myip
🇬🇧 EN

MAC address lookup

The manufacturer behind an address, which IEEE registry assigned it, and whether it is a real hardware address at all.

What a MAC address is, and where it stops

A MAC address is a 48-bit label burned into a network interface — a Wi-Fi radio, an ethernet port, a Bluetooth chip. It exists so that devices sharing one physical segment can tell each other apart, and that is the whole of its job. There are about 281 trillion possible values, which is why the original plan was for every interface ever manufactured to have a permanently unique one.

The single most important thing about it is where it stops: at the first router. A MAC address is used to move a frame across one link, and the next router strips it off and writes a new one for the next hop. It does not travel with your traffic, it is not in the packets that reach a website, and no site you visit can read it. If you found this page because something claimed otherwise, that claim was wrong — the only devices that see your MAC address are the ones on your own local network, plus your provider's equipment at the other end of the line.

That also means this page cannot read your address. Everything here works on an address you type in, and the lookup runs against a local copy of the IEEE registries — nothing is sent anywhere, by you or by us.

The three registries, and the mistake almost every lookup tool makes

Everyone knows the first three bytes identify the manufacturer. That was true until 2014 and is now wrong often enough to matter. IEEE sells assignment blocks in three sizes:

MA-L — 24 bits, about 16.7 million addresses
The classic "OUI". Roughly 37,000 of these exist, held by manufacturers large enough to need millions of addresses.
MA-M — 28 bits, about 1 million addresses
For medium-sized makers. Sixteen of them fit inside one MA-L block.
MA-S — 36 bits, 4,096 addresses
For small companies, one-off products and OEM runs. 4,096 of these fit inside one MA-L block.

Here is the trap. MA-M and MA-S blocks physically live inside MA-L blocks that are registered to the IEEE Registration Authority itself. So a tool that looks up only the first three bytes of a small vendor's address does not fail — it confidently answers "IEEE Registration Authority" or some other administrator, which looks exactly like a real result. The correct lookup checks the longest prefix first: 36 bits, then 28, then 24. That is what this page does, and it is why a MAC starting 70:B3:D5 or 00:50:C2 gets a real company name here and a shrug elsewhere — those two blocks are pure registry administration and contain thousands of separate small assignments.

Two bits that answer most questions

The lowest two bits of the very first byte carry meaning, and reading them takes no database at all.

Bit 0 — individual or group
Zero means a unicast address belonging to one interface. One means multicast: a group address that several devices listen to. If you found an address in a packet capture and no vendor lookup works, check this bit before assuming anything is broken.
Bit 1 — universal or local
Zero means the address came from the IEEE registry and belongs to a manufacturer. One means locally administered: chosen by software, registered to nobody, and guaranteed never to appear in any vendor database. This single bit is the difference between "we could not find the vendor" and "there is no vendor to find".

In practice you can read the second bit straight off the address. If the second hex digit is 2, 6, A or E, the address is locally administered.

Randomised addresses, which is now the normal case

For two decades a device broadcast its permanent hardware address constantly — including while merely scanning for Wi-Fi networks, which meant any shop, airport or passer-by with a cheap receiver could log the same identifier every time you walked past. That is no longer how it works. Apple began randomising the address used for network scanning in 2014, and the change that mattered most arrived around 2019 and 2020: Android 10 and iOS 14 both began generating a different address for every network you join, with Windows offering the same thing.

So when someone looks up the address their phone shows them in Wi-Fi settings and gets nothing, that is the system working correctly. The address is locally administered, invented for that one network, and often regenerated periodically. It identifies nothing outside that network, which was the entire point.

The practical consequences are worth knowing, because they surprise people:

What the vendor actually tells you — and what it does not

The registry names the company that bought the address block. That is the maker of the network chip, which is frequently not the maker of the device. An Intel prefix means there is an Intel Wi-Fi card in something; that something could be a laptop from any brand. Worse, a large share of the world's hardware is built by contract manufacturers, so a prefix belonging to one of them tells you precisely nothing about what the device is or whose logo is on it.

Where the vendor is informative, it is very informative: a prefix belonging to a router manufacturer, a games console maker, a printer company or a hypervisor tells you what kind of thing you are looking at. That is why this page labels a category only for vendors where the answer is unambiguous, and stays quiet for the ones where it would be a guess. A device type cannot be derived from a MAC address, and any tool that claims to has decided that a plausible answer beats a correct one.

