Are profile entitlements the same as app entitlements?
No. Profile entitlements form an allowlist. An app claims its own entitlements in its code signature, and those claims must be compatible with the profile.
.mobileprovision Inspector
Decode Apple provisioning profiles from CMS/PKCS#7 to plist. Inspect App ID, team, platform, dates, device scope, entitlements, and embedded developer certificates.
Inspect an Apple provisioning profile
The CMS container, embedded plist, entitlements, device identifiers, and certificates are decoded in a browser worker. No Apple service or profile URL is contacted.
Choose a .mobileprovision, provisioningprofile, CMS, or DER file.
Provisioning profile details
Profile identity, validity, device scope, entitlements, developer certificates, and CMS/plist layers will appear here.
Open every provisioning-profile layer in one workflow
DecodeLens unwraps the CMS SignedData container, reads the embedded XML plist, summarizes identity and device scope, flattens nested entitlements for search, and inspects DeveloperCertificates without uploading the profile.
Inspection and policy boundaries
- Provisioning profiles are decoded locally; Apple account, device, certificate, OCSP, and revocation services are never contacted.
- Profile type is inferred from ProvisionedDevices, ProvisionsAllDevices, get-task-allow, and beta-reports-active rather than asserted as an Apple verdict.
- The entitlement list authorizes possible app claims; it does not prove what an app binary actually claims.
- CMS content-digest consistency is distinct from CMS signature verification and Apple certificate trust.
- Device identifiers are masked in the UI by default, but revealing them makes the original values visible on screen.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- PKI & certificates
PKCS#7 / CMS Inspector
Inspect CMS and PKCS#7 content types, SignedData certificates and signers, EnvelopedData recipients, digest metadata, embedded content, and ASN.1 offsets.
Open tool - Security & identity
X.509 / PEM Certificate Decoder & Inspector
Inspect PEM or DER certificates, identity, validity, algorithms, SANs, extensions, fingerprints, and chain signatures.
Open tool - Binary analysis
ASN.1 DER / BER Decoder
Decode DER, BER, Base64, hex, or binary files into an offset-aware ASN.1 TLV tree with OID names and canonical DER diagnostics.
Open tool - PKI & certificates
CRL Decoder & Inspector
Decode X.509 CRLs, inspect update windows and extensions, search revoked serial numbers, and optionally verify the signature with an issuer certificate.
Open tool
Inspect a development profile before signing
Load the .mobileprovision file, check its App ID, Team ID and expiration, search the entitlement allowlist, then review device scope and developer certificate dates.
Provisioning profile
.mobileprovision → CMS SignedData → XML plistInspection result
Development · iOS · 2 devices
App ID: ABCDE12345.com.example.app
Entitlements and certificates available.mobileprovision Inspector FAQ
Why are device identifiers hidden?
ProvisionedDevices contains hardware identifiers associated with registered devices. DecodeLens masks them by default to reduce accidental disclosure during screen sharing or screenshots.
Does a valid date range mean the profile can install an app?
No. Installation also depends on signing identity, certificate trust and revocation, App ID and entitlement compatibility, device scope, platform policy, and the actual app signature.