.ipa Tier 1 · Deep AST Parser

Apple iOS App Store Package

ZIP-compressed iOS/iPadOS application distribution archive structured around `Payload/<AppName>.app/Info.plist` (`bplist00`) and Mach-O ARM64 binaries.

Disambiguated from generic `.zip` and `.aab` by locating `Payload/*.app/` directory entries in the ZIP Central Directory.

MIME Types application/octet-stream, application/x-ios-app

Byte Endianness little

Container Family zip

Canonical Spec Official Specification ↗

0xFF

Drop any .ipa file (even 100 GB+) to inspect locally

Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded

Binary Signature & Wire Layout

.ipa Magic Bytes & Header Offset Map

Offset: 0x00 (0 B) ASCII: PK..

50 4B 03 04

PKZIP archive containing Payload/*.app/Info.plist

Byte Offset	Length	Data Type	Field Name	Engineering Description
0x00 - 0x03	4 B	uint32_le	zip_magic	PKZIP Local File Header
0x1E+	var	utf8	payload_entry	'Payload/<App>.app/...' bundle path

Upload Gateway & AppSec Advisory

.ipa Security & Polyglot Risk Matrix

Risk Level: medium

Arbitrary Code / Macros

YES (Active Risk)

Pickle Deserialization

SAFE (No Pickle VM)

XML External Entity (XXE)

NONE

Polyglot Prepend Risk

YES (Check Tail/Offsets)

Backend Upload Validation Recommendation

Guard mobile CI extractors against Zip Slip (`../`) and symlink escapes inside Payload/ before running codesign or plist parsers.

Compiler-Verified Reference Code

Read .ipa Header & Metadata Without Heavy Dependencies

✓ Zero-Dependency .ipa Header Reader

import sys, zipfile
with zipfile.ZipFile(sys.argv[1], "r") as zf:
    plists = [n for n in zf.namelist() if n.startswith("Payload/") and n.endswith("Info.plist")]
    assert plists, "Missing Payload/*.app/Info.plist"
    print("Valid iOS IPA:", plists[0])

CI/CD & Unit Test Fixtures

Deterministic .ipa Sample Files & Edge Cases

Open Full .ipa Sample Matrix & Mutator →

minimalexpect: valid

minimal-app.ipa

UNSIGNED container-structure fixture: real ZIP with Payload/DemoApp.app/Info.plist (binary plist via plistlib) and a Mach-O arm64 header stub. NOT a signed installable app.

↓ Download (694 B)

SHA-256: 85778c5134a0d4c6235923fcfd82c823b35e2e9577a5fd61f7c8b5226000d479

Exact: 694 bytes

curl -fsSL https://fileformat.co/fixtures/v1/ipa/minimal-app.ipa -o minimal-app.ipa \
  && echo "85778c5134a0d4c6235923fcfd82c823b35e2e9577a5fd61f7c8b5226000d479  minimal-app.ipa" | shasum -a 256 -c

realisticexpect: valid

observatory-ios-bundle.ipa

UNSIGNED container-structure fixture: binary-plist Info.plist + PkgInfo + Mach-O stub for mobile CI artifact scanner tests. NOT a signed installable app.

↓ Download (777 B)

SHA-256: 53e13f6ea9bf56efe9c454706fa93e38d45bd77fa86d033b9cba843202a66348

Exact: 777 bytes

curl -fsSL https://fileformat.co/fixtures/v1/ipa/observatory-ios-bundle.ipa -o observatory-ios-bundle.ipa \
  && echo "53e13f6ea9bf56efe9c454706fa93e38d45bd77fa86d033b9cba843202a66348  observatory-ios-bundle.ipa" | shasum -a 256 -c

edge-caseMissing ZIP EOCDexpect: parser_error

truncated-eocd.ipa

Interrupted-upload fixture: ZIP container missing the EOCD record — zipfile must raise.

↓ Download (678 B)

SHA-256: c4abf5147786a39819f7c469079e22f72bfa617f2d9a7d10641c99c41a7c0717

Exact: 678 bytes

curl -fsSL https://fileformat.co/fixtures/v1/ipa/truncated-eocd.ipa -o truncated-eocd.ipa \
  && echo "c4abf5147786a39819f7c469079e22f72bfa617f2d9a7d10641c99c41a7c0717  truncated-eocd.ipa" | shasum -a 256 -c

Related Specifications & Alternatives

.aab little

Android AAB

Google Play publishing format packaging `BundleConfig.pb`, Protocol-Buffer encoded `base/manifest/AndroidManifest.xml`, and DEX bytecode inside a modular ZIP container.

.usdz little

USDZ

Zero-compression, 64-byte mmap-aligned PKZIP package created by Pixar & Apple for AR QuickLook and VisionOS spatial scenes, beginning with a root `.usdc` (`PXR-USDC`) or `.usda` stage.

.wasm little

WASM

Portable, sandboxed stack-machine binary bytecode format (`\0asm` v1) structured as a sequence of LEB128-framed Type, Import, Function, Memory, Export, and Code sections.