen lock, or Android leaves the seed out of the backup. For a spending wallet that is a reasonable deal. For savings, keep the keys on a Passport and back up its seed phrase on paper or steel; my seed storage rankings cover the options.
You can turn Magic Backups off during setup. Envoy then gives you 12 seed words and an encrypted backup file to store yourself. For a Passport Prime set up with Magic Backups, Envoy also holds one of three encrypted parts of the Prime's master key, and one part alone cannot recover it. Prime's manual setup keeps that data off Envoy and your cloud account entirely.
Setting up Envoy
Install Envoy from the links on Foundation's Envoy docs, which also publish the Envoy signing key for checking a GitHub download. For exact screens, follow Foundation's setup guide.
- 1Decide on Magic Backups or a manual backup before you start. Pick manual if you do not want the seed in your cloud account.
- 2With a manual backup, write the 12 words down and store the backup file away from the phone.
- 3Turn on the app lock. Foundation recommends it because Envoy can hold bitcoin directly on the phone.
- 4Pair your Passport: Prime over QuantumLink by scanning the QR code it shows, or Core by following Foundation's Passport Core setup guide. Run Foundation's security check on a Prime during setup.
- 5Before you receive, confirm the address in Envoy matches the one on the Passport screen.
My guide to moving bitcoin to a hardware wallet walks through the first transfer.
Privacy: Tor and your own node
By default Envoy talks to Foundation's server. The Privacy screen lets you switch to your own node, a public server from Blockstream, DIYnodes, or Bitaroo, and Tor. Foundation lists Start9, Umbrel, myNode, RaspiBlitz, and Nodl among the node packages Envoy connects to, through their Electrum servers. Once you pick another node, Envoy will not fall back to Foundation's server, which is what you want.
Tor is a setting called Improved Privacy. With it on, Foundation says the server never sees your IP address, at the cost of slower loading. With Tor off and Foundation's default server, that server could see your IP address and rough location, and Foundation says it does not log it. My pick: turn on Tor and point Envoy at your own node. If you need one, see my node rankings and the Start9 review.
Coin control is built in, with tags, notes, and the option to lock coins so you choose which ones a payment spends.
Fees and costs
Envoy is free. You pay Bitcoin network fees on each transaction, and Envoy 2.3.0 added sub-sat fee rates for cheap, slow sends. The real cost is the Passport: Prime sells for $349, covered in my Passport review.
Security record
Foundation shipped several security fixes for Envoy in 2026, and my security incident tracker lists the incidents.
| Date | What happened | Source |
|---|---|---|
| July 8, 2026 | Envoy 2.3.0 fixed a Magic Backup server flaw that allowed unauthenticated listing, downloading, and deletion of backup data. Foundation says it is certain the flaw was not exploited. | Envoy 2.3.0 notes |
| July 8, 2026 | The same release fixed a Passport Prime security check that could report a device error as a successful verification. | Envoy 2.3.0 notes |
| August 2026 | Envoy 2.3.1 fixed passphrase account transactions showing in the Activity feed while the passphrase was not active. | Envoy 2.3.1 notes |
| October 25, 2026 | Phishing emails went out from Foundation's own domains. Foundation found no evidence that Passport devices or keys were compromised. | Foundation |
| October 27 to 29, 2026 | Envoy 2.3.6 rotated the onion addresses for Foundation's servers as a precaution, and 2.3.7 moved the Prime security check and fixed screenshot protection on the seed QR screen. | Envoy 2.3.7 notes |
The Magic Backup files were end-to-end encrypted, so the server flaw exposed them to deletion more than to reading. Update Envoy whenever Foundation ships a release, and treat any email that claims to come from Foundation with suspicion.
How Envoy compares
| Envoy | BlueWallet | Nunchuk | |
|---|---|---|---|
| Hardware wallets | Passport only | Jade, SeedSigner, Krux, Passport | Jade, BitBox02, SeedSigner, Krux, Passport |
| Multisig | No | Yes | Yes |
| Desktop app | No | Mac | Mac, Windows, Linux |
Envoy wins on setup speed and on the Passport Prime connection. BlueWallet and Nunchuk win on hardware choice and multisig. The full ranking is on my software wallets page, and the Jade Plus review covers a cheaper hardware wallet if you have not bought one yet.
Verdict
I rate Envoy 8.7. With a Passport it is the natural app, and Prime owners need it for setup. Turn on Tor, point it at your own node, and decide on Magic Backups knowing the seed goes to your cloud account. Without a Passport, a wallet that signs with more hardware will serve you better.
Frequently asked questions
Do I need Envoy to use Passport Prime?
For setup, yes. Foundation says QuantumLink, the Bluetooth link between Prime and Envoy, is required for initial setup. After that, Prime can sign with QR codes or a file.
Can I use Envoy without a Passport?
Yes. Foundation says Envoy is now a standalone mobile wallet. Without a Passport you lose its main advantage, and it does not sign with other hardware wallets.
Are Envoy Magic Backups safe?
The seed syncs through your iCloud Keychain or Android backup, end-to-end encrypted, and the settings file on Foundation's server is encrypted with your seed. A 2026 server flaw allowed unauthenticated access to those encrypted files before Foundation fixed it. Use a manual backup if you do not want the seed in your cloud account.
Does Envoy support Lightning?
No. Foundation describes Envoy as a Bitcoin wallet with hot and cold accounts. Use a separate Lightning app for spending.
Can Envoy connect to my own node?
Yes. Choose Personal Node in the Privacy settings and paste your Electrum server address. Foundation lists Start9, Umbrel, myNode, RaspiBlitz, and Nodl among the packages that work.