Once you decide you want apps on your iPhone that aren't coming from the App Store — a tweaked app, an emulator, a homebrew tool, or just an IPA a developer sent you directly — you'll run into four names over and over: TrollStore, AltStore, Sideloadly, and certificate-based signing services like CocoCloud. None of these are jailbreaks. All of them get an unsigned or third-party IPA running on your device. But they solve the problem in very different ways, with very different tradeoffs. Here's how they actually compare.

The Core Problem They All Solve

iOS will only run apps that carry a valid Apple code signature. The App Store handles that automatically. Everything outside the App Store needs to get signed some other way — and that signature typically has an expiration date. The four approaches below differ mainly in whose signature they use, and how long it lasts.

1. Certificate-Based Signing (Developer & Enterprise Certs)

This is the approach behind services like CocoCloud: an IPA is signed with a real Apple Developer or Enterprise distribution certificate, then installed over-the-air. No jailbreak, no on-device exploit, no computer required at install time.

• Lifespan: Tied to the certificate. A paid Apple Developer certificate is valid for a year; a free personal-team certificate lasts about 7 days; shared enterprise certificates last until Apple revokes them.
• Compatibility: Works on essentially any iOS version and any device, current or old — there's no exploit to go stale.
• Trade-off: When a certificate gets revoked, every app signed with it stops opening until it's re-signed with a fresh one. This is why re-signing tools and platforms exist in the first place.

2. AltStore

AltStore takes a different angle: it uses your own free Apple ID, via a companion desktop app (AltServer) or, in the newer AltStore PAL/AltStore Classic setups, a device-based pairing. It automatically re-signs and refreshes your sideloaded apps roughly every 7 days, before the free-tier certificate expires.

• Lifespan: Indefinite, as long as AltServer or the on-device refresh runs periodically to re-sign before expiry.
• Compatibility: Broad — works across current iOS versions since it relies on Apple's normal free-developer-account signing, not an exploit.
• Trade-off: Needs that periodic refresh (historically a desktop app on the same Wi-Fi network, though wireless/standalone refresh options have matured over time). Miss a refresh window and apps stop launching until the next one.

3. Sideloadly

Sideloadly is a desktop tool (Windows/Mac) that signs and installs an IPA onto a plugged-in device using your Apple ID, similar in spirit to Xcode's "run on device" but without needing Xcode.

• Lifespan: Same 7-day free-account limit as any personal-team signed app, unless you supply a paid developer account.
• Compatibility: Broad, current-iOS-version friendly — it's just using Apple's official signing APIs under the hood.
• Trade-off: It's a one-time desktop install, not a background refresh service — you re-run it manually every time an app's signature is about to lapse (or on top of it, unless you script that yourself).

4. TrollStore

We covered TrollStore in detail in an earlier post. It's the outlier here: instead of using a real, expiring Apple signature, it exploits a bug in Apple's CoreTrust signing checks to make an install permanent. No re-signing, ever, on a supported device.

• Lifespan: Effectively permanent once installed, across most iOS updates on the same major version.
• Compatibility: Narrow and shifting — only specific chip/iOS combinations are exploitable at any given time, and that list changes as Apple patches bugs and new ones surface.
• Trade-off: If your device and iOS version aren't in the current supported window, it simply isn't an option, full stop — there's no fallback tier the way there is with certificate signing.

Side by Side

So Which One Should You Use?

If your device is in TrollStore's current supported range, it's hard to beat — permanent installs with zero maintenance. If it isn't (which, for most people on a recent device and iOS version, is the common case), certificate-based signing and AltStore both cover you broadly; the difference comes down to whether you'd rather manage a certificate through a signing service or run a periodic refresh yourself. Sideloadly is the right pick for a one-off install where you don't need it to renew automatically.

For everything outside TrollStore's exploit window, that's exactly the gap CocoCloud's signing tools are built to fill — upload an IPA, sign it against a current certificate, and install straight to your device without touching a computer.