Passport Prime 1.3.0

WHAT'S CHANGED

KeyOS 1.3.0 is a major update headlined by the ability to import external bitcoin seeds and nostr keys into the Vault, BIP85 password generation, mass-importing 2FA codes from Google Authenticator, and the new Universal QR Scanner. We've also delivered meaningful performance gains across the file browser, keyboard, and Bitcoin price graph, and completed a wide-ranging hardening pass driven by a comprehensive third-party security audit covering the kernel, cryptography, USB, NFC, Quantum Link, and PSBT handling. On top of all that, we've squashed a large number of bugs across the wallet, onboarding, lock screen, and connectivity experiences.

For more details on each of the changes, keep reading below!

NEW FEATURES

• You can now import external bitcoin seeds and nostr keys into the Vault app! Head to the Vault app, tap "Import Item", and select what you want to bring in

• Mass-import 2FA codes from Google Authenticator into the 2FA app in a single operation (big thank you to @immz4 for the contribution!)

• Generate BIP85 passwords in the Vault - Passport Prime can now generate passwords derived from your master key following the BIP85 standard, and advanced users can manually adjust the derived index and password length

• Introducing the Universal QR Scanner - tap the scanner icon on the bottom-right corner of the launcher and scan any QR code, and KeyOS will automatically route it to the right app

• Upgraded the underlying QR scanner library - it's now significantly more powerful and can read inverse-colored QR codes along with other exotic variants

• You can now scrub the Bitcoin price graph in the launcher with your finger to view older prices

IMPROVEMENTS

• Hardened KeyOS all around, including kernel and nameserver memory-message validations, runtime manifest parsing, framebuffer size validation, USB host descriptor handling, NFC/NDEF read paths, the platform callback registry, and additional safety fixes throughout the file system

• Strengthened wallet and transaction security by validating PSBT inputs against attacker-supplied funding data, surfacing duplicate equal-amount outputs in the recipient summary, requiring authenticity and replay protection on RemoteUpdate payloads, and preventing hot wallet key material from being persisted or logged in plaintext

• Hardened Quantum Link against message replay, including sealed messages after cache expiry and pairing requests

• Strengthened cryptography with hardware-accelerated AES-GCM, fixed counter-material reuse during partial-block streaming, and prevented encrypted eMMC from proceeding with all-zero keys

• Hardened the challenge-response flow to reject unsealed, erased, or wiped device secrets, and stopped logging sensitive Bluetooth challenge secrets during provisioning

• Tightened permissions around sensitive system access, restricting who can read global logs and last-panic reports and who can set the global system time

• The Sign Message and Connect actions have been swapped for a more intuitive flow

• Passport Prime now exchanges the Device Name with Envoy during pairing so both sides show the correct name (requires Envoy 2.3.0)

• Your device's timezone now syncs automatically when pairing with Envoy

• All bitcoin wallet status now syncs to Envoy when re-pairing your device

• When manually disconnecting in Passport Prime, it now sends a disconnect message to Envoy when in range, ending a session for a cleaner unpair flow (requires Envoy 2.3.0)

• You can now import a multisig configuration using the crypto-output UR type for broader compatibility with Sparrow Wallet

• Settings now clearly tells you when your firmware is already up to date every time you check

• Checking for a new firmware version and creating a backup now time out gracefully instead of hanging

• The Settings update flow now requires sufficient battery level so updates can't fail due to low battery

• If you get stuck any time during onboarding, you can now restart the initial setup flow by tapping the home button

• The file browser is now significantly faster when opening directories with many files

• Improved keyboard responsiveness by only redrawing the regions that change

• Optimized the Bitcoin price graph for smoother rendering

• Refined touch handling across the device, expanding touch targets on small or slow-to-tap controls and ignoring small drags so taps register more reliably on back buttons, the control center, file selectors, and script type pickers

• The Airlock is now read-only on every disconnect by default for added safety

• Auto-shutdown now defaults to twice your configured lock time

• The file browser now remembers when you dismiss a quick-tip popup and won't show it again

• Added a warning before archiving a Bitcoin account

• Settings backups are now uniquely renamed each time they're created

• Single-sig account colors are now derived from the account index, mirroring Passport Core and Envoy

• The way to format a damaged Airlock changed to a more intuitive one and can now be done directly from the Files app