Addresses that belong to no one

Some addresses you will meet in a packet capture are defined by protocol rather than assigned to a manufacturer, and looking for a vendor will never succeed:

FF:FF:FF:FF:FF:FF
Broadcast — every device on the segment. This is how ARP finds anything at all.
01:00:5E:…
IPv4 multicast. The lower 23 bits are copied from the IP multicast group being joined.
33:33:…
IPv6 multicast, including neighbour discovery — the IPv6 replacement for ARP. Common enough in any capture that people ask about it constantly.
01:80:C2:00:00:00
Reserved by IEEE 802.1 for bridge protocols such as spanning tree. Switches consume these frames and never forward them.

From MAC to IPv6, and why the digits change

A MAC address can be stretched into the 64-bit second half of an IPv6 address. The method, called EUI-64, has two steps, and the second one is where everybody gets confused: insert FF:FE in the middle, and invert the universal/local bit. That inversion is why 00:1B:44:11:22:33 becomes fe80::21b:44ff:fe11:2233 rather than starting with 001b. The digits really did change, and nothing is wrong.

This is worth understanding because it also explains a privacy problem that has since been fixed. An IPv6 address built this way contains the hardware address, so it would follow a laptop onto every network it joined — a permanent identifier visible to every site it talked to. Modern systems therefore generate temporary random interface identifiers instead, and rotate them. If you want to see which addresses your own connection actually uses, the IPv6 test shows them, and the subnet calculator covers the prefix side of the same arithmetic.

Frequently asked questions

Can a website see my MAC address?

No. A MAC address is used to carry a frame across one network link and is replaced at the very first router, so it never travels with your traffic to a website. The only machines that see it are the other devices on your own network and your provider's equipment at the end of your line. This page cannot read it either — it only decodes an address you type in yourself.

Why does my phone's MAC address return no manufacturer?

Because it is almost certainly randomised, and that is the system working as designed. Android 10 and iOS 14 generate a different address for every network you join, and Windows offers the same. Such addresses are locally administered — chosen by software, registered to nobody, and absent from every vendor database by definition. You can spot one instantly: if the second hex digit is 2, 6, A or E, the address was invented rather than assigned.

Can I tell what kind of device it is from the MAC address?

Only sometimes, and never reliably. The registry names the maker of the network chip, not of the device it sits in — an Intel prefix means there is an Intel wireless card in something, and that something can be a laptop from any brand. A great deal of hardware is also built by contract manufacturers whose prefixes say nothing at all. Where the vendor is unambiguous, such as a router maker or a games console, we show a category; where it would be a guess, we leave it blank.

Why do other lookup tools give a different manufacturer than you do?

Almost always because they check only the first three bytes. IEEE assigns blocks in three sizes — 24, 28 and 36 bits — and the smaller ones sit inside blocks registered to the registry administrators themselves. A three-byte lookup on a small vendor's address therefore returns the administrator's name, which looks like a real answer and is not. We check the longest prefix first, so addresses inside blocks such as 70:B3:D5 or 00:50:C2 resolve to the actual company.

Is MAC address filtering a useful security measure?

Not really. Every frame carries the sender's address in the clear, so anyone within range can read a permitted one, and changing your own address takes a single command. It keeps casual neighbours off a network and stops nobody who is actually trying. It has also become awkward in practice, because devices that rotate their address will lock themselves out until you tell them to use the real one for that network.

What does an address starting 33:33 or 01:00:5E mean?

Those are multicast groups rather than devices, so no manufacturer will ever match them. 01:00:5E is IPv4 multicast, with the lower bits copied from the IP group. 33:33 is IPv6 multicast, which includes neighbour discovery — the IPv6 equivalent of ARP — and is therefore extremely common in any packet capture. FF:FF:FF:FF:FF:FF is broadcast, meaning every device on the segment.

Why does the IPv6 address you show start with different digits from my MAC?

Because building an interface identifier from a MAC has two steps, and the second one changes a digit: FF:FE is inserted in the middle and the universal/local bit is inverted. That is why 00:1B:44:11:22:33 produces fe80::21b:44ff:fe11:2233 rather than something beginning 001b. Nothing has gone wrong — the inversion is part of the specification.

Can I change my MAC address, and will anything break?

Yes, every mainstream operating system can set one, and your devices are probably doing it already for Wi-Fi. Two things to watch: set the locally-administered bit so you do not collide with a real assignment, and remember that anything keyed to your old address — DHCP reservations, MAC filters, some captive portals and licensing tied to hardware — will stop recognising you until updated.

Related checks