KSign iOS (2026): Install, Certificates & Not Working Fixes

KSign is a free, open-source app that signs and installs IPA files directly on your iPhone — no computer in the loop once it is set up. It was built as a stand-in for ESign after ESign shut down, on top of the code of another signer, Feather. What it does not do is give you the one thing signing needs: a certificate. Every KSign install, every imported app and almost every “KSign not working” thread comes back to that.

Below: who makes KSign and where the real download lives, the three ways to get it onto a phone, where certificates come from and why nothing installs without one, how to sign an IPA step by step, and what each common error means. If you are still choosing between signers, our comparison of Feather, KSign, ESign and Scarlet covers the bigger picture; this page is the KSign manual.

What KSign is, and who makes it

KSign (the project itself writes it “Ksign”) lives on GitHub at Nyasami/Ksign, describes itself as “the cleaner Esign app”, and is licensed under GPL-3.0. Its README is unusually candid about why it exists. ESign had reached end of service, so the developer took Feather as the base and recreated ESign’s interface “as close as possible” so people would not have to relearn anything. The second reason is the important one: the app “was built specifically for Khoindvn to share his certificates”, so more people could sideload without buying a certificate. Khoindvn — a Vietnamese community figure credited in the README as product manager — is the certificate side of the project.

The timeline, from the project’s own releases page:

May 26, 2025 — the repository and the first public release, v1.2.0.
v1.4 (August 2025) — revoke check for certificates, Liquid Glass styling, and an AltStore-format source for KSign itself.
v1.5 (October 2025) — bulk signing, running in the background, a logs tab.
v1.5.1 (December 2025) — support for the old .ksign certificate files was removed.
v1.6 (May 24, 2026) — “optimized for iOS 26”, bulk install, a new idevice installation method, tweak injection into app extensions.

KSign needs iOS 16 or later, according to its own AltStore source. Under the hood it keeps Feather’s pieces — on-device signing through Zsign, AltStore repository support, tweak injection — and adds the ESign-style extras people missed: a file manager with plist and hex editors, a built-in downloader with a browser, and bulk sign and install.

One line in the README deserves to be read twice: the project is maintained and released only on GitHub, it has no website of its own, and sites that host its software “are often malicious”. Whatever site offers you a “KSign download”, it is not the developer’s.

How to install KSign on iPhone

KSign is not in the App Store, so the first install has the same problem every signer has: something has to sign KSign itself. There are three ways people do it.

1. A web page that installs it for you (“direct install”). This is the most common route and the one most “KSign direct install” videos show: a site hands you KSign already signed with a shared certificate, usually together with a DNS profile. No computer, a minute of your time. When the maintainer was asked whether KSign needs a computer, his answer was no — you can install it “using online signers using the ipa in releases”. The safe version of that advice is exactly what it says: take the IPA from the official Releases page yourself rather than from a mirror. The catch is the one that runs through this whole article: KSign then lives on someone else’s certificate, and when that certificate is revoked, KSign stops opening along with everything you signed in it.

2. With a computer and your own Apple ID. Download Ksign.ipa from Releases and install it with a computer-based tool such as Sideloadly or AltStore. It is signed by you, but a free Apple ID signature lasts seven days, so this route means refreshing (how the free tools compare).

3. From another signer. If you already run Feather, SideStore or another app that reads AltStore sources, add KSign’s own source — https://raw.githubusercontent.com/Nyasami/Ksign/refs/heads/main/repo.json — and install it from there.

Then trust it. If KSign was signed with an enterprise certificate, iOS will not open it until you go to Settings → General → VPN & Device Management, tap the developer’s name and tap Trust (on iOS 18 and later the button reads Allow & Restart). Apple’s own instructions add one detail that matters later: the phone needs an internet connection to verify the certificate, and if it cannot reach Apple, the app shows as Not Verified. If you signed KSign with a development certificate instead, iOS asks you to turn on Developer Mode (Settings → Privacy & Security), which takes a restart.

