How to Resign IPA Files for Sideloading

Why You Need to Resign IPA Files

Every app that runs on an iPhone must be code-signed with a valid Apple certificate. When you download an IPA file from the internet or export it from Xcode, it carries the original developer’s signature. Before you can install it on your own device, that signature needs to be replaced with one tied to a certificate your iPhone trusts. This process is called resigning, and it is a fundamental skill for anyone serious about iOS sideloading.

Resigning is not about bypassing security; it is about transferring trust. Apple’s security model requires every piece of code running on iOS to be vouched for by a known identity. When you resign an IPA, you are saying “I vouch for this app” using your own developer identity or a certificate managed by a tool like Scarlet iOS.

If you are new to the concept of IPA files, start with our guide on understanding IPA files: what they are and how to use them. Once you understand the structure of an IPA, resigning will make much more sense. Last checked: October 27, 2026, against the iOS App Signer and zsign READMEs on GitHub and Apple’s developer membership page.

The Risks First

• Resigning changes who vouches for the app, not what the app does. A modified IPA stays modified after you sign it, so check the IPA first.
• Never hand a .p12 certificate and its password to a website or a stranger. Anyone with them can sign apps as you.
• Resigning with a different bundle ID creates a separate app with no data. To update an app in place, keep the same bundle ID and the same Apple ID.
• With a free Apple ID, apps you sign stop opening after 7 days. Apple’s membership page says free provisioning profiles “will expire 7 days from issuance”.

Resigning Tools at a Glance

Tool	Runs on	Signs with	Good for
iOS App Signer	macOS (needs Xcode)	Your certificate and provisioning profile	A simple window-based resign
AltServer / AltStore	Mac or Windows	Your Apple ID	Resign and install in one step
Sideloadly	Mac or Windows	Your Apple ID	Resign and install, plus bundle ID and name changes
codesign	macOS (Xcode command line tools)	Your certificate and provisioning profile	Full control, scripting
zsign	macOS, Linux, Windows, Android, FreeBSD	A .p12 certificate and provisioning profile	Resigning without a Mac

What You Need Before Resigning

To resign an IPA file, you will need the following:

• The IPA file you want to resign
• A Mac (for traditional tools) or a Windows/Linux machine (for cross-platform tools)
• An Apple ID (free) or an Apple Developer account ($99/year for broader capabilities)
• A resigning tool such as iOS App Signer, AltServer, or a command-line approach using codesign
• A provisioning profile that includes your device’s UDID (with a free Apple ID, Xcode creates it for you; see below)

Alternatively, Scarlet iOS can install IPA files you already have and does the signing itself, so you do not handle certificates or profiles. But understanding the manual process gives you more control and helps you troubleshoot when automated tools fail.

Method 1: Resigning with iOS App Signer (Mac)

iOS App Signer is a free, open-source tool for macOS that provides a graphical interface for resigning IPA files. Here is how to use it:

1. Download iOS App Signer from its official GitHub repository. Its README says it “requires Xcode to be installed” and accepts ipa, deb, app and xcarchive files.
2. Open Xcode and sign in with your Apple ID via Settings > Accounts (Preferences in older versions). This creates a local signing certificate on your Mac.
3. Get a provisioning profile that includes your device. With a free Apple ID, the README’s route is to create these “from Xcode by creating a new project”: connect the iPhone, create an empty app project, and let Xcode manage signing. Apple’s membership page confirms that for free accounts “profiles are managed directly in Xcode”. With a paid account you can instead register the device UDID in the developer portal and download a profile there. Our guide shows how to find the UDID.
4. Open iOS App Signer and select your IPA file as the input.
5. Choose your signing certificate from the dropdown; it will appear as “Apple Development: Your Name” (or “iPhone Developer: Your Name” for older certificates).
6. Select the provisioning profile you downloaded.
7. Optionally change the bundle ID (the README calls it the application ID) or the display name if you want to install alongside the original app. See running multiple versions of the same app.
8. Click Start and wait for the resigned IPA to be generated.
9. Use Xcode’s Devices and Simulators window or a tool like Apple Configurator to install the resigned IPA.

Method 2: Resigning with AltServer

AltServer is another popular approach that works on both Mac and Windows. It integrates with AltStore but can also be used to resign arbitrary IPA files:

1. Install AltServer on your computer and AltStore on your iPhone.
2. Keep AltServer running on your computer, with the iPhone on the same Wi-Fi network (or connected by cable).
3. In AltStore on the iPhone, open My Apps, tap + and pick the IPA file. AltStore uses the Apple ID you signed in with when you installed it.
4. AltStore and AltServer handle the certificate creation, provisioning profile generation, resigning, and installation automatically.

The limitation of the free Apple ID method is the 7-day certificate expiry. Apps signed this way will stop working after a week unless you re-sign them again. A paid Apple Developer account ($99/year) extends this to 12 months. To keep free-signed apps alive, see how to refresh apps before the 7 days run out, and for the 3-app cap see the free Apple ID app limit.

Method 3: Command-Line Resigning with codesign

For advanced users and automation workflows, the command-line approach using Apple’s codesign tool gives the most flexibility. This method requires macOS and Xcode command-line tools installed.

