End-to-end FairPlay decrypter for App Store apps. Give it a bundle ID, get a decrypted .ipa. And yes - it happily decrypts iOS 26 apps.

How it works

ipadecrypt decrypts FairPlay apps on your computer - no device in the loop for day-to-day use. A jailbroken device is needed exactly once per Apple account, during bootstrap, to mint a reusable 16-byte account credential. After that, downloading and decrypting any app for that account is fully offline.

Requirements

On your computer

• Nothing special for decrypting. For the one-time mint: a jailbroken iPhone reachable over the network (or over USB with iproxy).

On the jailbroken iPhone (one-time mint only)

Requirement	Purpose
OpenSSH with root access	The mint connects over root SSH (install OpenSSH from Sileo)
≥1 owned App Store app installed	Bought with the same Apple ID; used to trigger FairPlay once

Tested on iOS 16.7.11 with palera1n rootless and Dopamine on iPhone 8 Plus. iOS 10+ is expected to work for minting; decryption itself runs anywhere.

Install

Download a prebuilt binary from the releases page.

Using go install:

go install github.com/londek/ipadecrypt/cmd/ipadecrypt@latest

From source (refer to BUILDING.md for detailed instructions):

git clone https://github.com/londek/ipadecrypt
cd ipadecrypt
go build ./cmd/ipadecrypt

Usage

First-time setup

ipadecrypt bootstrap

A two-step interactive wizard:

1. App Store sign-in - Logs into the App Store. Credentials stay local in ~/.ipadecrypt/config.json. The first sign-in downloads and caches the Apple frameworks the App Store engine emulates (~tens of MB, range-extracted from a pinned macOS image) under ~/.cache/ipadecrypt/; later runs reuse the cache.
2. Credential mint - Connects once to your jailbroken device over root SSH and extracts the reusable account credential, cached under ~/.ipadecrypt/credentials/.

Run it again anytime; it skips minting if a credential is already cached (pass --remint to force). After bootstrap, no device is ever needed again.

Decrypt an app

ipadecrypt decrypt <bundle-id|app-store-id|app-store-url|path-to-local-ipa>

List versions of an app

ipadecrypt versions <bundle-id|app-store-id|app-store-url>

Known issues

• Only the supported SINF/SUPF license formats decrypt; apps shipping a newer, unsupported SC_Info format are skipped.
• The credential is per Apple account: decrypting an app requires signing in with (and having minted from) the account that owns it.

License

MIT.

Prior art

• EthanArbuckle/fairplay-decrypt - the offline FairPlay decryptor and credential-minting approach this release is a Go port of.
• majd/ipatool - the Apple Configurator impersonation the App Store client is based on.
• 34306/TrollDecryptJB - task_for_pid + mach_vm_read from a suspended spawn, entitlement set.
• JohnCoates/flexdecrypt - the pre-iOS-16 approach that stopped working and prompted the pivot.

AI Disclaimer

This project was developed with the assistance of AI tools. While I can't guarantee the accuracy of all AI-generated content, I have overviewed creation process and then reviewed, tested the code to ensure it meets the project's requirements.