IPA

An .ipa is the packaged, code-signed iOS application you upload to App Store Connect, and despite the extension it is an ordinary zip archive.

Rename one to .zip, unpack it, and you get a Payload directory containing YourApp.app. Inside that bundle sit the compiled binary, Info.plist, asset catalogues, frameworks, a _CodeSignature directory holding the signature, and for anything other than an App Store build an embedded.mobileprovision profile. Reading Info.plist from an .ipa is the fastest way to confirm which version and build number you are actually holding.

The important thing about an .ipa is not its structure but how it was signed. One .xcarchive exports to several different .ipa files depending on distribution method: development, ad hoc, enterprise, or App Store Connect. They contain nearly the same code and are not interchangeable. An ad hoc .ipa installs on your registered devices and is rejected on upload; an App Store .ipa uploads cleanly and will not install directly on a device at all.

That asymmetry produces a common confusion. "It installed fine on my phone" does not mean the package is submittable, because the one you installed was signed for a different purpose.

Apple also strips and re-signs what you send. The binary users download is not byte identical to your upload, which is why local hashes are not a useful comparison.

See also: build, Transporter, TestFlight.