What is MAC address filtering, and is it worth turning on

Short answer: MAC address filtering lets your router allow or block specific devices by their hardware address. MAC addresses are easy to fake, so treat filtering as a light extra layer — pair it with a strong WiFi password and current encryption rather than relying on it by itself.

What MAC filtering actually does

Every network device has a MAC address burned into its network chip — a twelve-character hex ID like A4:83:E7:2C:1B:90. MAC filtering is a setting on your router that checks that address before letting a device join. There are two ways to configure it, depending on the router: an allow list, where only the addresses you add can connect and everything else is refused even with the correct WiFi password, or a deny list, where the addresses you add are blocked and everyone else connects as normal.

Most home routers only support one mode at a time, and the wording and location of the setting vary — look under “Wireless,” “Security,” or “Access Control” in the admin page. If you’re not sure how to log in, the router login directory has the admin address and default password for most models.

Why it’s weak security on its own

A MAC address isn’t a secret. It’s sent in plain text with every packet a device transmits, so anyone running basic network-monitoring software on the WiFi can read the MAC address of every connected device, including the ones on an allow list. Changing your own device’s MAC address to match one you just captured takes a few minutes — it’s a built-in setting on Windows, Mac, Linux, and most routers themselves.

That’s the core problem: filtering checks an address, and an address is public information the moment it’s transmitted. A password is different — nobody sees it just by being nearby. An attacker who wants past MAC filtering copies an address they captured. An attacker who wants past a password has to guess it or steal it some other way. Once an address is copied, an allow list treats the spoofed device exactly like the real one.

When it’s still worth turning on

MAC filtering isn’t useless — it’s aimed at a different problem than stopping a determined attacker. It’s a reasonable extra layer when:

• You want a hard block on one specific device — an old phone you sold but didn’t factory-reset, a smart TV you don’t trust — without changing the WiFi password for everyone else.
• You’re running a household and want a simple, low-effort default that keeps an unrecognized device off the network without extra steps each time.
• You already have a strong password and current WPA2 or WPA3 encryption, and you’re adding this as one more layer rather than relying on it alone.

Pair it with a strong WiFi password and current encryption. It works as an addition to those, not a replacement for either.

A simpler alternative if your goal is visibility

If what you actually want is to know what’s on your network, MAC filtering is the wrong tool for that job. Start by checking who’s currently connected to your WiFi from the router’s device list. Each entry’s MAC address reveals the manufacturer through a MAC vendor lookup, which is useful for identifying a device even if you never touch the filtering settings at all. For how that lookup works and where it falls short, see what an OUI is and how vendor lookup works.

If the goal is actually keeping unwanted devices off the network, a WiFi password does that job better than an allow list, because a password has to be obtained before it can be used — a MAC address just has to be observed.

Where MAC filtering earns its keep

Filtering matters more outside a typical home setup — a small office or a dedicated guest network, where tighter control is worth the effort of maintaining the address list as devices change. Even there, it runs alongside WPA2/WPA3, never in place of it. On a home network, treat it as a light deterrent for casual cases: the neighbor’s kid guessing at your old WiFi password, not someone who actually wants in.