Is Scarlet iOS Safe? An Honest Security Guide
“Is Scarlet iOS safe?” is one of the most common questions about it, and it deserves a straight answer rather than a sales pitch. This page explains what Scarlet does on your iPhone, what it does not do, where the real risks are, and how to keep them small. We only state what can be checked: the official Scarlet site, Apple’s own documentation, and what you can see on your device. Last checked: October 27, 2026.
The Risks at a Glance
- A shared enterprise certificate. Apps you install with Scarlet are signed with a certificate many other people use too. Apple’s support article describes the Apple Developer Enterprise Program as a way for an organization to “create and distribute proprietary enterprise apps for internal use”, not for the public. That is why such certificates get revoked.
- Revocations. When Apple revokes the certificate, Scarlet and the apps it installed stop opening until a new one is available. You cannot prevent this; you can only be ready for it.
- Third-party IPA files. Scarlet installs what you give it. Neither Apple nor Scarlet reviews those files, and modified apps can contain code you cannot see.
- No published audit. We could not find an independent security audit or public source code for Scarlet, and its official site names only a single developer. Its behaviour cannot be verified the way an open-source tool’s can.
None of these mean Scarlet is malware. They mean you are trusting a third party and a certificate you do not control, and you should decide with that in mind.
The Short Answer
Scarlet itself is a fairly low-risk way to install apps outside the App Store, as long as you get it from a trustworthy source. It does not jailbreak your device and does not change iOS. The real risks are elsewhere: fake or modified copies of the installer, apps from sources you cannot check, and Apple revoking the certificate the apps are signed with. Each of those is manageable if you know about it. There is no way to call any installer that uses a shared enterprise certificate risk-free.
What Scarlet Does on Your iPhone
- It is an app installer. The official site describes Scarlet as an App Store and Cydia alternative for iPhone and iPad. You use it to install apps from its library, from repositories you add, or from IPA files you have.
- It uses certificate signing. Apps installed with Scarlet are signed with an enterprise-style certificate that iOS accepts once you trust the developer in Settings, General, VPN and Device Management. Because of this, Scarlet does not need Developer Mode.
- It does not jailbreak. Scarlet works on stock iOS. It does not remove iOS protections, gain root access or change system files.
What Stays in Place
Because nothing is jailbroken, the normal iOS protections still apply to Scarlet and to the apps you install with it:
- App sandboxing: each app runs in its own sandbox and cannot read other apps’ data or system files.
- Permission prompts: apps still have to ask for access to your photos, contacts, location, camera or microphone, and you can say no or change it later in Settings.
- iOS updates: you can keep installing Apple’s security updates as usual. After a major iOS update, install the latest Scarlet as well.
Sandboxing protects your other apps, not the data you type into an app. A modified app can still misuse whatever you give it, such as a login.
What Apple Says About Trusting an Enterprise Developer
Apple’s support article on custom enterprise apps describes the same trust step you go through for Scarlet:
- When you first open the app, iOS says the developer “isn’t trusted on your device”. You trust it in Settings > General > VPN & Device Management, under Enterprise App. On iOS 18 and later, Apple says to tap “Allow & Restart” to finish.
- Trust is not checked only once. Apple says your iPhone “must reverify the app developer’s certificate periodically to maintain trust”. This check needs a connection to ppq.apple.com; if it fails, you may see “Not Verified” or an Unable to Verify message (see how to fix Unable to Verify App).
- Trust stays until you remove it. Apple says a developer stays trusted “until you use the Delete App button to remove all apps from the developer”.
Trusting a developer lets their apps run. It does not give those apps any extra access to your data; permissions are still asked one by one.
The Real Risks
1. Fake or modified copies of Scarlet
Scarlet is not on the App Store, so copies circulate on forums, file-sharing sites and video descriptions. A modified installer could contain anything. Get Scarlet from the official site or from an install page you trust, such as our Scarlet iOS install page, and be wary of any site that sells a “premium” or “revoke-proof” version.
2. The apps you install
This is the biggest risk. Apps installed outside the App Store are not reviewed by Apple, and tweaked versions of popular apps are code changed by people you usually cannot identify. Repositories are run by third parties, not by Scarlet, so their quality varies. Before installing a file from an unknown source, see how to scan IPA files for malware, and avoid signing in to important accounts in modified apps.
