Provisioning profile viewer
Drop a .mobileprovision (iOS, iPadOS, tvOS, watchOS, visionOS) or .provisionprofile (macOS) file to see its app ID, team ID, expiry date with the days left, whether it is a development, ad hoc, App Store or enterprise profile, every entitlement, the device UDIDs and the SHA-1 fingerprints of its certificates. The file is read in your browser and never uploaded. On a Mac, Xcode keeps your profiles in ~/Library/Developer/Xcode/UserData/Provisioning Profiles.
Nothing is uploaded. The file is read by this page, in your browser. Profiles contain your team ID, device UDIDs and certificates, so they should not go to a server.
Drop a .mobileprovision or .provisionprofile file
Or a .entitlements file. Read in your browser only, never uploaded.
How it works
- •A provisioning profile is a CMS (PKCS #7) signed file. The plist inside is stored as plain XML, so the page finds it by locating the bytes from "<?xml" to "</plist>" and parses that slice with its own plist reader. This gives the same XML as `security cms -D -i file.mobileprovision` on a Mac.
- •The profile type comes from four keys, in this order: ProvisionsAllDevices true means Enterprise (or Developer ID on a Mac-only profile). With a ProvisionedDevices list, get-task-allow true means Development and false means Ad Hoc. Without a device list, get-task-allow false or beta-reports-active true means App Store. Mac profiles have no get-task-allow, so there a device list means Development and no list means App Store. Anything else is shown as unknown, with the signals, rather than guessed.
- •Days left are counted from your device's clock to ExpirationDate, in whole days.
- •Certificate fingerprints are the SHA-1 of each DeveloperCertificates entry, computed by your browser's Web Crypto. The certificate name and expiry are read from its subject only when the certificate parses cleanly; otherwise they are left out.
- •A .entitlements file (XML or binary plist) dropped or pasted here is shown as a key and value table.
What it does not do
- •It does not verify Apple's signature on the profile, so it cannot tell a genuine profile from an edited one.
- •It does not check whether your Mac has the private key for a certificate, or whether a device is still registered in your developer account.
- •It does not compare the profile with a built app. To check an app's signed entitlements, use the IPA inspector or `codesign -d --entitlements - MyApp.app`.
- •It cannot renew, edit or re-sign a profile; that happens in Xcode or the Apple Developer website.
Questions
- How do I see what is inside a .mobileprovision file?
- Drop it on this page, or on a Mac run `security cms -D -i file.mobileprovision`, which prints the same XML plist. Xcode 16 and later keep downloaded profiles in ~/Library/Developer/Xcode/UserData/Provisioning Profiles; older versions used ~/Library/MobileDevice/Provisioning Profiles. Inside a built app the profile is the file embedded.mobileprovision.
- How can I tell a development, ad hoc, App Store or enterprise profile apart?
- Look at three keys. ProvisionsAllDevices set to true is an enterprise (In-House) profile. A ProvisionedDevices list with get-task-allow true is development; the same list with get-task-allow false is ad hoc. No device list with get-task-allow false, usually with beta-reports-active true, is App Store distribution, which TestFlight uses too.
- Why does my ad hoc build say it cannot be installed?
- Most often the device's UDID is not in the profile's ProvisionedDevices list, or the profile has expired. Check both here. Add the device in your Apple Developer account, regenerate the profile, and build again: a profile does not pick up new devices on its own.
- What happens when a provisioning profile expires?
- Development and ad hoc builds signed with it stop launching on devices, and so do enterprise apps. Apps already on the App Store are not affected, because Apple re-signs them; you only need a valid distribution profile for your next upload. Development and distribution profiles usually last one year.
- Is it safe to open my profile on this page?
- The file never leaves your browser; there is no upload and no server code for this tool. A profile holds your team ID, device UDIDs and the public part of your certificates, never private keys, but it is still worth keeping off third-party servers.
- Why do I get "entitlement not allowed by the provisioning profile"?
- Your app asks for an entitlement (in its .entitlements file) that the profile does not grant, for example Push Notifications or an App Group the App ID does not have enabled. Paste your .entitlements file here and compare it with the profile's entitlements table, then enable the capability for the App ID and regenerate the profile.