Three days late, only one threshold to add: how UnfairPlay got 960 stars the week FairPlay was cracked

2026 Oct 25 early morning 1:15 (UTC), security researcher Jurre van Bergen (on X: DrWhax) posted: add a new Apple ID on macOS 27.0.1 and you can decrypt iOS IPAs on a Mac, "No jailbreak needed." The post got 178k views and 1.4K bookmarks. He didn't invent offline FairPlay decryption; an early mover had open-sourced it three days earlier. What he added was one piece: no jailbroken iPhone required. 12 days later, his repo unfairplay had 961 stars and 176 forks (GitHub, 11-06). Below: which barrier it removed, where the stars came from, what's worth copying, and why I don't recommend building another tool like this.

First, what it is

iOS apps downloaded from the App Store are encrypted (Apple's DRM is called FairPlay). To reverse-engineer them, do security research, or run them on a Mac via PlayCover, you first have to decrypt them, which the community calls "cracking the shell." Previously that required a jailbroken iPhone, and iOS 26 and 27 had essentially no public jailbreak.

UnfairPlay is a Go command-line tool. You sign into the Mac App Store on an Apple-silicon Mac, install an iPhone app, open it once, then download the matching encrypted IPA under the same account, and run unfairplay setup once. It recovers an "enrollment model" from this Mac's FairPlay state. After that, any IPA downloaded under that account can be decrypted offline with unfairplay decrypt. The exported model also works on Linux.

It deliberately does only one thing: no Apple sign-in, no purchases, no IPA downloads. Downloading is delegated to ipatool, an older tool with 12,000 stars. The README opens with a long note that it's "only for apps you legally obtained," and has a --strip-account-data flag that removes the Apple ID from the output. Another command, convert-ipa-macos, converts an iOS IPA into a layout the Mac can install, so iOS apps the developer never released for Mac can run there.

It's the third move in a wave of events

Who "requested" it isn't stated publicly. The repo's NOTICE says the code comes from ipatool and DrWhax's own research fork. My guess is that the ipatool author didn't want decryption in the main project, so it was split into a separate tool. Unverified.

Which days the stars came in

(GitHub daily stars; 11-06 repo page live 961)

The curve is typical: most stars in the first four days after launch, then ten to twenty a day, with a jump only when a notable person demoed it. Forks are about 19% of stars, very high for repos of this age. Two reasons: the README only gives source build steps, so you have to clone and compile it yourself; and in the same week a batch of wrapper projects appeared, all forked from it.

The early mover fairplay-decrypt now has 2,363 stars; unfairplay is roughly 40% of that. The breakthrough itself drew more attention than the barrier-removal did.

Where users come from

1. The author's own post. The launch post with 178k views; a same-night post linking the repo caught the traffic. DrWhax is someone who researches spyware at Amnesty's security lab and has had posts reach the HN front page before, so saying "this works" in security circles carries weight. A reply with 7,700 views in the comments worried: "The only thing Apple can really do is track down people using ipatool and ban them."
2. Jailbreak and sideloading communities. ONE Jailbreak blog, r/onejailbreak, r/jailbreak, and r/sideloaded all cite each other, plus tutorials on YouTube Shorts and Instagram Reels.
3. The Chinese decryption community. The "iOS宝藏" X and Telegram channels, accounts reposting the unfairplay-bot, the Chinese trendshift page, and DKFile's new-repo chart at #31. The demand comes from people running mobile games on Mac via PlayCover who need decrypted packages.
4. GitHub aggregator site. When Early Signal 10-27 was logged, it was gaining 297 stars a day. GitHub's official trending skips repos under two months old, so it wasn't trending that drove the growth.
5. Wrapper projects linking back. The Telegram bot missuo/unfairplay-bot (118 stars), the ipaDown-for-Mac GUI, a Swift package, and a Rust rewrite all point their READMEs back to it.

No HN thread of its own turned up, and no coverage from The Verge, 9to5Mac or any other mainstream tech outlet.

Why this one

1. Timing. From 10-22 to 10-25, offline FairPlay cracking was just becoming a hot topic. Early movers had raised awareness but stalled on "you need a jailbroken device," and many viewers after the demo found they couldn't use it. UnfairPlay arrived three days later and caught exactly those people.
2. The barrier dropped to "you need a Mac". Its target audience, reverse engineers, security researchers, PlayCover users, and sideloaders, nearly all have an Apple-silicon Mac.
3. Engine only. No sign-in, no downloads, a clean CLI with JSON output. It's easy for others to build bots and GUIs on top, and every wrapper sends stars back.
4. Framing that makes it safe to share. "Only for legally obtained apps," the flag that strips account info, and positioning around "interoperability, archiving, authorized research" let media and intermediaries repost with confidence.

