If you want to check iOS Signing Certificate (P12) instead, please use my online certificate checker. Or, if you wanna check a mobileprovision file, use this Provisioning Profile checker.
What this tool does
The checker above opens an iOS configuration profile, the .mobileconfig file, and shows you exactly what it would do to your device before you install it.
It tells you whether the profile is signed and by whom, whether it can be removed once installed, and then it breaks down every payload inside it in plain language, with a risk flag on the ones that actually matter.
If a payload installs a certificate, sets up a proxy, enrolls the device in management, or filters your traffic, you will see it called out rather than buried in raw XML.
Nothing you upload is kept, and there is no outbound network call at all. The profile is read in memory, taken apart, and discarded the moment the page finishes loading.
I built this because “should I install this profile” is one of the most common and most dangerous questions in the iOS world, and the answer usually requires reading the file, which almost nobody does.
So what is a .mobileconfig file, really?
A configuration profile is a bundle of settings that an iPhone or iPad will apply to itself once you install it.
A single profile can carry many separate pieces, called payloads, and each payload configures one thing: a Wi-Fi network, a VPN, an email account, a set of restrictions, a certificate, a web filter, or full device management. One file, many changes.
That flexibility is the whole point, and it is also the whole risk. The same file format that a company uses to hand out its office Wi-Fi is the file format a scammer uses to slip a trusted certificate onto your device so they can read your encrypted traffic. iOS itself treats profiles carefully for exactly this reason.
When you download one it does not apply immediately. It waits in Settings for you to review and approve it, under General and then VPN and Device Management.
This tool is meant to be the step before that, so you know what you are approving.
Signed, unsigned, and what that actually tells you
A profile can be signed. Signing wraps the profile so a device can see who produced it and confirm the contents were not altered after signing.
The checker detects this and shows “Signed by” with the name on the signing certificate, or “Not signed” if there is no signature at all.
Two honest cautions here, because this is where people get a false sense of safety. First, an unsigned profile can be edited by anyone who touches it, so the contents you see are not guaranteed to be what the author intended.
Second, and more important, a signature tells you who made the profile, not that the profile is harmless.
A signed profile can still install a malicious certificate. The checker shows the embedded signer, but it does not walk the full trust chain up to a certificate Apple trusts, so treat “Signed by” as identity information, not as a safety verdict.
The safety verdict comes from reading the payloads.
Reading the top of the profile
Name and Organization
The display name and the organization the author put on the profile. Useful, but remember anyone can type anything here.
A profile claiming to be from a well known company is not proof it is.Identifier and UUIDThe internal IDs iOS uses to track the profile. If you install a newer profile with the same identifier, it replaces the old one.
Removal
Whether the profile can be removed normally.
Some profiles are marked so they cannot be deleted without a passcode or without going through the management server that installed them.
A profile that fights removal is worth extra suspicion, because making themselves hard to uninstall is exactly what unwanted profiles do.
Payloads
How many separate changes the profile makes. Each one is listed below it with its own risk flag.
The payloads that matter, and why
The checker labels each payload High impact, Worth a look, or Routine. Routine covers things like Wi-Fi, wallpaper, fonts, and mail accounts.
The ones below are the payloads that can genuinely hand someone control of your device or your traffic, and they are the reason to read a profile before installing it.
Root certificate
This installs a certificate authority that your device will then trust. In the wrong hands it is the most dangerous payload of all, because trusting a malicious authority lets whoever controls it silently sit between you and every secure website you visit, reading traffic that should be encrypted.
The checker parses the certificate, shows its name, and throws a red warning when a payload installs a certificate authority.
Mobile Device Management (MDM)
MDM enrollment hands ongoing remote control of the device to a management server. A legitimate one is how a workplace manages company phones.
A malicious one can install apps, apply restrictions, track location, and in some cases wipe the device. If you did not knowingly enroll with an employer or school, an MDM payload is a red flag.
