pkpass Analyzer — Apple Wallet Pass Inspector

⚠️

Educational Use Only This tool demonstrates pkpass phishing detection for educational purposes. Do not upload passes containing real booking references, PNR codes, or loyalty account numbers from production travel environments.

🎫

Drop a .pkpass file here

Click to browse · .pkpass files only

Report

Drop a .pkpass file above and click Analyze Pass to generate a full security report…

Test File · Clean

sample_legitimate.pkpass

Synthetic United Airlines boarding pass. All fields match expected legitimate issuer patterns. Tool should report CLEAN.

↓ Download

Test File · Malicious

sample_malicious.pkpass

Synthetic phishing pass with suspicious .top TLD webServiceURL, short authenticationToken, and urgency language. Tool should report CRITICAL.

↓ Download

Attack Layer 01

The Email — Trusted Delivery

A phishing email arrives with a convincing .pkpass attachment — a fake boarding pass, hotel key, or event ticket. It adds directly to Apple Wallet without triggering email security controls. The familiar Wallet UI builds trust.

Attack Layer 02

The webServiceURL — Hidden Channel

Once in your Wallet, the pass silently polls its webServiceURL for updates — sending your device push token and IP address to attacker infrastructure on a schedule. This channel persists after your trip ends until the pass is deleted.

Attack Layer 03

The Phishing Link — Credential Harvest

The email also contains a "manage your booking" link pointing to a fake login page. The legitimate-looking pass makes the victim trust the email, increasing the chance they click the link and enter their credentials.

The webServiceURL is invisible to you in Wallet. You cannot see it in the Wallet UI — only the pass designer can see it in pass.json. This tool makes it visible and checks it against known suspicious patterns. A malicious pass from a phishing campaign will have this field pointing to attacker infrastructure while the pass itself looks like a completely normal boarding pass.

What This Tool Checks

Field	Risk	What to Look For
webServiceURL	CRITICAL	Must match the organization's own domain. Freemail, suspicious TLD (.top .xyz .click), or no HTTPS = malicious.
authenticationToken	HIGH	Should be a high-entropy random string of 16+ characters. Short or predictable tokens indicate a fake pass.
passTypeIdentifier	MEDIUM	Format: pass.com.domain.name — the domain should match the organization.
organizationName	MEDIUM	Urgency language ("Verify", "Confirm", "Security") in the org name is a red flag.
Archive contents	MEDIUM	A legitimate pkpass contains only JSON, PNG images, and a signature file. Unexpected file types are suspicious.

How to Stay Safe

Only add pkpass files from emails you expected — a booking confirmation you initiated, an event ticket you purchased. Unsolicited passes are suspicious regardless of how convincing they look.
Check the sender's email domain before opening any attachment. A boarding pass from noreply@united.com is expected. One from support@booking-verify.top is not.
Remove old passes from Apple Wallet after every trip. A malicious pass continues polling its webServiceURL indefinitely until deleted. Open Wallet, swipe left on the pass, tap Remove.
If you received an unexpected pass and added it, delete it immediately and check your push notification settings for unusual apps.
For security teams: the companion Sublime Security detection rule for pkpass phishing is available at gist.github.com/yana-ivanov.