End-to-end FairPlay decrypter for App Store apps.
Give it a bundle ID, get a decrypted .ipa. And yes - it happily decrypts iOS 26 apps.
ipadecrypt decrypts FairPlay apps on your computer - no device in the loop
for day-to-day use. A jailbroken device is needed exactly once per Apple
account, during bootstrap, to mint a reusable 16-byte account credential.
After that, downloading and decrypting any app for that account is fully
offline.
The offline decryptor handles arm64, arm64e, arm64_32 and
32-bit ARM slices, with page keys from .supf/.v5.supf or
.supp/.v4.supp files. A fat binary is thinned to one slice: the plain
arm64 slice, else arm64e, else arm64_32, else 32-bit ARM (armv7 when there
are several). The other slices are dropped from the output. Apple Arcade
apps need a second, Arcade credential from the same account, minted
alongside the regular one. If an app can't be decrypted offline at all,
ipadecrypt automatically falls back to decrypting it on your jailbroken
device when one is configured (the same device used for minting). Pass
--no-on-device to disable the fallback, or --on-device to go straight to
the device.
- Nothing special for everyday decrypting. A jailbroken iPhone reachable over
the network (or over USB with
iproxy) is needed for the one-time mint, and again only for the on-device fallback on apps that can't be decrypted offline.
| Requirement | Purpose |
|---|---|
| OpenSSH | The mint and the on-device fallback connect over SSH (install OpenSSH from Sileo), as root or as a user that can sudo - mobile on Dopamine and palera1n rootless, where root has no password by default. With SSH key auth you are asked once for that user's sudo password |
| ≥1 owned App Store app installed | Bought with the same Apple ID; used to trigger FairPlay once during the mint |
| An Apple Arcade app installed (optional) | From the same Apple ID; only to mint the Arcade credential that decrypts Arcade apps |
AppSync Unified + appinst |
Only for the on-device fallback: installs the app on the device so it can be decrypted |
Tested on iOS 16.7.11 with palera1n rootless and Dopamine on iPhone 8 Plus. iOS 10+ is expected to work for minting; decryption itself runs anywhere.
Download a prebuilt binary from the releases page.
Using go install:
go install github.com/londek/ipadecrypt/cmd/ipadecrypt@latestFrom source (refer to BUILDING.md for detailed instructions):
git clone https://github.com/londek/ipadecrypt
cd ipadecrypt
go build ./cmd/ipadecryptipadecrypt bootstrapA three-step interactive wizard:
- App Store sign-in - Logs into the App Store. Credentials stay local in
~/.ipadecrypt/config.json. The first sign-in downloads and caches the Apple frameworks the App Store engine emulates (~tens of MB, range-extracted from a pinned macOS image) under~/.cache/ipadecrypt/; later runs reuse the cache. - Credential mint - Connects once to your jailbroken device over SSH and extracts the reusable account credential, cached under
~/.ipadecrypt/credentials/. If an Apple Arcade app from the account is installed, it also mints the account's Arcade credential; without one that step is skipped, and you can add it later by installing an Arcade app and re-running with--remint. - On-device fallback check - Verifies the device is ready to decrypt apps the offline decryptor can't handle (AppSync Unified +
appinstpresent, helper uploads and execs). Best-effort: a missing prerequisite only disables that fallback and is reported, not fatal.
Run it again anytime; it skips minting if a credential is already cached (pass
--remint to force). After bootstrap, decrypting is fully offline - the device
is only needed again for the on-device fallback.
ipadecrypt decrypt <bundle-id|app-store-id|app-store-url|path-to-local-ipa>This decrypts offline. If the offline path can't handle the app and a jailbroken device is configured, ipadecrypt automatically falls back to decrypting it on the device. Useful flags:
--on-device- skip the offline attempt and decrypt on the device directly.--no-on-device- never touch the device; fail if offline can't fully decrypt.--keep-watch- keep and decrypt the Watch app instead of removing it (offline only).--patch-device-type- expandUIDeviceFamilyso an app built for a different device type still installs during the on-device fallback.--no-uninstall/--force-uninstall- control whether the app is removed from the device after an on-device decrypt (default: removed only if this run installed it).
ipadecrypt versions <bundle-id|app-store-id|app-store-url>- Only the supported SINF/SUPF/SUPP license formats decrypt offline; apps shipping a newer, unsupported
SC_Infoformat fall back to the on-device path when a device is configured. - The credential is per Apple account: decrypting an app requires signing in with (and having minted from) the account that owns it.
- Only one slice per binary is decrypted: a fat binary is thinned to its plain arm64 slice, else arm64e, else arm64_32, else 32-bit ARM (armv7 when there are several). The other slices are dropped from the output. A binary with no ARM slice can't be decrypted offline.
- A Watch app kept with
--keep-watchis thinned like any other binary (normally to arm64_32), so it does not run on Apple Watch Series 3 or earlier. - Apple Arcade apps decrypt only with the account's Arcade credential; without it they fall back to the on-device path when a device is configured.
MIT.
- EthanArbuckle/fairplay-decrypt - the offline FairPlay decryptor and credential-minting approach this release is a Go port of.
- majd/ipatool - the Apple Configurator impersonation the App Store client is based on.
- 34306/TrollDecryptJB -
task_for_pid+mach_vm_readfrom a suspended spawn, entitlement set. - JohnCoates/flexdecrypt - the pre-iOS-16 approach that stopped working and prompted the pivot.
This project was developed with the assistance of AI tools. While I can't guarantee the accuracy of all AI-generated content, I have overviewed creation process and then reviewed, tested the code to ensure it meets the project's requirements.