Web content filter
A filter payload can inspect and block web traffic. It has a legitimate use in parental controls and schools, but it also means something is watching what you browse.
Global HTTP proxy
This routes all of the device’s web traffic through a proxy server. Whoever runs that server can see and shape that traffic.
DNS settings and the anti-revoke trick
A DNS payload sets which servers the device uses to look up domain names, which quietly decides where names resolve.
This is worth understanding because of a specific real world use in the sideloading scene. A DNS “anti-revoke” profile points the device at a custom resolver and then forces Apple’s own certificate validation hosts, names like ocsp.apple.com and valid.apple.com, through it so they can be blackholed.
The goal is to stop the device from checking whether a signing certificate has been revoked, which keeps revoked sideloaded apps launching.
If you inspect one of these in the tool you will see the giveaway plainly: a DNS payload whose match domains are a list of Apple validation servers.
It is a neat trick, but understand that it works by blinding your device to revocation across the board, which has its own security cost.
SCEP and ACME enrollment
These automatically enroll the device to receive certificates from a server. Legitimate in managed environments, but they mean the profile can provision trust on your behalf without asking again.
Web clips
A web clip is just a home screen icon that opens a web page. Harmless on its own, but it can be dressed up with a real looking icon and name to impersonate an app, which is a common trick in phishing profiles. The checker now renders the actual icon so you can see what it would look like on your home screen.
Why people get burned by profiles
Almost every profile based attack follows the same shape. You are told to install a profile to unlock a feature, get free data, jailbreak, get a game hack, or fix some problem.
The profile then quietly does something you did not bargain for: installs a certificate authority so traffic can be intercepted, enrolls the device in management, or points DNS somewhere it controls.
Because the profile listed a friendly name and maybe carried a signature, it looked fine. The contents told the real story. Reading them first is the entire defense, and it is what this tool is for.
What happens to your file
A configuration profile can contain real detail about a network or an organization, so here is the honest accounting.
The profile is received, held in memory only, read, and discarded when the request ends. It is not written to disk. It is not saved in any database.
There is no outbound network call whatsoever, which for this tool matters twice over, because it means neither your profile nor any tracking beacon leaves the page while you inspect it.
Frequently asked questions
Is it safe to install a .mobileconfig file?
It depends entirely on what is inside it. A profile that just adds a Wi-Fi network is routine. One that installs a root certificate, sets a proxy, or enrolls the device in management can hand control of your traffic or your device to someone else. Read the payloads first, which is what this tool is for.
Does “Signed by” mean the profile is safe?
No. A signature tells you who produced the profile and that it was not altered afterward. It does not mean the contents are harmless, and this tool does not validate the full trust chain. A signed profile can still install a malicious certificate.
Can a profile read my messages or passwords?
Not directly, but a profile that installs a certificate authority and routes your traffic through a proxy can position someone to intercept traffic that is supposed to be encrypted, which is how sensitive data gets exposed. That combination is the one to watch for.
What is a DNS anti-revoke profile?
It is a profile that sets custom DNS and blackholes Apple’s certificate validation servers so the device stops checking whether signing certificates have been revoked.
It is used to keep revoked sideloaded apps working. The tool shows it clearly, as a DNS payload matching Apple validation domains.
How do I remove a profile I already installed?
On the device, go to Settings, General, then VPN and Device Management, select the profile, and remove it. Some profiles are marked to resist removal and will ask for a passcode or refuse, which this tool flags before you install.
Does this tool install or change anything on my device?
No. It only reads the file and reports what is inside. It never installs the profile, and it makes no network call at all.
Who made this
I am GeoSn0w, and I run iDevice Central. I work in iOS security research, reverse engineering, and responsible disclosure, and I have pulled apart more sketchy configuration profiles than I can count, the kind people are told to install without ever being shown what is inside.
I wrote this tool and this guide so that reading a profile is a thirty second job instead of a terminal session. If you spot something inaccurate, tell me, I would rather fix it than leave it wrong.
