MAC Address Lookup
Paste any MAC address and find the hardware vendor registered to its OUI — the first 24 bits IEEE assigns to a manufacturer. Colon, hyphen, Cisco-dot and bare-hex spellings all work. The tool also decodes the U/L (universally vs locally administered) and I/G (unicast vs multicast) bits, so you can spot a randomized or software-set address at a glance. Everything runs in your browser; nothing is uploaded.
The vendor database is a static file served from this site and loaded once into your browser; every lookup and all bit-decoding happens locally. The MAC you paste is never sent to any server.
What this tool is
- Paste any MAC address — colon (00:1B:63:…), hyphen (00-1B-63-…), Cisco dot (001b.6384.…) or plain hex — and this tool reads the vendor registered to its OUI.
- The first 24 bits of a MAC (the first three octets) are the OUI — the block IEEE assigns to a manufacturer. The remaining 24 bits are the device-specific part the vendor itself assigns.
- It also decodes the two low bits of the first octet: the U/L bit (universally vs locally administered) and the I/G bit (unicast vs multicast), so you can tell a real burned-in address from a randomized or software-set one.
- If no vendor comes back, the address is very likely randomized, locally administered, or from an unassigned block — common on modern phones that rotate their Wi-Fi MAC for privacy.
- Everything runs in your browser against a static OUI database loaded once from this site. The MAC you enter is never sent to a server.
What is a MAC address?
A MAC address (Media Access Control address) is the 48-bit hardware identifier baked into a network interface — the Wi-Fi radio or Ethernet port of a laptop, phone, router, printer or IoT device. It is written as 12 hexadecimal digits in six octets, like 00:1B:63:84:45:E6. MAC addresses live at Layer 2 and move frames across the local link; IP addresses live at Layer 3 and change as a device roams between networks.
OUI — the vendor half
The first 24 bits (the first three octets) are the OUI — the Organizationally Unique Identifier that IEEE assigns to a manufacturer. Looking up those three octets in the public IEEE registry tells you who built the chip. The remaining 24 bits are the device-specific portion the vendor assigns to each individual unit. IEEE sells three block sizes: MA-L (a classic 24-bit OUI, ~16.7M addresses), MA-M (28-bit prefix) and MA-S (36-bit prefix). This tool matches on the 24-bit OUI, which covers the vast majority of assignments.
The two flag bits
The two least-significant bits of the first octet carry meaning:
- U/L bit (0x02) — administration. When clear, the address is universally administered: a globally-unique, IEEE-assigned, burned-in address. When set, it is locally administered — assigned by software, an OS or a hypervisor rather than from an OUI block.
- I/G bit (0x01) — cast type. When clear, the frame is unicast (one interface). When set, it is multicast / group (many). So
01:…is multicast, and02:00:00:…is a unicast but locally-administered address.
Why a lookup may show no vendor
Modern iOS and Android devices use MAC randomization: by default they present a random, locally-administered MAC to each Wi-Fi network — and often rotate it — specifically so you cannot be tracked across venues by your hardware address. A randomized MAC has the U/L bit set and belongs to no IEEE block, so a vendor lookup correctly returns nothing. When this tool shows "no registered vendor" alongside the locally administered flag, that is almost always privacy randomization, a virtual NIC, or an unassigned block — not a bug.
Security note: a MAC address is a weak, spoofable identifier — any host can set its MAC to an arbitrary value in software in seconds. Wi-Fi MAC filtering and "trusted device" allow-lists are trivially bypassed by cloning an observed permitted address, and a MAC is only visible on the local link (it does not survive routing). Use MACs for inventory, asset tracking and troubleshooting, but gate real access control on cryptographic identity — 802.1X, certificates, strong authentication — not on a hardware address.
Frequently asked questions
What is a MAC address?
A MAC (Media Access Control) address is the 48-bit hardware identifier assigned to a network interface — the Wi-Fi radio or Ethernet port in a laptop, phone, router or IoT device. It is written as 12 hexadecimal digits, usually in six colon- or hyphen-separated octets such as 00:1B:63:84:45:E6 (Cisco gear often groups it as three dot-separated quads, 001b.6384.45e6). It operates at Layer 2 of the network and is used to deliver frames on the local link, whereas an IP address operates at Layer 3 and can change as a device moves between networks.
What is an OUI, and how does vendor lookup work?
The OUI (Organizationally Unique Identifier) is the first 24 bits — the first three octets — of a MAC address. IEEE sells these blocks to manufacturers, so the OUI identifies who made the network chip. A vendor lookup simply takes those first three octets and searches the public IEEE registry for the organization they were assigned to. The remaining 24 bits are the device-specific portion, which the manufacturer assigns to individual units. IEEE now sells three block sizes: MA-L (a 24-bit OUI, ~16.7M addresses), MA-M (28-bit prefix) and MA-S (36-bit prefix) — this tool matches on the 24-bit OUI, which covers the overwhelming majority of assignments.
Why does my phone show no vendor, or a different MAC every time?
Modern iOS and Android devices use MAC randomization: by default they present a random, locally-administered MAC to each Wi-Fi network (and often rotate it) specifically so you cannot be tracked across venues by your hardware address. A randomized MAC has its locally-administered (U/L) bit set, which means it does not come from any IEEE OUI block — so a vendor lookup correctly returns nothing. If you see "no registered vendor" together with the "locally administered" flag, that is almost always privacy randomization rather than an error.
What do the U/L and I/G bits mean?
They are the two least-significant bits of the very first octet of the MAC. The U/L bit (bit 1, value 0x02) says whether the address is universally administered — a globally-unique, IEEE-assigned, burned-in address — or locally administered, meaning it was set by software or an OS (randomization, virtualization, a manual override). The I/G bit (bit 0, value 0x01) says whether the frame is unicast (one interface) or multicast/group (many). For example 02:00:00:… is unicast but locally administered (the 0x02 bit is set), while 01:… is a multicast address (the 0x01 bit is set). This tool decodes both from the address you paste.
Can a MAC address be trusted as an identifier?
No — treat it as a weak, spoofable hint, never as authentication. Any host can set its MAC to an arbitrary value in software in seconds, so MAC-based allow-lists (Wi-Fi MAC filtering, "trusted device" lists, licensing tied to a MAC) can be bypassed by an attacker who observes a permitted address and clones it. A MAC is also only visible on the local link; it does not survive routing. Use it for inventory, asset tracking and troubleshooting, but gate real access control on cryptographic identity (802.1X / certificates, strong auth) rather than on a hardware address.