{
  "schemaVersion": "1.0",
  "canonicalPage": "https://fileformat.co/ext/ipa",
  "inspectorUrl": "https://fileformat.co/inspect",
  "spec": {
    "slug": "ipa",
    "extension": ".ipa",
    "aliases": [],
    "name": "Apple iOS App Store Package",
    "shortName": "iOS IPA",
    "category": "devtools-security",
    "tier": 1,
    "summary": "ZIP-compressed iOS/iPadOS application distribution archive structured around `Payload/<AppName>.app/Info.plist` (`bplist00`) and Mach-O ARM64 binaries.",
    "technicalNotes": "Disambiguated from generic `.zip` and `.aab` by locating `Payload/*.app/` directory entries in the ZIP Central Directory.",
    "mimeTypes": [
      "application/octet-stream",
      "application/x-ios-app"
    ],
    "identifiers": {
      "specUrl": "https://developer.apple.com/library/archive/documentation/CoreFoundation/Conceptual/CFBundles/BundleTypes/BundleTypes.html"
    },
    "binarySignature": {
      "endianness": "little",
      "magicBytes": [
        {
          "offset": 0,
          "hex": "50 4B 03 04",
          "ascii": "PK..",
          "description": "PKZIP archive containing Payload/*.app/Info.plist"
        }
      ],
      "containerFamily": "zip",
      "headerLayout": [
        {
          "offset": "0x00 - 0x03",
          "byteOffset": 0,
          "byteLength": 4,
          "lengthLabel": "4 B",
          "dataType": "uint32_le",
          "fieldName": "zip_magic",
          "description": "PKZIP Local File Header"
        },
        {
          "offset": "0x1E+",
          "byteOffset": 30,
          "byteLength": 24,
          "lengthLabel": "var",
          "dataType": "utf8",
          "fieldName": "payload_entry",
          "description": "'Payload/<App>.app/...' bundle path"
        }
      ]
    },
    "securityProfile": {
      "riskLevel": "medium",
      "allowsArbitraryCodeOrMacros": true,
      "xxeRisk": false,
      "polyglotPrependRisk": true,
      "pickleDeserializationRisk": false,
      "uploadValidationNotes": "Guard mobile CI extractors against Zip Slip (`../`) and symlink escapes inside Payload/ before running codesign or plist parsers."
    },
    "codeSnippets": {
      "python": "import sys, zipfile\nwith zipfile.ZipFile(sys.argv[1], \"r\") as zf:\n    plists = [n for n in zf.namelist() if n.startswith(\"Payload/\") and n.endswith(\"Info.plist\")]\n    assert plists, \"Missing Payload/*.app/Info.plist\"\n    print(\"Valid iOS IPA:\", plists[0])",
      "typescript": "export async function checkIpaZip(file: File) {\n  const b = new Uint8Array(await file.slice(0, 4).arrayBuffer());\n  return b[0] === 0x50 && b[1] === 0x4b;\n}",
      "rust": "use std::{fs::File, io::Read};\nfn main() -> std::io::Result<()> {\n    let mut b = [0u8; 4];\n    File::open(std::env::args().nth(1).expect(\"usage: <prog> <file>\"))?.read_exact(&mut b)?;\n    println!(\"IPA container magic: {:02X?}\", b);\n    Ok(())\n}",
      "go": "package main\nimport (\"archive/zip\"; \"fmt\"; \"os\")\nfunc main() {\n    r, err := zip.OpenReader(os.Args[1])\n    if err != nil {\n        fmt.Fprintln(os.Stderr, \"open zip:\", err)\n        os.Exit(1)\n    }\n    defer r.Close()\n    fmt.Println(\"IPA entries:\", len(r.File))\n}"
    },
    "relatedFormats": [
      "aab",
      "usdz",
      "wasm"
    ],
    "verifiedAt": "2026-11-14T16:09:03Z"
  },
  "samples": [
    {
      "id": "ipa-minimal",
      "filename": "minimal-app.ipa",
      "variant": "minimal",
      "title": "iOS Unsigned Container Fixture (.ipa)",
      "description": "UNSIGNED container-structure fixture: real ZIP with Payload/DemoApp.app/Info.plist (binary plist via plistlib) and a Mach-O arm64 header stub. NOT a signed installable app.",
      "localPath": "/fixtures/v1/ipa/minimal-app.ipa",
      "cdnUrl": "https://fileformat.co/fixtures/v1/ipa/minimal-app.ipa",
      "sizeBytes": 694,
      "sha256": "85778c5134a0d4c6235923fcfd82c823b35e2e9577a5fd61f7c8b5226000d479",
      "expectValid": true
    },
    {
      "id": "ipa-realistic",
      "filename": "observatory-ios-bundle.ipa",
      "variant": "realistic",
      "title": "iOS Unsigned Container Fixture with PkgInfo",
      "description": "UNSIGNED container-structure fixture: binary-plist Info.plist + PkgInfo + Mach-O stub for mobile CI artifact scanner tests. NOT a signed installable app.",
      "localPath": "/fixtures/v1/ipa/observatory-ios-bundle.ipa",
      "cdnUrl": "https://fileformat.co/fixtures/v1/ipa/observatory-ios-bundle.ipa",
      "sizeBytes": 777,
      "sha256": "53e13f6ea9bf56efe9c454706fa93e38d45bd77fa86d033b9cba843202a66348",
      "expectValid": true
    },
    {
      "id": "ipa-edge-case",
      "filename": "truncated-eocd.ipa",
      "variant": "edge-case",
      "title": "Truncated IPA Missing ZIP EOCD Trailer",
      "description": "Interrupted-upload fixture: ZIP container missing the EOCD record — zipfile must raise.",
      "localPath": "/fixtures/v1/ipa/truncated-eocd.ipa",
      "cdnUrl": "https://fileformat.co/fixtures/v1/ipa/truncated-eocd.ipa",
      "sizeBytes": 678,
      "sha256": "c4abf5147786a39819f7c469079e22f72bfa617f2d9a7d10641c99c41a7c0717",
      "expectValid": false,
      "edgeCaseTag": "Missing ZIP EOCD"
    }
  ]
}