IpaDownloadTool: finding the IPA link inside a distribution web page

The tool reads a distribution page so you do not have to

Enterprise and internal beta distribution on iOS still runs through web pages. A link is pasted into Safari, the page asks for a profile to be installed, and somewhere behind a plist file sits the actual IPA download. IpaDownloadTool exists to compress that flow into one app.

The stated feature set covers the whole loop. You enter a download page link, the app parses the IPA download address from it, and it supports both downloading the file locally and sharing it onwards. It can hand the file to another person or send it to a computer over AirDrop. A download history list keeps whatever you have fetched, and the documentation is explicit about why that matters: an arbitrary number of IPAs can be stored locally, so you do not lose a build because the page that served it has expired.

URL entry is not limited to typing. The app also accepts a URL scanned from a QR code, which is the normal way a test device receives a build in a room where nobody wants to type a long address.

What the tool does not do is stated just as plainly, and that list matters for judging it. It does not support downloading IPAs from the App Store, and it does not support extracting an IPA from an app already installed on the device. There is no path here to the App Store catalogue and no path to the contents of a jailbroken or otherwise accessible device. The input is a distribution page you were given, and the output is a file.

A WKWebView intercepts the itms-services:// request

The mechanism is interception rather than scraping, and the project description states it plainly: the app intercepts the itms-services:// request made by the web view and parses the plist file behind it. That request is the one an iOS device makes when it is told to install an app from a manifest, so catching it means catching the manifest itself rather than guessing at the download button on the page.

Two later releases sharpen that mechanism. v2.1.2, dated 2024-09-03, added direct parsing of itms-services:// links, so you can hand the app the manifest URL itself and skip the page. v2.2.0, dated 2025-03-02, replaced UIWebView with WKWebView, which the changelog describes as an improvement to page loading experience and performance, along with work to improve IPA extraction compatibility.

That WKWebView migration is the single most consequential engineering change in the project, and it cuts both ways. The old UIWebView was long deprecated by Apple and had been the classic source of breakage for tools of this kind, because it was easy to reach the page but the API surface kept shrinking. Moving to WKWebView means the app works on current systems, but it also means any extraction logic that depended on UIWebView internals had to be rewritten, and the same changelog entry notes the extraction rules were still being adjusted in that release.

The extraction rules themselves are described only in general terms. The changelog for v2.0.1 refers to optimising the extraction rules and details, and v2.2.0 refers to improving compatibility, but the repository does not document the rules as a specification, so the behaviour on an unfamiliar page is not something you can predict from the documentation.

UDID profiles are matched and can be virtualised

The hardest part of enterprise testing is the device identifier. A device management profile carries a list of UDIDs, and if the device you are holding is not on that list, the install fails at the profile step even though the IPA itself is fine.

The v2.1.0 release, dated 2023.04.08, added automatic parsing and installation of the UDID provisioning profile, so the tool can continue to the IPA extraction after the profile step rather than stopping there. The same release added a rule for matching the profile URL and a custom virtual UDID, and a URL Scheme so a page in Safari can hand the address to the app.

ipadownloadtool://hander?url=

The scheme is the mechanism for the jump from Safari into the app with the relevant page already loaded. It is also a reminder of how the flow is meant to work in the field: the page is opened normally, and the tool takes over at the point where the manifest is requested.

A note on the boundary of all this. Handling the profile inside the app does not remove the requirement that the device be entitled to install the build. The profile has to list the device, and the app can only help with the paperwork of getting the profile in place. A virtual UDID, as the changelog calls it, is a matching rule for the profile URL, not a way of adding an unlisted device to an existing profile.

For the underlying provisioning file parsing, the project uses the TCMobileProvision library from tcurdt, listed among the third party components it uses.

A blocklist took two hosting platforms out of scope in v2.1.1

The clearest statement of the project's boundaries is a change log entry. v2.1.1, dated 2023.08.09, added an access blocklist that forbids visiting the pgyer and fir pages, and the README carries a warning that, at the request of the site operators, extraction of pgyer and fir IPAs has been prohibited since v2.1.1. The earlier feature list even keeps the old capability with a strikethrough through it.