3. Certificate revocations
Apple’s enterprise program is meant for companies distributing apps to their own employees, which is why Apple revokes certificates it finds being used to distribute apps to the public. When that happens, Scarlet and the apps it installed stop opening until they are reinstalled with a new certificate. Your data is not exposed by a revocation, but it is disruptive. Our guide on what to do when the certificate is revoked covers the fix, and enterprise certificate safety explains how these certificates work.
4. Fake sites and phishing
Be careful with sites that ask for your Apple ID password in a web form, ask you to install extra configuration or VPN profiles you did not expect, or want payment for features. Never type your Apple ID password into an install page.
How to Check What Is on Your iPhone
- Profiles and developers: open Settings > General > VPN & Device Management. Anything you do not recognize, especially a configuration or VPN profile you did not mean to install, should be removed.
- Permissions: open Settings > Privacy & Security and go through Photos, Contacts, Location Services, Camera and Microphone. Turn off access for any sideloaded app that does not need it.
- Network activity: in Settings > Privacy & Security, turn on App Privacy Report. After a few days it shows which domains each app contacted, which is a good way to spot a modified app sending data somewhere unexpected.
- Sharing and access: Safety Check, also in Privacy & Security, lets you review and stop sharing with people and apps in one place.
Step-by-step paths for each setting are in our guide on how to revoke access from untrusted apps.
Scarlet vs Jailbreaking: Security Compared
| Scarlet iOS | Jailbreak | |
|---|---|---|
| Changes iOS | No | Yes |
| App sandboxing | Unchanged | Can be bypassed |
| iOS security updates | Install as normal | Often held back to keep the jailbreak |
| Main risk | Untrusted apps, revocations | Weakened system protections, untrusted tweaks |
| Undo | Delete the app | Usually needs a restore |
For a wider look, read sideloading vs jailbreaking.
A Safety Checklist
- Install Scarlet from the official site or a trusted install page, never from a re-upload.
- Add only repositories whose maintainers you can identify.
- Prefer an app’s original project (for example its GitHub Releases page) over a mirror.
- Check IPA files from unknown sources before installing them.
- Do not sign in to banking, email or main social accounts inside tweaked apps.
- Review app permissions in Settings and turn off what an app does not need.
- Keep iOS up to date, and keep copies of the IPA files you rely on in case of a revocation.
- Remove apps you no longer use, and delete their developer profiles in VPN and Device Management if no apps from that developer remain.
Our sideloading security guide goes deeper on each point.
Frequently Asked Questions
Can Scarlet read my messages or photos?
Scarlet runs in the iOS sandbox like any app, so it cannot read other apps’ data. Access to photos and similar data needs your permission through the normal iOS prompts.
Will banking apps work with Scarlet installed?
Scarlet does not jailbreak the device, which is what most banking apps check for. Each bank’s app makes its own checks, so we cannot promise every app behaves the same way.
Can Apple damage my iPhone because I use Scarlet?
No. What Apple does is revoke certificates, which stops the affected apps from opening. It does not affect the rest of your device.
Is it legal to use Scarlet?
Installing an app installer is not the same as using it for pirated software. Installing pirated or cracked paid apps infringes copyright. Laws differ by country, so we cannot give legal advice; use Scarlet for apps you are entitled to use.
How do I remove Scarlet completely?
Delete the Scarlet app and any apps you installed with it, then remove the developer profile in Settings, General, VPN and Device Management if it is still listed. Apple’s article describes the Delete App button on the developer’s page there, which removes all apps from that developer and ends the trust.
Has Scarlet been independently audited?
Not that we could find. There is no published independent audit or public source code, so you are relying on the developer. That is a reason to keep important accounts out of sideloaded apps.
Does Scarlet work on iOS 27?
Scarlet is confirmed on iOS 14 through iOS 26; iOS 27 support is reported by third parties but not officially confirmed.
Want the step-by-step install? Read how to install Scarlet iOS, or start from our install page. More answers are in the complete Scarlet iOS FAQ.
