UDID Tools Website

The official UDID Tools marketing website and free Safari-based utility for retrieving an iPhone or iPad UDID. It is also a public integration example for @udid-tools/core and @udid-tools/device-info.

What UDID Tools does

UDID Tools retrieves the Unique Device Identifier of an iPhone or iPad directly in Safari. The public flow does not require an account, Apple ID, payment, desktop computer, USB cable, iTunes, Xcode, or an app installation.

1. Open udid.tools in Safari on the device to identify.
2. Allow the configuration-profile download.
3. Review and install the profile in iOS or iPadOS Settings.
4. Return to the result page and copy the identifier provided by iOS.

The profile requests the documented device-attribute categories used by Apple's Profile Service flow. The website is not an MDM server and does not enroll the device in remote management.

Privacy model

The application is designed to process device information only to complete the requested flow and display the result, without creating an account or persisting a server-side UDID record. The iOS response is encrypted into a versioned bearer token carried in the result-page URL, so that URL should be treated as sensitive and shared only with an intended recipient.

Public informational pages use privacy-limited Vercel Web Analytics and Speed Insights. Sentry is configured without request bodies, default personal information, or Session Replay, and monitoring filters remove device identifiers, result tokens, and URL query strings. Hosting and operational logging caveats are documented in the Privacy Policy.

Canonical guides

• How to find an iPhone or iPad UDID
• How to get an iPhone UDID without iTunes or a computer
• What an iPhone UDID is and why developers need it
• Whether it is safe to share a UDID
• When app testing and provisioning need a UDID
• UDID compared with serial number, IMEI, and MEID

Local development

Use Node.js 22.14.0 or newer and the npm version declared in package.json.

npm ci --ignore-scripts --no-audit --no-fund
cp .env.example .env.local
npm run dev

Local development defaults to unsigned configuration profiles and development-only cryptographic keys. Production and preview deployments must configure their own signing, response-verification, challenge, and result-token secrets.

Run the full quality gate before proposing a change:

npm run verify
npm audit --audit-level=high
npm audit signatures

Release integrity

Releases contain the exact archived .vercel/output directory deployed to production, its checksum, CycloneDX SBOM, and portable Sigstore attestation bundles. Verify a downloaded artifact with:

gh attestation verify website-v1.0.0.vercel-output.tar.gz --repo udid-tools/website
sha256sum --check website-v1.0.0.vercel-output.tar.gz.sha256

Production deployment rebuilds nothing: Vercel receives the verified release artifact through vercel deploy --prebuilt. The release build also embeds its validated signed tag and exact commit SHA in that artifact. The footer links the tag to the corresponding GitHub Release and the full SHA to the immutable commit; preview builds show only their commit, while local builds make no deployment-source claim.

Security

Never report a vulnerability or share a real device identifier, result link, profile response, certificate, private key, or passphrase in a public issue. Use private vulnerability reporting.

License

MIT © UDID Tools contributors.