Step 1: Unzip the IPA

An IPA file is just a ZIP archive. Rename it with a .zip extension and extract it, or use the terminal:

unzip MyApp.ipa -d MyApp_extracted

Step 2: Remove Existing Signature

rm -rf MyApp_extracted/Payload/MyApp.app/_CodeSignature

Step 3: Copy Your Provisioning Profile

cp MyProvisioningProfile.mobileprovision MyApp_extracted/Payload/MyApp.app/embedded.mobileprovision

Step 4: Re-sign with codesign

Sign the frameworks and app extensions inside the app first, then the app itself, so that nothing inside is left with the old signature:

codesign -f -s "Apple Development: Your Name (TEAMID)" MyApp_extracted/Payload/MyApp.app/Frameworks/*

If the app has extensions (a PlugIns folder), sign each .appex the same way before the app, with a provisioning profile and entitlements that match that extension’s own bundle ID. With a free Apple ID this is often the point where it fails; tools like Sideloadly can strip extensions instead.

codesign -f -s "Apple Development: Your Name (TEAMID)" --entitlements entitlements.plist MyApp_extracted/Payload/MyApp.app

Newer certificates are named “Apple Development”; older ones may still show as “iPhone Developer”. Run security find-identity -v -p codesigning to list the exact names on your Mac. The entitlements file must match your provisioning profile, so take its values from the profile rather than from the original app.

Step 5: Repackage as IPA

cd MyApp_extracted && zip -r ../MyApp_resigned.ipa Payload

Resigning Without a Mac: zsign

zsign (MIT license, active on GitHub in October 2026) describes itself as “a fast, open-source, cross-platform codesign alternative for iOS 12+” that re-signs .ipa packages and .app bundles “with custom certificates and provisioning profiles, without Xcode, without macOS”. Its README lists builds for macOS, Linux, Windows, Android and FreeBSD, per-extension provisioning profiles for apps with extensions, bundle ID and display name changes, and a certificate and OCSP check that can show whether a certificate is still valid. You need a .p12 certificate, its password and a matching provisioning profile, which in practice means a paid developer account. It is a command-line tool, so it suits users comfortable with a terminal.

Resigning Directly in Scarlet iOS

If you are using Scarlet iOS, most of the resigning complexity is handled for you behind the scenes. When you install an IPA file through Scarlet, it is signed with the certificate Scarlet uses instead of your own, so you need no Apple ID, computer or provisioning profile. The trade-off is that this certificate is shared and Apple can revoke it.

For advanced users, our guide on Developer Mode on iPhone explains when Apple’s Developer Mode setting is needed: for apps you resign with your own Apple ID, yes; Scarlet itself is enterprise-signed and does not need it. Scarlet is confirmed on iOS 14 through iOS 26; iOS 27 support is reported by third parties but not officially confirmed.

Common Resigning Errors and Fixes

Error: “A valid provisioning profile for this executable was not found”

This means the provisioning profile you used does not include your device’s UDID, or the profile has expired. With a paid account, register the device in Apple’s developer portal and download a new profile; with a free Apple ID, let Xcode create a new one by building an empty project to the connected iPhone.

Error: “The executable was signed with invalid entitlements”

Some apps request entitlements (special permissions) that require a paid developer account or specific capabilities enabled in the provisioning profile. Remove the unsupported ones from the entitlements file you pass to codesign (--entitlements) so it matches your provisioning profile, then sign again.

Error: “Code object is not signed at all”

This usually occurs when frameworks bundled inside the app were not re-signed along with the main executable. You need to re-sign each framework individually before re-signing the main app bundle.

Error: “Unable to Install” or “integrity could not be verified” on the iPhone

The signature, the profile or the device list does not match. Check that the profile includes your device, that every framework was signed, and that the certificate has not been revoked. See how to fix the integrity error.

The app installs but will not open

On iOS 16 and later, apps signed with your own development certificate need Developer Mode turned on, and the developer may need to be trusted in Settings > General > VPN & Device Management. See the Untrusted Developer fix.

Best Practices for Resigning IPA Files

• Always keep a backup of the original, unmodified IPA before resigning.
• Document which certificate and provisioning profile you used for each app; this makes renewal much easier.
• If you need multiple apps to communicate with each other (app groups), make sure all apps are signed with the same team ID.
• For apps you use regularly, consider a paid Apple Developer account to avoid weekly re-signing headaches.

Conclusion

Resigning IPA files is a core skill for anyone who wants full control over app installations on their iPhone. Whether you choose a GUI tool, command-line approach, or let Scarlet iOS handle it automatically, understanding the process empowers you to troubleshoot problems and unlock apps that the App Store does not offer.

If you would rather not handle certificates yourself, a tool that signs on the device is the simpler route; see how to install Scarlet iOS (or open our Scarlet iOS install page in Safari), or our guide to creating your own IPA file for the step before resigning.

FAQ

Can I resign an IPA on Windows?

Yes. AltServer and Sideloadly sign with your Apple ID on Windows, and zsign runs on Windows with a .p12 certificate.

Does resigning keep my app data?

Only if you install the resigned app over the existing one with the same bundle ID (and, for Apple ID tools, the same Apple ID). Deleting the app first deletes its data.

Can I resign with a free Apple ID?

Yes, but the profile lasts 7 days and you can have at most 3 sideloaded apps on a device at once, according to Apple’s membership page.