Extract an IPA from an iPhone in one command
getIPA pulls an app off your own jailbroken iPhone and packages it as a decrypted IPA in one command. What you need, how to use it and why decryption matters.
Free open-source tool
getIPA, an IPA extractor for iPhone
Pull an app off your own jailbroken iPhone and package it as an IPA in one command. getIPA does the SSH, copy, zip and download for you, and gives you a decrypted copy that's ready to analyse.
Runs on your own computer. Nothing is sent to us.
Recommended
Install with pipx
One command installs getIPA from PyPI. The second is a one-time step that adds bagbak, which makes decrypted copies. Skip it if you only want raw copies.
pipx install getipa
getipa --install-bagbakSource code
Get the tool from GitHub
The full source, the README and the MIT licence. Clone it and run the installer, which also sets up bagbak.
git clone https://github.com/RansomWhisker/getIPA.git
cd getIPA
./install.shWhat you need
- Your computer: macOS or Linux (Windows is experimental), Python 3.9 or newer, and the OpenSSH client.
- Your iPhone: jailbroken, with OpenSSH running, on the same Wi-Fi as your computer.
- For decrypted IPAs: Node.js on your computer, and frida-server running on the phone.
Only use getIPA on apps and devices you own or are authorised to test.
Quick start
Run getipa. It asks for your username (usually root, or mobile on some newer jailbreaks), the phone's IP address (just the last number works: 9 means 192.168.1.9) and the SSH password you set on the phone. Then it lists your apps, newest first, with Apple's own apps hidden.
$ getipa
Username [root]: root
Device IP (just the last number works, e.g. 9 = 192.168.1.9): 9
[*] Using 192.168.1.9
Recently installed apps (newest first):
1. 2026-11-04 18:22 com.example.app 2.4.1 Example
Pick a number (or Enter to quit): 1
Extract as:
1) Decrypted IPA (recommended)
2) Encrypted IPA (raw copy, fastest)
[+] Wrote ipas/com.example.app_2.4.1.ipaExample output with a placeholder app.
Handy options
--list- List your apps and exit
-b com.example.app- Extract an app by bundle ID or name
--decrypted- Decrypted IPA only (needs bagbak and frida-server)
--encrypted- Raw encrypted copy only, the fastest
--info- Print permissions, entitlements and settings after extracting
--info-file app.ipa- Report on an IPA you already have (no phone needed)
--host, --port, --user- Connection details (port 22 and user root by default)
--key PATH- Use an SSH key instead of a password
-o DIR- Where to save the IPA (./ipas by default)
How to use the result
What to do with the IPA
- Read the app report.
getipa --info-file app.ipashows permissions, entitlements, App Transport Security settings, URL schemes and frameworks. Settings that weaken transport security are flagged. - Scan it with AppSleuth.
appsleuth scan app.ipachecks for secrets, weak transport security, missing hardening and risky web content, and writes an HTML report. - Look for secrets. API keys, tokens and internal URLs shipped inside an app can be read by anyone holding the IPA. Our note on mobile apps storing secrets locally explains what to look for.
- Analyse the binary. A decrypted IPA opens in your usual reverse-engineering tools; an encrypted one won't.
- Test the API behind it. The app is usually just the front end. Most serious findings are in the server it talks to.
Background
Why decrypted matters
Apps from the App Store are encrypted on the phone (Apple calls it FairPlay). A plain copy gives you an IPA whose main code can't be read, so it's useless for analysis. getIPA checks for this and tells you. With bagbak, it dumps the app while it runs, so you get the real code. In the default mode it tries a decrypted copy first and falls back to the raw copy, with a warning, if that fails.
If the decrypted option fails, the usual cause is that frida-server isn't running on the phone. Install it from Sileo or Zebra, start it, and try again.
Built to be safe on your network
- Nothing leaves your machine except your own SSH connection to the phone (and Frida, if you ask for a decrypted copy). No telemetry.
- One SSH session, reused for every step. Your password goes to SSH through a short-lived helper; it's never on the command line and never written to disk.
- The phone is treated as untrusted. Files are extracted defensively (no path traversal, links skipped), and names from the device are cleaned before they're printed or used.
Change the default alpine password on your phone, prefer SSH keys, and use getIPA only on a network you trust.
Responsible use
getIPA is for apps and devices you own or are authorised to analyse: your own apps, security research, interoperability and personal backup, where the law allows. Don't use it to copy paid apps or get around licensing.
FAQ
getIPA questions
Is getIPA free?
Yes. getIPA is free and open source under the MIT licence. Install it with pipx install getipa, or download the source from GitHub.
Does it send anything to Rudranetra?
No. getIPA runs on your own computer and has no telemetry. The only network traffic is your SSH connection to your phone, and the connection to frida-server on the phone if you ask for a decrypted copy.
What's the difference between a decrypted and an encrypted IPA?
Apps from the App Store are encrypted on the phone (Apple calls it FairPlay). A plain copy keeps that encryption, so the main binary can't be read, although Info.plist, entitlements and other resources still can. A decrypted IPA is dumped from the running app with bagbak, so you get the real code for analysis.
Does it need a jailbroken iPhone?
Yes. getIPA connects over SSH, which needs a jailbroken iPhone with OpenSSH running. Decrypted copies also need frida-server running on the phone and Node.js on your computer.
Does it work on Windows?
Yes, as an experimental option. Install it with pipx install getipa; it needs Python 3.9 or newer and the OpenSSH client built into Windows. Windows OpenSSH can't share one connection, so each step logs in separately and an SSH key (--key) works best. The install.sh script is for macOS and Linux only.
Which apps can I use it on?
Only apps and devices you own or are authorised to test: your own apps, security research, interoperability and personal backup, where the law allows. Don't use it to copy paid apps or get around licensing.
Related
Mobile App Penetration Testing (iOS & Android)
In-depth testing of your iOS and Android apps and the backend they talk to, aligned with OWASP MASVS.