MAC Address Generator

Two bits in the first byte decide what kind of address you get

A MAC address is 48 bits, written as six bytes in hex. Most of it is just an identifier, but the two lowest bits of the first byte carry meaning:

• Bit 0, I/G (individual/group) — 0 means unicast, one specific interface. 1 means multicast, a group address. A network card's own address must be unicast.
• Bit 1, U/L (universal/local) — 0 means the address is universally administered: the first three bytes are an Organizationally Unique Identifier the IEEE sold to a manufacturer. 1 means locally administered: someone assigned it in software and no registry is involved.

With Locally administered ticked (the default), the generator draws six random bytes and then rewrites the first one as (byte AND 0xFE) OR 0x02: multicast bit cleared, local bit set. That's why every address it produces starts with a byte whose second hex digit is 2, 6, A or E. The remaining 46 bits are random.

Unticked, the generator still clears the multicast bit, so every result is a valid unicast address, but it leaves the U/L bit random. About half the results are then "universal" addresses squatting on an OUI that might belong to a real company. That mode is good for testing a parser against both kinds of address, and not a good choice to assign to an interface on a shared network.

A worked example

Suppose the six random draws produce the bytes 0x19 0x80 0x40 0xC0 0xE6 0x00 (decimal 25, 128, 64, 192, 230, 0). We fed exactly those draws to the tool's generator function to check the output:

• Unticked: 0x19 (binary 0001 1001) is odd, so the multicast bit is cleared: 0x19 AND 0xFE = 0x18 (0001 1000). The address is 18:80:40:c0:e6:00 — unicast, and with the U/L bit at 0 it claims to be a universally administered, manufacturer-assigned address.
• Ticked: the same 0x18, then OR 0x02 = 0x1A (0001 1010). The address becomes 1a:80:40:c0:e6:00 — unicast, locally administered.
• The same ticked address in the other formats: 1a-80-40-c0-e6-00 (hyphen) and 1a80.40c0.e600 (Cisco dot).

Where locally administered addresses show up

You have almost certainly seen these without noticing. QEMU/KVM virtual NICs default to the 52:54:00 prefix, and Docker's bridge network gave containers addresses starting 02:42 until Engine 28, which switched to fully random locally administered ones — all have the U/L bit set. Phones use them too: the "private Wi-Fi address" on iOS and the randomized MAC on Android are locally administered addresses, generated per network so that one device can't be tracked across hotspots. That's also why a MAC vendor lookup fails on so many addresses you collect from a modern network.

The U/L bit has one more cameo in IPv6: when a host builds a modified EUI-64 interface identifier from its MAC, it inverts that bit and inserts ff:fe in the middle. If you are decoding such addresses, the IPv6 expander writes them out in full.

Using a generated address

On Linux the usual sequence is to bring the interface down, set the address, and bring it back up: ip link set dev eth0 down, ip link set dev eth0 address 02:…, ip link set dev eth0 up (as root). For a VM, paste the address into the network adapter settings of your hypervisor. In a lab or test suite, the generator is handy for seeding a DHCP reservation table or giving each simulated device a distinct, obviously-fake address.

Scope note: this tool only generates strings. It doesn't change your own machine's address, doesn't read your hardware MAC (browsers can't), and doesn't pick from any vendor's OUI.

Frequently asked questions

What is a locally administered MAC address?

One whose second-lowest bit of the first byte (the U/L bit) is set to 1. It tells the network the address was assigned by software or an administrator rather than burned in by a manufacturer under an IEEE-registered OUI. You can spot one by the second hex digit of the first byte: 2, 6, A or E for a unicast locally administered address, as in 52:54:00:... (QEMU) or 02:42:... (older Docker)

Should I leave "Locally administered" ticked?

For almost any real use, yes. Every address the tool makes is unicast either way, because the multicast bit is always cleared. Ticked, it also sets the local bit, so the address cannot clash with any manufacturer's range. Unticked, the local bit is left random: about half the addresses will then look like universal, manufacturer-assigned ones, and their first three bytes may be an OUI that belongs to a real vendor or to nobody. That mode is mainly useful for testing parsers.

Are the generated addresses guaranteed to be unique?

No, but collisions are extremely unlikely. A locally administered unicast address has 46 free random bits, about 70 trillion possibilities, and the tool generates at most 256 per click. The randomness comes from Math.random(), which is fine for addresses but should not be relied on for anything secret.

Which format should I use: colons, hyphens, or dots?

Whatever the tool you are pasting into expects. Linux (ip, ifconfig), macOS and most config files use colons; Windows displays hyphens; Cisco IOS uses three dot-separated groups of four hex digits. All three write the same 6 bytes. This tool outputs lowercase hex; most software accepts either case.

Can I look up the manufacturer of a generated address?

Not meaningfully. A locally administered address has no registered owner, so a vendor lookup should come back empty. That is in fact a quick way to tell a randomized phone or VM address from a real hardware one.