• Added a "Please connect drive" screen for when no external drive is present

• The bootloader can now boot firmware images larger than 32MB

• The QR Scanner now supports single-part URs

• Added a guided error flow for QR scanning during onboarding to guide you when a scan doesn't go as expected

• Added a warning when creating a backup fails

• Relicensed the API crates and their dependencies under MIT OR Apache-2.0 for broader compatibility with the Rust ecosystem

• Each backup shard is now stored with a unique identifier, making them easier to tell apart

• KeyOS now maintains a larger battery reserve so critical operations like graceful shutdowns can complete safely when the battery runs low

• The lock screen now features a refreshed time design

• The Done button in the keyboard now adapts its label to the current screen for clearer context

• Writing a long passphrase or account name now keeps the end within focus, and text can be scrolled left and right

BUG FIXES

• Fixed several validation gaps where the device could accept seeds or indices outside expected ranges, including 18-word seeds at QR import and generated indices outside the BIP32 hardened range

• Fixed U2F security key bugs that prevented some keys from working and that skipped validation of the application parameter on the sign branch, resolving issues with services like Google

• Fixed a bug where launching an app could override the lock screen

• Fixed a bug where setting password mode on the lock screen was broken

• Fixed a crash where the device could panic after being erased

• Fixed an unexpected shutdown bug

• Fixed a crash where the GUI server could fail when too many layers were present

• Fixed a Prime crash caused by an async-watch bug

• Fixed several onboarding issues, including a crash to launcher after setting up a backup, popups appearing behind the keyboard, overly tight warning modals, and incorrect warning icon colors, among many others.

• Fixed a bug where importing a multisig configuration from BlueWallet would fail

• Fixed a bug where the Save then Sign flow would block non-zero account indices

• Fixed several wallet amount display inconsistencies, including missing trailing zeroes on fees

• Fixed a bug where adding a Slack 2FA QR code reported the secret as invalid

• Fixed a bug where long 2FA labels could overlap text

• Fixed a bug where closing the QR scanner didn't clear the UR progress bar

• Fixed a bug where the wrong QR scanner could fire if opened too early

• Fixed a bug where the Airlock would still appear plugged in after being unplugged

• Fixed an OOM issue that could appear when tapping Explore addresses on the verify camera

• Fixed a bug where an iPhone or laptop could fail to recognize Prime over USB after rebooting, and could even be charged by Prime

• Fixed some missing touch events in the bootloader

• Fixed a visual bug where the Disconnect Passport icon was missing

• Fixed a bug where saving a backup would not show the available files

• Fixed a bug that prevented buttons from being disabled in the launcher while an app was launching

• Fixed the Bitcoin launcher tile label

• Fixed a bug where tapping outside an edit box would not unfocus it in the Vault app

• Fixed a visual bug where the Bitcoin graph lost its stripes

• Fixed a visual bug where the file browser search icon rendered at the wrong size

• Fixed a bug where NFC registration on iOS did not vibrate

• Fixed a 25-second delay on macOS when switching from Read & Write to Read in airlock

• Fixed a bug where the disconnect timer was not reset on a new connection

• Fixed a bug where the device name substring incorrectly read "Prime" when displaying the bluetooth device on the phone

• Updated the file picker and Airlock imagery, including a dedicated image when a drive is plugged in, and made it clearer that items can't be moved to the Airlock while the device is plugged in

• Refined link colors and touch areas across the interface

• The onboarding static QR now includes the Prime device name (requires Envoy 2.3.0 to fully take advantage of it)

• Fixed a bug where the file browser's filtered count included hidden files

• Fixed a visual bug where the passphrase box wasn't clipped by its corner radius while changing state

• Fixed a visual bug where disabled buttons used the wrong colors

• Fixed a bug where searching in the time zone picker was broken

• Fixed a bug with address verification

• Fixed a bug where the Show Fiat Value toggle was not respected (requires Envoy 2.3.0)

• Fixed a link in the 2FA app README that pointed to a private Figma document

• Fixed a minor visual glitch where if a backup was created less than a minute ago, a tilde made it look like the text said "-1" minutes ago

HOW TO UPDATE

To update the firmware on your Passport Prime, head to Settings > Updates. If an update is available, tap 'Update with Envoy'. Passport Prime will use its secure QuantumLink connection with Envoy to automatically download, verify, and install the update.

Learn more here.