MAC address lookup

How this tool works

Enter a MAC address and the tool tells you who manufactured the network interface. It is free and runs on a locally stored copy of the IEEE registry, so it needs no account and makes no external request when you search.

A MAC address is 48 bits long and conventionally written as 6 pairs of hexadecimal digits. The first 3 pairs are the OUI, a prefix the IEEE assigns to a manufacturer; the last 3 pairs are chosen by that manufacturer to make each interface unique. The tool strips whatever separators you used, keeps the hexadecimal digits, and looks up the first 6 of them in the registry. It then shows the registered organization and the postal address the organization gave the IEEE.

Two bits in the first byte carry extra meaning, and the tool decodes both. The lowest bit says whether the address is unicast (0) or multicast (1). The second-lowest bit says whether the address is universally administered (0), meaning it came from a manufacturer's block, or locally administered (1), meaning software set it. Both flags are shown with every result, because they often explain why a lookup finds no vendor.

The registry is refreshed by a scheduled job that downloads the current OUI file from the IEEE and replaces the local table. You can enter a full 12-digit address or only the first 6 digits; the result is the same, since only the prefix is looked up.

How to read the result

Vendor and address. The organization that holds the prefix and the address it registered. For large manufacturers the name may be a subsidiary or a regional entity rather than the brand on the device, and devices built by contract manufacturers carry the contract manufacturer's prefix.

Formatted MAC and prefix. The address normalized to colon-separated pairs and the prefix the lookup used. If you typed fewer than 12 digits, the formatted address is padded; only the prefix matters.

Locally administered: yes. The address was set by software. On a phone or laptop this almost always means Wi-Fi address randomization, a privacy feature that is on by default in current versions of iOS, Android, Windows and macOS. Such an address will have no vendor, and it changes per network or over time. On a server it means a virtual machine, a container, a bonded interface or an administrator-set address.

Multicast: yes. The address is a group destination, not a device. You will see these in packet captures and switch tables; they never identify a specific interface.

No vendor found, not locally administered. The prefix is not in the public registry. Possible reasons: a prefix from a smaller IEEE block that the tool does not import, an unregistered prefix used by a low-cost or counterfeit device, or a typo.

What to do with the result

Identify an unknown device on your network

1. In the router's admin page, open the list of connected devices or DHCP leases and copy the MAC of the entry you do not recognize.
2. Look it up here. A vendor name narrows it down quickly: a television maker, a smart plug brand, a phone manufacturer.
3. If the address is locally administered with no vendor, it is most likely a phone or laptop with a randomized address. Check each household device's Wi-Fi settings for the "private address" or "random hardware address" option to confirm.
4. If you still cannot place the device, change the Wi-Fi password and reconnect only the devices you know. Anything that disappears was unauthorized or forgotten.

Find the MAC address of your own device

1. Windows: ipconfig /all in Command Prompt. The Physical Address line under each adapter is the MAC. PowerShell: Get-NetAdapter.
2. macOS: System Settings, Network, select the interface, Details, Hardware. Or ifconfig en0 | grep ether in Terminal.
3. Linux: ip link lists every interface with its link/ether address.
4. Android: Settings, About phone, Status, or the Wi-Fi network's details page, which also shows whether a randomized address is in use for that network.
5. iOS: Settings, General, About, Wi-Fi Address. The per-network private address is shown in the network's details under Wi-Fi.
6. Routers and smart devices: usually on a label on the underside, next to the serial number.

Decide whether to disable MAC randomization

Randomization protects you from being tracked between networks by anyone collecting addresses, such as a shopping mall's Wi-Fi analytics. Keep it on in general. Turn it off for a specific network only when that network relies on the address, for example a home router with a static DHCP lease or a parental-control rule, or a corporate or campus network that registers devices by MAC.

What a MAC address can and cannot tell you

The address identifies the interface to the local network segment only. When your device sends traffic to the internet, the router replaces the frame's source MAC with its own on each hop, so no website, server or service beyond your local network ever sees your device's MAC. Websites identify you by your IP address, cookies and browser fingerprint instead, and those are what the privacy tools on this site test.

What the registry gives is the manufacturer, and from that, often, the kind of device. It gives no serial number, no model, no owner and no location. Two devices from the same vendor are indistinguishable by prefix. And an address that was changed in software, whether for privacy or by a virtual machine, points at nothing in the registry at all.

The practical uses are local: inventorying devices on a network, reading switch and router tables, matching a DHCP lease to a piece of hardware, identifying whether a device on a packet capture is a camera or a phone, and spotting the vendor behind a rogue access point.

MAC address formats and where they appear

The same 48-bit address is written differently depending on the system that shows it, and the tool accepts all of the common forms.

The last row is worth knowing. Some IPv6 stacks build the interface part of a link-local address from the MAC by inserting ff:fe in the middle and flipping one bit of the first byte. In the example, 3e5a:b4ff:fe12:3456 corresponds to the MAC 3C:5A:B4:12:34:56: remove ff:fe and flip the second-lowest bit of the first byte back. Modern systems use random or stable-privacy interface identifiers instead, so the trick works on routers and embedded devices more often than on phones and laptops.

What the manufacturer tells you about a device

A vendor name alone often answers the question you had. A prefix registered to a television or games console maker identifies the device class immediately; a networking vendor points at a switch, access point or router; a prefix belonging to a large contract manufacturer means the brand on the case is probably someone else and you will need the router's device name or the DHCP hostname to narrow it down. Virtual machine platforms use their own well-known prefixes, so a vendor name from a virtualization company tells you the address belongs to a VM, not to a physical machine on the network.

Limits of this tool

• The lookup uses the IEEE OUI (MA-L) registry, which covers 24-bit prefixes. Smaller assignments, the 28-bit MA-M and 36-bit MA-S blocks, are not imported, so a device from one of those blocks shows no vendor.
• Randomized, virtual and administrator-set addresses have no entry by design. The locally administered flag tells you when that is the reason.
• The registered organization is the entity that holds the prefix, which can differ from the brand sold to consumers.
• The registry is updated on a schedule. A prefix assigned since the last import is not found until the next one.
• The tool reports the manufacturer's registered address, not the location of the device.
• Nothing is verified about the address itself. A typed address that happens to match a registered prefix returns that vendor whether or not the device exists.
• The tool cannot look up devices by IP address or hostname; MAC addresses are visible only on the local network, so you need to read the address from the device or the router first. For addresses and networks on the internet, use the IP lookup.