Wi-Fi privacy
Private MAC & randomization checker
Tell rotating private Wi-Fi addresses apart from burned-in hardware, and see what MAC randomization on iOS, Android and Windows means for DHCP, network access control, guest Wi-Fi and tracking.
Addresses to checkFree up to 5 addresses
One per line or raw ARP, DHCP or controller output. Any notation works.
Private address settings by platform
Names and menus vary slightly between versions. Managed devices can have the setting enforced per network by an MDM Wi-Fi profile.
| Platform | Default behavior | Where to change it |
|---|---|---|
| iPhone & iPad (iOS / iPadOS 14+) | On by default, a separate private address per network. Since iOS 18 the options are Off, Fixed and Rotating. | Settings → Wi-Fi → ⓘ next to the network → Private Wi-Fi Address |
| Mac (macOS 15 Sequoia+) | Per-network private address with Off, Fixed and Rotating options. | System Settings → Wi-Fi → Details next to the network → Private Wi-Fi address |
| Android 10+ | Randomized per network by default. Some versions and vendors can re-randomize on every connection. | Settings → Network & internet → Internet → network settings → Privacy → Use device MAC |
| Windows 10 / 11 | Off unless enabled. When on, uses a random address per network, optionally changed daily. | Settings → Network & internet → Wi-Fi → Random hardware addresses (and per-network properties) |
| Linux (NetworkManager) | Random address while scanning; connections keep the permanent address unless configured. | wifi.cloned-mac-address = permanent, stable or random |
What MAC randomization changes on your network
DHCP reservations
A reservation tied to the hardware MAC no longer matches; a fixed private address only matches until it is reset or rotated.
Ask users to set the private address to Off or Fixed on the corporate network, or have MDM enforce it. Reserve by client identity where your DHCP server allows it.
MAC allow-lists, MAB and NAC
Devices fail MAC authentication bypass or allow-lists because the address they present is not the registered one.
Use 802.1X with certificates or credentials for managed devices, and disable private addresses on managed SSIDs through MDM.
Guest Wi-Fi and captive portals
Rotating addresses look like new clients, so users must log in again and per-device time limits reset.
Tie sessions to vouchers or accounts rather than the MAC, and expect re-authentication.
Presence and footfall analytics
Probe requests and associations use changing addresses, so counts inflate and individuals cannot be followed reliably — by design.
Report aggregate trends, not individual devices, and use consented methods such as app check-ins or login data.
Home routers and parental controls
Rules keyed to a device's MAC stop applying when the address changes.
Set the private address to Fixed for the home network, or use the router's device-identification feature.
Security investigations
A randomized MAC in a log cannot be mapped to hardware on its own.
Correlate DHCP, RADIUS / 802.1X and controller logs, which link the address in use to a user or certificate at that time.
Privacy and compliance notes
- In the EU and UK, MAC addresses collected from devices are generally treated as personal data under the GDPR because they identify a device used by a person. Wi-Fi tracking can also fall under ePrivacy rules.
- In California, device identifiers count as personal information under the CCPA / CPRA. Other jurisdictions have similar definitions.
- Randomization does not make data anonymous. A fixed private address is a stable identifier on that network, and rotating addresses can sometimes be linked by timing or other signals.
- Hashing a MAC address is not anonymization: the address space is small enough that hashes can be reversed by brute force. Treat hashed MACs as pseudonymous personal data.
- Collect only what the purpose needs, tell people when Wi-Fi analytics are in use, keep retention short and document why MAC data is processed.
General information, not legal advice. Check the rules that apply to your organization and location.
How it works
- 01
Paste addresses
One address or thousands, in any notation, or raw output from an ARP table, DHCP server or wireless controller.
- 02
Each address is classified
The locally administered bit separates private and virtual addresses from manufacturer-assigned ones; the second hex digit gives the IEEE SLAP quadrant.
- 03
Decide what to do
Burned-in addresses get their IEEE vendor. For private ones, see which platform setting controls them and how they affect your network.
What it is used for
Help desk triage
Explain why a phone lost its DHCP reservation or was blocked by a MAC allow-list after an OS update.
Unknown-vendor alerts
Most “unknown vendor” devices on Wi-Fi are private addresses, not rogue hardware. Separate the two before escalating.
Guest and captive-portal Wi-Fi
Estimate how many clients rotate addresses and will need to log in again.
Privacy reviews
Check what a Wi-Fi analytics or presence system can and cannot reliably identify.
Frequently asked questions
How can I tell if a MAC address is randomized?
Look at the second hex digit. If it is 2, 6, A or E (for example x2:xx:xx…), the locally administered bit is set and the address was assigned by software, not burned in by a manufacturer. Phones, laptops, virtual machines and containers all use such addresses.
Can I find the real hardware MAC from a private one?
No. A private address is generated independently of the hardware address and carries no vendor prefix. Only the device itself, or your 802.1X or MDM records, can link the two.
Does a private address change every time?
It depends on the setting. iOS, iPadOS and macOS can use a fixed private address per network or rotate it; Android uses a per-network address by default; Windows can use a fixed random address or change it daily. Forgetting and rejoining a network may also produce a new address.
What is the SLAP quadrant?
IEEE 802c divides locally administered addresses into four quadrants by the second hex digit: 2 is administratively assigned (AAI), 6 is reserved, A is extended local (ELI, tied to a company ID) and E is standard assigned (SAI). Randomized client addresses may appear in any of them.
Why is 02:42 shown as Docker instead of private?
Some software assigns locally administered addresses from fixed prefixes, such as Docker (02:42), QEMU/KVM (52:54:00) and VirtualBox host-only adapters (0A:00:27). Those are flagged as virtual, not as privacy addresses.
Is anything uploaded?
Classification runs in your browser. Only globally unique addresses are sent to our vendor lookup endpoint; private addresses have no vendor to look up.