Why did my MAC address lookup return nothing?

Because the address is a randomized (private) MAC generated by the device itself, not one assigned to a manufacturer by the IEEE. There is no vendor to look up — the address was invented locally for privacy. It is a valid, working address; it just does not map to a maker.

How can I tell if a MAC address is randomized?

Look at the second hex digit of the address. If it is 2, 6, A, or E, the locally-administered bit is set, which means the address was generated by the device rather than assigned by the IEEE. Example: DA:A1:19:… — the D-A first octet has that bit set, so it is a private address.

Is a randomized MAC address a security risk?

No — it is the opposite. MAC randomization is a privacy feature that stops networks and trackers from following a device across locations by its hardware address. A private MAC on your network is almost always just a phone, tablet, or laptop with the default privacy setting on.

Which devices use randomized MAC addresses?

Effectively all modern client devices by default: iPhone/iPad (iOS 14+, 2020), Apple Watch (watchOS 7+), Android (10+), Windows 11, and recent macOS. They rotate a fresh private address per WiFi network (and some rotate periodically), so the same phone shows a different MAC on each network it joins.

How do I identify a device if its MAC is randomized?

The OUI vendor is gone, so you fingerprint the device from other signals: the DHCP hostname it announces, its DHCP option fingerprint, mDNS/Bonjour and UPnP advertisements, and its traffic pattern. On your own router, the assigned hostname (e.g. 'Janes-iPhone') is usually the fastest identifier. The ssid.ai MAC lookup flags the randomized address so you know to switch to these signals instead of chasing a vendor that does not exist.

How do I detect a randomized MAC address without any service?

Read the second hex digit of the first octet. If it is 2, 6, A or E the locally-administered bit (0x02) is set, which means the device generated the address itself instead of using the block the IEEE assigned to its manufacturer. In code it is one AND: (parseInt(mac.slice(0,2), 16) & 0x02) === 0x02. No lookup table is involved, so the test runs offline and costs nothing.

Why does my MAC lookup return 404 instead of saying the address is randomized?

Because most MAC lookup services hold the IEEE vendor table and nothing else, so they answer 404 for any address that is not in it. A private address is not in it. Neither is a prefix the IEEE has never assigned. Both collapse to the same 404 and the caller cannot tell which happened. ssid.ai splits them: a private address returns kind: "randomized" with HTTP 200 and confidence 0, and an address whose prefix is genuinely absent returns kind: "universal" with vendor: null.

Is randomized MAC address detection accurate?

The bit test is exact. An address either has the locally-administered bit set or it does not, and no probability is involved. What it cannot tell you is intent: some virtual interfaces, VMs and hand-configured devices also set that bit without being privacy rotations. So a randomized result means the address was not assigned by the IEEE to a manufacturer, which is the honest reading, rather than proof that the device is a phone.

Can I turn randomization off?

Yes, per network. On iOS: Settings › WiFi › (i) next to the network › turn off 'Private WiFi Address'. On Android: long-press the network › Privacy › 'Use device MAC'. Do this only on networks you trust — it re-exposes your real hardware address to that network.

Learn

Randomized (private) MAC addresses, explained

If a MAC lookup came back blank, the address probably is not unknown — it is randomized. Modern phones, tablets and laptops invent a private hardware address per network. Here is what that means, how to spot it, and how to identify the device anyway.

Last updated 2026-08-27 · compiled by ssid.ai

The short version: a randomized MAC is a valid address the device generated itself for privacy. It has no manufacturer to look up. That is not an error — it is the design. Check an address →

Detecting these at scale is one bit of arithmetic on the address itself, so it is free on every ssid.ai tier and it needs no key. The test is below.

What a randomized MAC actually is

Every network interface has a MAC address. Historically the first half (the OUI) was assigned to the manufacturer by the IEEE, so a lookup could tell you “this is an Apple device” or “this is a Samsung device.” A randomized (or private, or locally-administered) MAC is one the device makes up itself instead of using its factory address. There is no manufacturer in it, because no manufacturer assigned it.

Devices do this so networks and trackers cannot follow them from place to place. Your phone presents a different MAC to the coffee shop, the airport, and your home — so none of them can link those visits by hardware address.

How to tell in one glance

The clue is a single bit in the first octet — the locally-administered bit (the second-least significant bit of the first byte). If the second hex digit of the address is 2, 6, A, or E, the bit is set and the address is locally-administered — almost always a privacy MAC.

DA:A1:19:5F:2C:88 → private (randomized)

44:38:39:FF:EF:57 → universal (Cumulus Networks — real vendor)

Test it yourself, offline

No lookup table is involved, so you do not need a service for the detection half. One AND against the first octet answers it:

// true when the address is randomized / locally administered
(parseInt(mac.replace(/[^0-9a-f]/gi, "").slice(0, 2), 16) & 0x02) === 0x02

What a service can add is the failure case. Most MAC lookup APIs hold the IEEE vendor table and nothing else, so they answer HTTP 404 for a private address and HTTP 404 for a prefix the IEEE never assigned. Those are different facts with the same response, and code that branches on the difference stores “unknown vendor” for a phone. The ssid.ai lookup returns kind: "randomized" with HTTP 200 for the first and kind: "universal" with a null vendor for the second.

