What is a randomized MAC address?

A randomized MAC address — also called a private, anonymized or random hardware address — is an address a device generates for itself instead of presenting the address burned into its network hardware. It follows one rule that makes it recognisable: the locally administered bit is set, so the second hexadecimal digit of the first octet is 2, 6, A or E, as in A6:1B:2C:3D:4E:5F. Because no IEEE registration covers such an address, a MAC address lookup returns no registered organization for it.

What rules apply to a randomized address?

Two bits in the first octet are fixed, and the rest is free. The individually/group bit must stay 0 so the address is unicast, and the locally administered bit must be 1 so the address is marked as assigned outside the IEEE registry. The remaining 46 bits are random. Those two rules are why a randomized address never collides with an address block the IEEE Registration Authority assigned to an organization.

Nothing prevents a device from generating a large number of addresses over time. The randomization is per network: the same device presents a different address on a different network, and some operating systems rotate it periodically.

How can I tell whether an address is randomized?

By the local bit and nothing else. A randomized address always sets it, so the second hexadecimal digit of the first octet is 2, 6, A or E. The reverse does not hold: that bit marks an address as locally administered, which is a wider category, and a locally administered address is not necessarily a randomized one.

What is a locally administered MAC address?

A locally administered address is one assigned by software or by a network administrator instead of being taken from an IEEE-assigned block. IEEE assigns address blocks with the local bit clear, so any address that sets the bit is, by definition, outside the registry and has no registrant to look up. Software creates them for several reasons: a container interface such as Docker's 02:42 default bridge range, a virtual machine's network adapter, a bridge or bond interface, and a manually configured address all take this form. Privacy randomization is the best-known use of the same bit, which is why the two are easy to confuse.

Which operating systems randomize, and when?

• iOS 14, iPadOS 14 and later use a private Wi-Fi address on each network by default. Since iOS 18 the setting has three modes — Off, Fixed and Rotating.
• Android 10 and later use a randomized address by default, as documented in Android's MAC randomization behaviour. Randomization is per network and persistent by default, so the same network sees the same address until a factory reset; from Android 12 some networks re-randomize at the start of each connection.
• Windows 10 and Windows 11 can use random hardware addresses, which are off until you enable them for all networks or for one network.
• Linux distributions vary: wpa_supplicant and NetworkManager can scan with a random address, and NetworkManager can also assign one when joining a network.

What randomization does not do

• It does not make the device anonymous or unfindable. The address is one signal among several, and the network you join still sees the traffic you send through it.
• It does not hide the device from the network's own access controls: a network that registers, filters or bills by address needs a stable one, which is what the Fixed mode on Apple devices and persistent randomization on Android provide.
• It does not remove the hardware address from the device. When randomization is off — or set to Off on an Apple device — the hardware address is presented again.

Does a randomized address mean the device cannot be identified?

No. A lookup of a randomized address returns no registrant because the address is not a registered assignment, and that is all it returns: no device model, no owner and no location. A network can still correlate a device through other signals, so treat randomization as a measure that raises the cost of tracking rather than as anonymity. The same is true of the older term anonymized MAC address : the address is randomized, not anonymized.

Check an address

Paste any address into the MAC address lookup. An address whose second hexadecimal digit is 2, 6, A or E is locally administered and will not resolve to a vendor. Related guides: what a MAC address is, why a lookup returns no vendor, why devices randomize, private Wi-Fi addresses on Apple devices and randomization on Android.