Generate Random MAC Address
Generate up to 1,000 random MAC addresses: locally administered unicast addresses that are safe for test networks, addresses with a virtual machine prefix for KVM, Hyper-V, VMware, VirtualBox or Xen, or multicast. Write them with colons, hyphens or Cisco dots, and see each one's IPv6 link-local address.
First-byte bits set per IEEE 802 · generated in your browser
The Second Digit Tells You the Type
Two bits in the first byte decide what kind of address it is. The lowest bit is I/G (0 = one device, 1 = a group, i.e. multicast). The next is U/L (0 = universally administered, with a manufacturer prefix from the IEEE; 1 = locally administered, chosen by whoever set it). Both live in the second hex digit, so you can read the type at a glance:
| Second digit | Bits (U/L, I/G) | Type | Example |
|---|---|---|---|
| 0, 4, 8, C | 0, 0 | Universal unicast: a manufacturer's hardware address | 00:15:5d:… |
| 1, 5, 9, D | 0, 1 | Universal multicast | 01:00:5e:… (IPv4 multicast) |
| 2, 6, A, E | 1, 0 | Local unicast: set by software or an admin | 52:54:00:… |
| 3, 7, B, F | 1, 1 | Local multicast | 33:33:… (IPv6 multicast) |
Example: QEMU's 52 is 0101 0010 in binary. The last bit (I/G) is 0, so unicast; the one before it (U/L) is 1, so locally administered. That's why QEMU can use the prefix without buying it from the IEEE.
Local Addresses: x2, x6, xA or xE
Local addresses were once a free-for-all. IEEE 802c (2017) split them into four quadrants by two more bits, the Structured Local Address Plan (SLAP). The default setting here keeps random addresses in the quadrant meant for them.
| Second digit | Quadrant | Meant for |
|---|---|---|
| 2 | AAI, administratively assigned | Random or manually chosen addresses: VMs, containers, tests |
| 6 | Reserved | Future use; may be used like AAI until then |
| A | ELI, extended local | Blocks assigned under an IEEE Company ID (CID) |
| E | SAI, standard assigned | Addresses handed out by a protocol |
Most networks ignore the quadrants, so "Any of 2, 6, A, E" is fine for test data. Phones that randomise their address may use any of the four.
Worked Example: MAC Addresses for KVM Virtual Machines
An admin is defining three KVM guests in libvirt XML and wants fixed MAC addresses so the DHCP server always gives them the same IPs.
Step 1: Use the hypervisor's prefix
Step 2: Check how much room there is
Step 3: Estimate the chance of a clash
MAC addresses only need to be unique on the same network segment, but a clash there causes confusing, intermittent drops. Tick No repeats for the batch, and compare against addresses already in use. The same approach works for other platforms with their own prefix:
| Platform | Prefix | Note |
|---|---|---|
| QEMU / KVM (libvirt) | 52:54:00 | Locally administered |
| Microsoft Hyper-V | 00:15:5D | Hyper-V's dynamic MAC pool uses this prefix |
| VMware (manual) | 00:50:56 | Static addresses must be 00:50:56:00:00:00 to 3F:FF:FF |
| Oracle VirtualBox | 08:00:27 | Default for new VMs |
| Xen | 00:16:3E | Xen's registered prefix |
| Docker (older default) | 02:42 | Followed by the container's IPv4 address bytes |
Colons, Hyphens or Dots: Who Writes It Which Way
| Where | Written as | Example |
|---|---|---|
| Linux (ip link), macOS, most Unix tools | Lowercase, colons | 52:54:00:ab:cd:ef |
| Windows (ipconfig /all, getmac), IEEE documents | Uppercase, hyphens | 52-54-00-AB-CD-EF |
| Cisco IOS (show mac address-table) | Lowercase, dots every 4 digits | 5254.00ab.cdef |
| Many APIs, databases and DHCP exports | 12 digits, no separators | 525400abcdef |
All four are the same 48-bit value, and case never matters. When matching addresses between systems, strip the separators and compare in one case. A common bug is a regex that only accepts one style, so the list from a Cisco switch never matches the list from a Windows DHCP server.
