Finding apps and IPA files
A source-first approach to developer releases, AltStore sources, mirrors, modified apps, and encrypted packages.
The safest useful rule is simple: move as little distance from the original developer as possible.
Preferred sources
- App Store, TestFlight, official alternative marketplace, or the developer's website.
- The developer's verified source repository and Releases page.
- A documented AltStore/Feather source owned by the developer.
- A reproducible community build with source, workflow, release notes, and hashes.
- A known mirror that preserves provenance and checksums.
An aggregator can improve discovery, but it does not inherit the trust of every upstream project. Follow the item back to its maintainer before installing.
Verify repository identity
- Compare the repository owner with links from the developer's site.
- Check history, signed tags/releases, contributors, and recent security reports.
- Beware of a one-letter account-name change or a repository created only to host binaries.
- Prefer release assets produced by visible CI workflows.
- Compare SHA-256 when the maintainer publishes one.
Modified applications
A modified social, video, game, or messaging client includes code not reviewed by the original developer. Determine who created the modification, what was injected, whether source exists, and which accounts or data will enter the app.
Do not use an unofficial build for a password manager, bank, primary authenticator, enterprise identity, or irreplaceable account.
Paid and App Store apps
The ability to sign software does not grant a license to obtain or distribute it. Support developers through their authorized channel. This guide does not link to piracy repositories or certificate dumps.
Repositories inside signing apps
AltStore-compatible source files are catalogues of metadata and download URLs. Adding a source does not install every app, but it gives the source operator a route to offer future updates. Review ownership and update URLs, not only the initial app.
A hash proves sameness, not safety
A matching hash proves you received the same bytes the publisher named. It does not prove the publisher or software is trustworthy. It is one link in the provenance chain.