Which devices randomize — and since when

iPhone / iPad — on by default since iOS 14 / iPadOS 14 (2020). A fresh private address per network.
Apple Watch — watchOS 7+.
Android — randomized per network by default since Android 10; Android 11+ can rotate periodically.
Windows 11— “Random hardware addresses” available per network.
macOS — recent versions randomize on supported networks.

This is why plain OUI lookup has been quietly breaking on phones since 2020: on a typical home network, a growing share of the “unknown” devices are just modern clients with privacy on.

How to identify the device anyway

The vendor is gone, so you fingerprint from everything else the device broadcasts:

DHCP hostname — the name the device gives your router (e.g. Janes-iPhone). Usually the fastest answer; check your router's client list.
DHCP option fingerprint — the specific set and order of DHCP options requested maps to an OS/device class.
mDNS / Bonjour & UPnP — Apple, Chromecast, printers and smart-home gear announce model and service info.
Traffic pattern — which cloud endpoints it talks to often reveals the platform.

The ssid.ai MAC lookup flags a randomized address explicitly — so you know immediately to switch to these signals instead of chasing a vendor that does not exist.

Is it a problem?

On your own network, almost never — it is a phone or laptop protecting its owner's privacy. It only matters when you rely on MAC address for access control or device tracking, which randomization is specifically designed to defeat. If you need stable identity on a network you control, ask users to disable “Private WiFi Address” for that one network, or move to certificate/account-based identity instead of MAC.

FAQ

Why did my MAC address lookup return nothing?: Because the address is a randomized (private) MAC generated by the device itself, not one assigned to a manufacturer by the IEEE. There is no vendor to look up — the address was invented locally for privacy. It is a valid, working address; it just does not map to a maker.
How can I tell if a MAC address is randomized?: Look at the second hex digit of the address. If it is 2, 6, A, or E, the locally-administered bit is set, which means the address was generated by the device rather than assigned by the IEEE. Example: DA:A1:19:… — the D-A first octet has that bit set, so it is a private address.
Is a randomized MAC address a security risk?: No — it is the opposite. MAC randomization is a privacy feature that stops networks and trackers from following a device across locations by its hardware address. A private MAC on your network is almost always just a phone, tablet, or laptop with the default privacy setting on.
Which devices use randomized MAC addresses?: Effectively all modern client devices by default: iPhone/iPad (iOS 14+, 2020), Apple Watch (watchOS 7+), Android (10+), Windows 11, and recent macOS. They rotate a fresh private address per WiFi network (and some rotate periodically), so the same phone shows a different MAC on each network it joins.
How do I identify a device if its MAC is randomized?: The OUI vendor is gone, so you fingerprint the device from other signals: the DHCP hostname it announces, its DHCP option fingerprint, mDNS/Bonjour and UPnP advertisements, and its traffic pattern. On your own router, the assigned hostname (e.g. 'Janes-iPhone') is usually the fastest identifier. The ssid.ai MAC lookup flags the randomized address so you know to switch to these signals instead of chasing a vendor that does not exist.
How do I detect a randomized MAC address without any service?: Read the second hex digit of the first octet. If it is 2, 6, A or E the locally-administered bit (0x02) is set, which means the device generated the address itself instead of using the block the IEEE assigned to its manufacturer. In code it is one AND: (parseInt(mac.slice(0,2), 16) & 0x02) === 0x02. No lookup table is involved, so the test runs offline and costs nothing.
Why does my MAC lookup return 404 instead of saying the address is randomized?: Because most MAC lookup services hold the IEEE vendor table and nothing else, so they answer 404 for any address that is not in it. A private address is not in it. Neither is a prefix the IEEE has never assigned. Both collapse to the same 404 and the caller cannot tell which happened. ssid.ai splits them: a private address returns kind: "randomized" with HTTP 200 and confidence 0, and an address whose prefix is genuinely absent returns kind: "universal" with vendor: null.
Is randomized MAC address detection accurate?: The bit test is exact. An address either has the locally-administered bit set or it does not, and no probability is involved. What it cannot tell you is intent: some virtual interfaces, VMs and hand-configured devices also set that bit without being privacy rotations. So a randomized result means the address was not assigned by the IEEE to a manufacturer, which is the honest reading, rather than proof that the device is a phone.
Can I turn randomization off?: Yes, per network. On iOS: Settings › WiFi › (i) next to the network › turn off 'Private WiFi Address'. On Android: long-press the network › Privacy › 'Use device MAC'. Do this only on networks you trust — it re-exposes your real hardware address to that network.