Why Phones and Laptops Show Random MACs
If your router lists a device whose MAC's second digit is 2, 6, A or E, it's almost certainly using a randomised address to stop it being tracked from network to network:
- iPhone and iPad: a different private Wi-Fi address for each network by default since iOS 14. From iOS 18 it can be Fixed or Rotating, which changes about every two weeks; Rotating is the default on open or weakly secured networks.
- Android: a randomised MAC by default since Android 10. Apps asking for the real address have received the placeholder 02:00:00:00:00:00 since Android 6.
- Windows: the "Random hardware addresses" setting under Wi-Fi does the same where the adapter supports it.
Side effects: DHCP reservations, MAC filtering and parental controls keyed on the old hardware address stop matching. Fix them by turning randomisation off for that one network on the device, not globally.
From MAC Address to IPv6 Link-Local Address
IPv6 can build an interface's 64-bit ID from its MAC address (modified EUI-64). Tick Show IPv6 link-local to see the result for each address. For 00:15:5d:12:34:56:
Step 1: Split the MAC in half and insert ff:fe
Step 2: Flip the U/L bit (bit value 2) in the first byte
Step 3: Add the link-local prefix and compress
The flip is why a local MAC such as 52:54:00:… ends up with 50 in its IPv6 ID. Because this embeds the hardware address, modern systems use other methods for addresses that leave the local network: temporary addresses (RFC 8981) and stable opaque IDs (RFC 7217). The ff:fe in the middle is a quick sign that an IPv6 address was made from a MAC.
Frequently asked questions
Can I use a random MAC address on a real network?
Yes, if it is locally administered unicast (second digit 2, 6, A or E) and no other device on the same network segment has it. Linux: ip link set dev eth0 address 02:…; Windows and macOS have adapter settings for it. Follow the rules of networks you don’t own.
Why doesn’t a vendor lookup find my random MAC?
Vendor lookups match the first three bytes against IEEE-assigned prefixes. Locally administered addresses aren’t assigned to anyone, so lookups return nothing or “private”.
What does 02:00:00:00:00:00 mean?
It is the placeholder Android has returned to apps since Android 6 instead of the real hardware address. It is a valid locally administered address, but it identifies nothing.
Is a MAC address the same as an IP address?
No. A MAC address identifies a network interface on the local link and is used by switches; an IP address is used for routing between networks and usually changes when you move.
Sources
- RFC 7042: IANA Considerations and IETF Protocol Usage for IEEE 802 Parameters: the I/G and U/L bits, 01-00-5E and 33-33 multicast prefixes.
- IEEE Registration Authority: Guidelines for use of EUI, OUI and CID: universally and locally administered identifiers.
- RFC 4291: IP Version 6 Addressing Architecture: appendix A: modified EUI-64 interface identifiers.
- RFC 8981: Temporary Address Extensions for SLAAC in IPv6: privacy addresses that hide the MAC.
- RFC 7217: Semantically Opaque Interface Identifiers: stable IPv6 IDs not derived from the MAC.
- Apple Support: Use private Wi-Fi addresses on Apple devices: per-network addresses, Fixed and Rotating.
- Android Open Source Project: MAC randomization behavior: randomized MAC by default from Android 10.
- Android 6.0 changes: apps receive 02:00:00:00:00:00 instead of the hardware address.
- QEMU documentation: Network emulation: the 52:54:00 prefix in examples.
Related Tools
Create GUIDs for Microsoft and .NET fields.
Generate binary numbers with a chosen bit length.
Create a random pixel image and save it as a PNG.
Generate bytes in hex, Base64, or decimal format.
Pick a date between your chosen start and end dates.
Generate decimals with a chosen range and precision.