What a MAC address lookup tells you
A MAC address is the 48-bit hardware address of a network interface, written as 12 hexadecimal digits such as 3C:22:FB:9A:10:02. The first half is normally an Organizationally Unique Identifier (OUI) that the IEEE Registration Authority sells to manufacturers, so looking it up tells you who made the Wi-Fi chip or Ethernet port. That is how you identify an unknown device on your router’s client list: a Raspberry Pi prefix, a Hikvision CCTV camera, a Sky UK Q box, a Sonos speaker or an Espressif smart plug.
Remember that the lookup names the maker of the network chip, not always the brand on the box. Many smart-home gadgets use Espressif, Realtek, MediaTek or Murata modules, so a “Tuya” plug often shows up as Espressif, and some laptops show Intel or Liteon rather than Dell or Lenovo. The address also cannot tell you a location or an owner — it never travels beyond your local network.
The IEEE sells three sizes of block. An MA-L (the classic OUI) fixes 24 bits and covers 16.7 million addresses; an MA-M fixes 28 bits (about a million); an MA-S fixes 36 bits (4,096), aimed at small manufacturers. The older 36-bit IAB blocks work like MA-S. This tool always reports the most specific match and names the parent block too.
Randomised and locally administered addresses
The second hex digit of a MAC address carries two flag bits. If it is 2, 6, A or E, the universal/local bit is set: the address was assigned by software rather than burned in at the factory, and no registry can name a manufacturer. Today that almost always means a private Wi-Fi address. iPhones and iPads (iOS 14 onwards), Android 10 onwards, Windows 10 and 11 and recent macOS all generate a different random address for each network to stop shops, stations and public hotspots tracking you between locations.
| Second digit | Meaning |
|---|---|
| 0, 4, 8, C | Universal unicast — a manufacturer-assigned address you can look up |
| 2, 6, A, E | Locally administered unicast — randomised privacy address, VM, container or VPN adapter |
| 1, 3, 5, 7, 9, B, D, F | Group (multicast) address — never a single device |
This matters at home: if your router’s parental controls, DHCP reservations or MAC filtering stop recognising a phone, it is usually because the phone rotated its private address. Either reserve the private address it is using on your network or set the phone to a fixed private address for your home Wi-Fi only. The locally administered bit is also used by virtual machines (QEMU/KVM uses 52:54:00, Docker uses 02:42), which the tool flags separately.
MAC address formats and where you find them
The same address is written differently by different systems, and the tool accepts all of them — including a whole block of pasted command output:
- Colon
3c:22:fb:9a:10:02— Linux, macOS, Android, most routers. macOSarp -adrops leading zeros (0:50:56:c0:0:8); these are padded correctly. - Hyphen
3C-22-FB-9A-10-02— Windowsipconfig /allandarp -a. - Cisco dotted
3c22.fb9a.1002—show mac address-tableandshow arpon Cisco IOS. - Bare
3C22FB9A1002— databases, DHCP servers and some ISP routers.
Paste a Windows ARP table and every address is picked out, looked up and listed with its vendor. Use Convert list to to copy them all in the format your switch, firewall or MAC filter wants, or download a CSV. To work out which IP range those devices sit in, use the subnet calculator; for your public address, see what is my IP address.
Where the data comes from and how current it is
Vendor names come straight from the four public IEEE Registration Authority lists — MA-L, MA-M, MA-S and IAB — which together hold about 58,600 assignments. The date of the copy in use is shown in the tool’s header. The list is compressed into a single file of about 0.6 MB that your browser downloads from this site the first time you use the tool and then caches, so lookups are instant, work for thousands of addresses at once, have no daily limit and never send the addresses you paste to anyone — unlike API-based lookups, which see every MAC you check.
Names appear exactly as registered, which is why you will see both “Raspberry Pi Foundation” and “Raspberry Pi (Trading) Ltd”. A handful of very old OUIs were issued twice and all holders are listed. Blocks marked Private belong to companies that paid the IEEE to keep their name off the public list. Special addresses that are not in the registry — broadcast, IPv4 and IPv6 multicast, spanning tree, LLDP, LACP, 802.1X, VRRP and Cisco HSRP virtual gateways — are recognised from the relevant standards. See more network tools.
Frequently asked questions
Can a MAC address lookup find a person or location?
No. A MAC address identifies a network interface and its manufacturer, nothing more. It is only visible to devices on the same local network or Wi-Fi, because routers replace it at every hop, so websites and people on the internet never see it. The lookup tells you who made the network chip, which helps you identify an unknown device on your own router’s client list.
Why does my phone show a different MAC address on my router?
Modern phones use a private, randomised MAC address for each Wi-Fi network — iPhones call it Private Wi-Fi Address, Android calls it randomised MAC. The randomised address has the locally administered bit set, so its second digit is 2, 6, A or E and no manufacturer can be found. Your router sees the random address, not the phone’s factory one.
Why does my smart plug show a different brand?
The lookup names whoever bought the address block, which is usually the maker of the Wi-Fi module rather than the brand on the packaging. Many smart plugs, bulbs and cameras use modules from Espressif, Realtek, MediaTek, Tuya or Murata, so they appear under those names. Laptops often show Intel or Liteon because those companies made the wireless card.
What is the difference between an OUI, MA-L, MA-M and MA-S?
OUI is the traditional name for the first 24 bits of a MAC address; the IEEE now sells it as an MA-L block covering 16.7 million addresses. MA-M blocks fix 28 bits and cover about a million addresses, and MA-S blocks fix 36 bits and cover 4,096, for smaller manufacturers. The tool reports the most specific block that matches and its full address range.
How do I find the MAC address of my device?
On Windows, run ipconfig /all and read Physical Address. On macOS, hold Option and click the Wi-Fi icon, or run ifconfig en0. On Linux, run ip link. On an iPhone look under Settings, General, About, Wi-Fi Address; on Android under About phone, Status. A router’s connected devices page lists every device’s address, ready to paste here.
Is it safe to use a random MAC address generator?
Yes, provided you generate locally administered addresses, which this tool does by default. They set the local bit so they can never collide with a manufacturer’s real address, which makes them right for virtual machines, containers and test labs. Addresses with a real vendor prefix should only be used on isolated test networks, because they could duplicate a real device.
What does 01:00:5E or 33:33 at the start mean?
Both are multicast addresses, not devices. 01:00:5E is used for IPv4 multicast, carrying the lower 23 bits of the group address — 01:00:5E:00:00:FB is mDNS, used by AirPlay, Chromecast and printers. 33:33 is IPv6 multicast, used by neighbour discovery. FF:FF:FF:FF:FF:FF is the broadcast address that every device on the network receives.