That detail tells you more about the project than any feature claim. The tool was originally built to intercept the download pages of hosted beta platforms, and its earlier releases, including v1.0.2 from 2021.01.16, mention support for pgyer super signing and similar platforms. When those operators objected, the author removed the capability rather than arguing about it.

The remaining scope is the part that is yours. Custom and self hosted distribution pages, where the plist is on a server you control or one your company operates, are exactly what the interception mechanism is for. The tool that could once pull an IPA from a public sharing platform now, by design, only works on pages that are yours or that you are authorised to use.

The reading of the README's usage note is consistent with that. It describes the app as a tool for extracting your own IPA from third party web pages for testing and for study, and states that it must not be used for illegal purposes, and that the developer does not bear responsibility for consequences of misuse. The project description on the repository limits the tool to downloading your own IPA and forbids any other use.

You install the app from a release IPA, the README gives no build steps

This is an iOS application, and the distribution method is unusual: the README links directly to the IPA files of each release, hosted on the project's own object storage, with the newest one labelled as the latest version and the older ones listed as historical versions. The versions offered are 2.2.0 from 2025-03-02, 2.1.2 from 2024-09-03, 2.1.1 from 2023-08-09, 2.1.0 from 2023-04-08, and 2.0.1 from 2022-10-18.

Installing an IPA means signing it and trusting the profile, which is a different procedure from installing a build of your own, and the documentation does not walk through the sideload steps. It also does not document how to build the project from source. The repository contains an IpaDownloadTool directory with the Xcode project, but there is no build or signing section in the README, so if you want to compile it yourself with your own team identifier you are working from the repository alone.

There is a support channel instead of a build guide, with a feedback group linked from the README, and a list of third party components the project builds on: ALToastView for toasts, SGQRCode for QR scanning, BackButtonHandler for the navigation bar back behaviour, NJKWebViewProgress for the loading progress bar, ZXTableView and ZXDataHandle from the same author, and TCMobileProvision for the provisioning file parsing. That list is a decent map of what the app does, since each library accounts for one visible feature.

The project is MIT licensed, with a LICENSE file at the root, and the support badge states iOS 9.0 and above.

A long feature history with small, specific fixes

The changelog in the README is a good place to read how the tool behaves around its edges, because most entries are small corrections rather than features.

From v2.0.1 in October 2022: direct downloading of IPA files found inside a web page, forward, back and reload controls on the main page, sorting the extraction history by time or file name, editing page titles in the browsing history, and data import and export. The same release fixed a crash when the plist download failed, fixed a load failure when the URL contained Chinese characters, fixed a missing site logo in the history, fixed a misplaced progress bar when the device was rotated, and fixed a crash when tapping the share or re-download entries on an iPad. It also stopped showing an MD5 digest as the shared file name and started showing the original name, and it started deleting interrupted download files.

v1.0.3 in September 2022 was mostly iOS 15 cosmetics, a black navigation bar and a gap above the table view, plus a fix for incomplete URLs in the browsing history and the ability to swipe away a downloaded IPA from the downloaded pages list.

v1.0.2 in January 2021 added clipboard URL detection on launch, the ability to change the local app name, and version numbers shown in both the extraction history and the download list, alongside long press on the web button to view the browsing history.

The pattern is that of a single maintainer iterating on a utility for their own use and publishing the fixes. The last push to the repository was on 2026-10-07, and the published tags are 2.2.0 from 2025-03-02, 2.1.2 from 2024-09-03, and 2.1.1 from 2023-08-08, so code moves more often than releases do.

Editorial conclusion

IpaDownloadTool fits a developer or tester who receives an enterprise or internal beta build through a web distribution page and wants the IPA and the matching UDID profile on a device without reading the plist by hand. It does not fit anyone looking for App Store apps, for apps already installed on a phone, or for hosting platforms the author has blocked, since pgyer and fir extraction has been refused since v2.1.1. Verify first that the page you want to open is not on that blocklist, that the profile it serves matches the UDID of the device you will install on, and that the IPA you extract is one you are entitled to install, since the project itself limits its use to your own builds.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. Releases
5. SmileZXLee/IpaDownloadTool on GitHub