What this provisioning inspector reads
The bounded ASN.1 reader unwraps CMS SignedData and extracts its XML property list plus wrapper certificate records. The plist view exposes profile identity, team IDs, App ID prefix and bundle pattern, creation and expiration, platform, device restrictions, authorized entitlements, and DeveloperCertificates. IPA input is treated as a bounded ZIP archive and every readable app or extension embedded.mobileprovision is offered separately.
How profile comparison helps
Select a second standalone profile or IPA to compare metadata, entitlement values, provisioned device membership, and exact SHA-256 certificate fingerprints. Added and removed entries stay distinct, making a regenerated or distribution profile easier to audit without reducing nested entitlements to a misleading yes/no result.
Interpreting App ID and profile type
The standard application identifier joins an App ID prefix to a bundle ID or wildcard bundle pattern. Profile type is described only from visible evidence: debugging permission, a device list, or all-device authorization. A missing device list alone is not enough to claim a specific distribution channel, and App Store downloads commonly omit the embedded provisioning profile entirely.
Security and validity boundary
This is an offline metadata debugger, not a signing or trust-verification tool. It does not verify the CMS signature, signer attributes, Apple certificate chain, revocation, code-directory signature, executable entitlements, bundle identifier, notarization, App Store receipt, or installability. Apple documents that a modern profile's DER-Encoded-Profile is the source of truth; this tool reports its presence and size but does not interpret that undocumented representation. Never upload private keys or PKCS #12 files—this page neither needs nor accepts them.
Frequently asked questions
Why are the profile entitlements not the app's entitlements?
The profile authorizes capabilities that signed code may claim. The executable's code signature separately declares what the app actually claims, so the two need a dedicated signature comparison before installability can be assessed.
Why does an IPA show no embedded profile?
Apps downloaded from the App Store do not contain one because provisioning is checked during distribution. A missing profile can therefore be expected, depending on the IPA's origin.
Does a future expiration date mean the profile works?
No. Certificate validity, revocation, profile signature, device membership, bundle identity, entitlements, platform policy, and the signed application must also agree.
Authoritative references
Apple's TN3125: Inside Code Signing — Provisioning Profiles explains the CMS-wrapped plist, App ID, device, expiration, entitlement, embedded-file, and DER-profile behavior. Apple also documents the App ID, certificate, and device inputs to a development profile. Envelope and certificate field parsing follows RFC 5652 CMS and RFC 5280 X.509.
Browse mobile signing tools · Inspect MCUboot firmware signing metadata · Inspect U-Boot FIT signatures and hashes