So be clear about this: it didn't invent offline decryption; it made it usable by everyone in the same week. The author's built-in traffic and credibility meant people believed it from day one.

How many people know about it

It's hot within small circles. The jailbreak, sideloading, iOS reverse-engineering, and Chinese decryption communities have mostly all picked it up, and there's a RuntimeWire write-up; developers outside those circles mostly haven't heard of it. Copycats have started: beyond the wrappers above, there's a string of UnfairPlayKit, multIPA, ipa-dlp, ios-app-decrypter, and others.

If it were you

Verdict: C. The approach of "skip the first-mover spot, remove the biggest barrier early movers left" is worth copying, but building another FairPlay decryption tool isn't worth it. The core requires deep reverse-engineering skill, and the author's security-community credibility can't be borrowed. Heat has already dropped to a dozen stars a day, and repos with the same title are appearing at seven or eight a week. Apple changing the format, banning accounts, or filing a DMCA could kill the whole direction overnight.

Who it suits: people doing iOS reverse engineering and security research; developers who know the jailbreak and sideloading communities and where those users get stuck.

Who it doesn't suit: anyone hoping to collect stars with "I also built a decryption tool." The stars here came from technical credibility and timing, and you control neither. People uncomfortable with legal risk should stay away too: DRM circumvention is a legal gray area in many places, and the repo could be taken down at any time.

How to do it, ranked by how worthwhile:

1. Use the same approach in a different domain. Watch a circle you know well for the next "X got cracked" or "Y got open-sourced" technical event. Early movers usually only prove it can be done, leaving one big barrier in place: special hardware, a jailbreak, a GPU, Linux-only support. Within three days of the topic taking off, remove that barrier and ship. The groundwork can start now: list the barriers you could realistically remove.
2. Build a layer on top of unfairplay. It deliberately skips downloads and UI, leaving room for: one-click GUIs, web or Telegram bots, integration with PlayCover, batch processing. unfairplay-bot reached 118 stars in a week, which is probably the ceiling for this layer. Almost no technical gamble here, but the window is short and others are doing it too.
3. Write up "how to run iOS apps the developer never released on Mac". Kishan's demo shows this is a second, bigger demand, and apps like Netflix need separate patches. Compile which apps run, which need patches, and how to patch them into a compatibility-list repo. It's easy to bookmark, and it doesn't touch decryption itself.

How to get users: copy its sequence. First post a demo with visible results on X (a screenshot or screen recording) with one line saying "it used to require X, now it doesn't," and link the repo only when people ask. Then post in the relevant communities (here, r/jailbreak, r/sideloaded, jailbreak blogs, Chinese Telegram channels). Finally, make it an engine with machine-readable output so others build on it; every wrapper becomes a backlink.

When to act, before: item 1 has no deadline; watch for when the next hot topic arrives, and the key is moving within three days of it taking off. Items 2 and 3 need to happen within November; my estimate is that in two or three more weeks, this wave's heat will be left only with long-time users.

What it means if we got it wrong: ① If Apple doesn't change the FairPlay format for a month or two and there are no mass bans, and unfairplay's stars climb back to hundreds a day, the demand lasts longer than estimated here, and building an upper-layer tool (item 2) deserves more serious investment; ② If a wrapper project overtakes unfairplay itself in stars, then in this circle "easy to use" is worth more than "technical", and item 2 should move to first place; ③ If the repo gets DMCA'd quickly, this kind of topic has to be borrowed from a different field, and items 2 and 3 should be dropped too.

Data and sources

GitHub: DrWhax/unfairplay repo page, README, NOTICE, daily stars (10-27 to 11-06); stars for similar repos fairplay-decrypt, FairPlayed, ipadecrypt, ipatool (11-06). X: two posts by DrWhax (10-25; 178k and 20k views) and replies, a post by Stevie Graham 10-23, a demo post by Kishan Bagaria 11-02. Coverage: onejailbreak.com (10-26), tutoriel-iphone.fr, earlysignal.news (10-27), runtimewire.com (11-03). Anything marked "inferred" or "unverified" is inferred or unverified.