Certificates: why KSign does nothing without one

A signer is a wrapper around one step: it takes an IPA, applies a code-signing identity, and hands the result to iOS. The identity is two files:

a .p12 — the signing certificate with its private key, usually protected by a password;
a .mobileprovision — the provisioning profile that says which devices and capabilities the signature covers.

In KSign you add them under Settings → Certificates → New Certificate: Import Certificate File for the .p12, Import Provisioning File for the profile, then the password (leave it blank if there is none). A wrong password gets a Bad Password alert. Since v1.4 KSign checks whether a certificate has been revoked and marks it with a red Revoked pill — check that list first whenever something stops working.

If an older guide tells you to tap a .ksign file to import a certificate, that format is gone: v1.5.1 removed support for it. Import the .p12 and .mobileprovision pair instead.

Where the pair comes from is the real decision, and there are three answers:

A shared certificate — the free one circulating in the KSign community. It is what KSign was built around, and it is also the arrangement that ends abruptly: one identity used by a crowd of strangers is precisely what Apple revokes, and when it goes, every app signed with it stops at once.
A paid certificate — bought from a seller for your device. More stable, but you are trusting the seller to still exist after the next revoke wave. The same community that shares free certificates sells paid ones, so be careful who you pay — and never hand over your Apple ID password; signing needs a certificate and your device’s UDID, nothing more.
Your own Apple Developer account — $99 a year, a certificate nobody else uses. The sturdiest option, and the one almost nobody takes for a handful of apps.

The DNS profile that comes with most shared certificates deserves one honest sentence: it blocks the phone’s check of the certificate with Apple, so a revoked certificate keeps launching apps that are already installed. It does not un-revoke anything, and new installs still fail. The full trade-off is in our eSign explainer, which applies to KSign word for word.

How to sign and install an IPA in KSign

With a working certificate imported, the flow is short:

Import the app. In the Library tab, tap the import menu and choose Import from Files or Import from URL. You can also fetch an IPA with KSign’s built-in downloader or from an AltStore-format source.
Sign it. Open the app in the Library and tap Sign. Pick the certificate, and adjust the signing options if you need to — app name, bundle ID, icon, or tweaks to inject (.deb, .dylib and, since v1.6, .bundle). For several apps at once, select them and use bulk signing.
Install it. Tap Install. The app appears on the Home Screen like any other.

How the install step actually reaches iOS is set in Settings → Installation, and it matters for troubleshooting:

Server (the default) runs a small web server inside KSign and installs through Apple’s itms-services mechanism. It has two sub-modes, Fully Local and Semi Local.
idevice (advanced, added in v1.6) talks to the phone’s installer directly, the way a computer would. It needs a pairing file, made once on a computer, and a loopback VPN such as LocalDevVPN from the App Store. KSign’s own description calls it very reliable, because it needs no SSL certificates and no outside server.

Sid at a desk stamping a stack of papers with a rubber stamp

KSign not working: what each error means

Most KSign problems are certificate problems wearing different error messages. The rest come down to the install method or a badly packaged IPA. In order of how often they come up:

“Unable to Verify App” — on KSign and every app at once. This is a revoked certificate, not a bug. The pattern in KSign’s issue tracker is always the same: everything works for a few days, then KSign and all the apps signed in it stop opening together — one report on iOS 26.4.2 describes exactly that after about three days, with reinstalling the DNS profile and the app changing nothing. Project volunteers close these reports as duplicates and ask people not to open GitHub issues “just to beg for enterprise certificates”. Nothing inside KSign can fix it: you need a certificate that is not revoked, and then you re-sign everything. What the error means case by case is in unable to verify app on iPhone.

“This app cannot be installed because its integrity could not be verified.” iOS rejected the signature at install time. When it happens to KSign itself, the certificate the installing site used is usually already dead. When it happens to apps you sign, first update KSign (v1.3 fixed a bug that produced exactly this error), then check the certificate’s status, then try signing again with another certificate.

