Extract an IPA from an iPhone in one command

Pulling an app off a jailbroken iPhone usually means a pile of manual steps: SSH in, find the app folder, copy it, zip it, copy it back. And after all that, the IPA often turns out to be encrypted, so it’s useless for analysis.

We built getIPA to do all of it in one command. It’s free and open source.

What you need

• A jailbroken iPhone with OpenSSH running, on the same Wi-Fi as your computer
• A Mac or Linux computer with Python 3.9 or newer (Windows works too, as an experimental option)
• For decrypted IPAs only: Node.js on the computer, and frida-server running on the phone

Only use it on apps and devices you own or are authorised to test.

Install

pipx install getipa
getipa --install-bagbak

The second command is a one-time step. It installs bagbak, the tool that decrypts the app. Skip it if you only want raw copies. If you’d rather build from source, the getIPA tool page links to the code on GitHub.

Use it

Just run:

getipa

It asks for three things:

• Username: usually root (on some newer jailbreaks, mobile)
• Device IP: you can type just the last number, so 9 becomes 192.168.1.9, or type your phone’s full IP address
• Password: the one you set on the phone for SSH

Then you see your apps, newest first, with Apple’s system apps hidden:

Recently installed apps (newest first):
  1. 2026-11-04 18:22  com.example.app     2.4.1   Example
  2. 2026-11-02 13:54  com.example.notes   1.8.0   Notes
Pick a number (or Enter to quit): 1

Pick one, then choose how to extract it:

• Decrypted IPA (recommended): ready to analyse
• Encrypted IPA: a fast raw copy

Your IPA is saved in the ipas folder where you ran the command.

Why “decrypted” matters

Apps from the App Store are encrypted on the phone (Apple calls it FairPlay). A plain copy gives you a file whose main code you can’t read. getIPA checks for this and tells you, so you never waste time on a dead file. With bagbak, it dumps the app while it runs, and you get the real code.

If the decrypted option fails, the usual cause is frida-server not running on the phone. Install it from Sileo or Zebra, start it, and try again.

Handy options

getipa --list                  # just show the apps
getipa -b com.example.shop     # pick an app by bundle ID
getipa --decrypted             # decrypted only
getipa --encrypted             # raw copy only
getipa --info                  # print permissions and settings after extracting
getipa --info-file app.ipa     # report on an IPA you already have

The --info report is a quick first look: permissions, entitlements, App Transport Security settings and whether the binary is still encrypted. For what to look for next, such as secrets stored inside the app, see our mobile app penetration testing guide.

Safety

getIPA never sends anything anywhere except over your own SSH connection. It opens a single SSH session, extracts files defensively, and keeps your password out of command lines and files.

Get it

• Install: pipx install getipa
• Source code, README and licence: on the getIPA tool page, with a link to GitHub
• Analyse the IPA: AppSleuth scans it for security issues (appsleuth scan app.ipa)
• The Android version: getAPK
• More free tools: rudranetra.com/tools