If you've ever downloaded an iOS app from somewhere other than the App Store, you've handled an IPA file — the iOS equivalent of Android's .apk. Understanding what's actually inside one explains why iOS apps can't simply be double-clicked into place like a desktop application.

The short definition

IPA stands for iOS App Store Package. It's a ZIP archive renamed to .ipa, containing a compiled iOS app plus the metadata iOS needs to verify and install it. Rename any .ipa to .zip and unzip it — the contents are right there.

What's inside an IPA

Every valid IPA has this structure:

YourApp.ipa
└── Payload/
    └── YourApp.app/
        ├── YourApp           ← compiled binary (Mach-O)
        ├── Info.plist        ← app metadata
        ├── embedded.mobileprovision  ← provisioning profile
        ├── _CodeSignature/   ← signature data
        └── Assets/, Frameworks/, etc.

The .app bundle is the same format your Mac uses for desktop apps. The Payload wrapper is the iOS convention.

The two files that decide if it installs

Two pieces inside the IPA control whether iOS will accept it:

  • embedded.mobileprovision — the provisioning profile. Tells iOS which certificate signed the app and which devices/Apple IDs are authorized.
  • _CodeSignature/ — the cryptographic signature. Generated by Apple's code signing process. If anything in the IPA changes after signing, the signature breaks and iOS refuses to launch the app.

How an IPA gets installed

iOS won't let you install an IPA by just having the file. It needs a delivery method that can hand iOS the manifest plus the certificate trust chain. The three real options:

  1. App Store — Apple's own delivery, no certificate work on your end.
  2. TestFlight — Apple's beta channel, capped at 10,000 users and 90 days.
  3. Direct install with a signed IPA — using an Enterprise certificate or Developer certificate, delivered via itms-services:// install link, AltStore, or Sideloadly.

IPA vs APK — the big difference

Android apps install from any APK that the user trusts. iOS is stricter: the IPA must be signed by an Apple-issued certificate and the device must trust that certificate. No certificate, no install — regardless of the IPA's quality or origin.

This is why you can't just download an arbitrary IPA off the internet and tap it. You need a signing service or a developer certificate to make it installable on your device.

Why this matters

When your IPA "doesn't install" or "won't open after install", the issue is almost always with the signature or provisioning profile — not the binary itself. The same IPA can be re-signed dozens of times with different certificates and remain functionally identical. See our guide to fixing IPA install errors for the common cases.