Install does nothing or fails — since September 2026. This one is new and not your fault. KSign’s Fully Local mode relied on backloop.dev, a free service that provided a trusted SSL certificate for localhost. Its operator shut it down on September 4, 2026 after every certificate it published had been revoked. A user reported on September 30 that Fully Local no longer works; the maintainer replied he is working on an alternative and, in the meantime, suggested switching to Semi Local (Settings → Installation). The idevice method avoids the problem entirely, at the cost of the one-time pairing file.

“Whoops!, something went wrong when extracting the file.” The IPA did not unpack. Go to Settings → Archive & Extraction and switch the extraction library (KSign offers two). If that fails too, the IPA itself is badly packed — one user found his had been zipped as a folder instead of as the Payload folder inside it. Very large games (2 GB and up) had their own extraction bug, fixed in v1.4.1.

The app shows as “expired” right after signing. Reported on October 10, 2026 and still open in the tracker, so there is no official fix yet. Before anything else, open Settings → Certificates and check the expiry date and status of the certificate you used — an expired or revoked certificate produces an expired app.

iOS asks for Developer Mode. Not an error: your certificate is a development one. Turn Developer Mode on in Settings → Privacy & Security and restart. Enterprise certificates do not need it.

KSign vs Feather vs ESign, briefly

They are closer relatives than the names suggest.

ESign is the original. It reached end of service in 2025, and what carries the name today is a mix of rebuilds and certificate sellers — the details are in our eSign breakdown.
KSign is ESign’s interface rebuilt on Feather’s code, with the extras ESign users expect (file manager, downloader, bulk actions) and a community that shares certificates. It has around 700 stars on GitHub.
Feather is the base: an open-source signer “meant for developer certificates”, with about 4,800 stars, no analytics, AltStore source support and tweak injection. It is the cleaner tool if you have a certificate you trust; it does nothing at all if you do not.

Feather

on-device signer · AltStore sources · bring your own certificate

GET

Feather is in our catalog, so you can install the signer itself from Safari without a certificate of your own. Signing other IPAs inside it still needs your .p12 and profile — that part is the same for every tool on this page.

The no-certificate option

Every route above ends at the same question: whose certificate is it, and what happens to your apps the day it goes? builds.io is the version where that question is not yours. There is no signer to install and nothing to import — signing happens on our side, scoped to your device, and you install apps from the catalog in Safari.

One tap, no computer, no p12, no DNS profile, no pairing file.
No 7-day refresh and no three-app limit.
On Premium, revokes are covered: if a certificate goes down, a new one is issued and your apps come back.

It is a subscription, so the honest trade is money for time. One expectation to set: when you first add a device, Apple processes it before apps go live. Most devices are ready within a day; some take up to three days. It is normal and it happens once.

Apps people commonly sideload this way are already in the catalog:

YouTube Plus (ex. YTLite)

no ads · background play · downloads

GET

iPoGo

Pokémon GO with spoofing and automation

GET

KSign FAQ

Is KSign free? Yes. The app is free and open source under GPL-3.0. The certificate is a separate question: shared ones cost nothing, paid ones cost whatever the seller charges, and your own developer account is $99 a year.

Is KSign safe? The code is public on GitHub, which is more than most signers can say. The risks sit around it: copies from unofficial download sites (the developer warns against them himself), a DNS profile that routes your phone’s lookups through someone else’s server, and anyone asking for your Apple ID password.

Does KSign work on iOS 26? Yes — v1.6 was released as optimized for iOS 26, and the app supports iOS 16 and later. Whether your apps keep opening depends on the certificate, not on the iOS version.

Can I install KSign without a computer? Yes, through a site that signs it for you — with the shared-certificate caveat above. To stop depending on any certificate at all, install the apps you want from builds.io instead.