MAC address
The address a network card carries on its own link. It does not survive a router, with one exception that carries a form of it into every request.
Updated 20 September 2026 · 6 primary sources
A MAC address is 48 bits burned into a network interface. It addresses frames between two machines on the same link, which is why your laptop needs one to talk to your router. The first three bytes identify the maker, out of a registry that hands them out, and the rest is the maker's own numbering.
It is a local thing. A router "generally removes the Link Layer header a message was received with, modifies the IP header, and replaces the Link Layer header for retransmission". Your address is stripped at the first hop and never reaches the site you are visiting.
Two bits that decide what the address means
Inside the first byte sit two flags. One says the address is a group rather than one machine. The other, worth more here, says whether the address is globally unique or made up locally. The standard is blunt: the local bit "is zero for globally unique EUI-48 identifiers assigned by the owner of an OUI".
So an address either comes out of a registered block, and names the maker, or it was invented by the device and names nobody. Both work on a link. Only one of them says anything about you, and only in one situation does it leave the building.
| Part | What it holds | What it tells |
|---|---|---|
| Local bit | Zero or one | Registered address, or one the device invented |
| First three bytes | The registered block | Which company made the interface |
| Last three bytes | The maker's numbering | Which interface, within that company |
The one way a form of it travels
IPv6 gave the address a door. The original way to build an address takes the hardware address, inserts a fixed marker into the middle and flips the local bit. The result becomes the second half of the IPv6 address. That second half then goes out with every packet, to every site, from that machine.
We read the public RIPE Atlas probe register on 20 September 2026 and found 4,334 addresses built this way. Undoing the flip says where each one came from. Registered vendor addresses account for 75.1 percent of them, and locally administered ones for 24.9 percent. The registered ones carried 147 distinct vendor blocks, with the largest single block covering 23.4 percent and the top five covering 53.1 percent.
The concentration says more about the fleet than the internet: measurement probes come from a handful of hardware models. The first number does not. Where this old recipe still runs, three addresses in four carry a registered maker's block, in the clear, in every request. It still runs widely: on home lines in the same register, 83.0 percent of IPv6 addresses are built this way.
| What we read | All probes | Home lines |
|---|---|---|
| Addresses built this way | 4,334 | 1,606 |
| From a registered vendor address | 75.1 percent | 76.6 percent |
| From a locally administered one | 24.9 percent | 23.4 percent |
| Distinct vendor blocks | 147 | 72 |
Randomisation, and what it actually changes
Phones and laptops now invent a hardware address per network instead of using the one from the factory. That is the quarter of the addresses above with the local bit set. On the link it works: the network cannot recognise the same device coming back, and the maker is no longer named.
It is worth being clear about what it does not do. Randomising the hardware address changes nothing a website sees, because the address never reached the website. The standards make the same point from the other side. Identifiers elsewhere in a connection "can enable device tracking even if the device administrator takes care of randomizing other potential identifications like link-layer addresses or IPv6 addresses".
What this means when you work through a proxy
Nobody blocked you because of your MAC address. It stopped at your router, and a site that claims to read it is reading something else. Changing it is a local-network move, useful on a captive portal, useless against a website.
The question worth asking is the IPv6 one. Say your machine still builds its address from the hardware and your traffic leaves over IPv6. A stable identifier naming your interface's maker goes out with it, and no IPv4 proxy touches that. Test which address a site actually sees rather than assuming the proxy caught everything.
How HProxy handles it
We never see your MAC address and neither does the site you are visiting. What is worth checking with us is the IPv6 half. Our leak test shows which address a target really receives, and that is where a hardware-derived identifier would show up.
Frequently asked questions
What is a MAC address?
A 48-bit address carried by a network interface, used to move frames between machines on the same link. The first three bytes name the maker.
Can a website see my MAC address?
No. A router strips the link-layer header at the first hop, so the address never travels. The one exception is an IPv6 address built from it, which carries a converted form of it everywhere.
Does changing my MAC address hide me online?
Not from a website, because your address never reached it. It changes what your local network sees, which is why it helps on a captive portal and nowhere else.
What is an OUI?
The registered block at the start of a globally unique address, three bytes handed to an organisation. It is what makes a hardware address name its maker.
What is a private or randomised Wi-Fi address?
An address the device invents per network instead of using the factory one. It has the local bit set, names no maker, and stops the network recognising the same device.
Is a MAC address unique?
A registered one is meant to be, being a maker's block plus its own numbering. A randomised one is not, and makes no such claim.
What is the ff:fe in my IPv6 address?
The marker the old recipe inserts into the middle of a hardware address to make an interface identifier. It is the sign that your address was built from your network card.
Does a proxy hide my MAC address?
There is nothing to hide: it never left your link. A proxy matters for the address a site does see, which is the IP address.
Sources
- RFC 7042: IANA Considerations and IETF Protocol and Documentation Usage for IEEE 802 Parameters, IETF Best Current Practice (D. Eastlake 3rd, J. Abley), 2013-10.
- RFC 1812: Requirements for IP Version 4 Routers, IETF Standards Track (F. Baker, Ed.), 1995-06.
- RFC 4291: IP Version 6 Addressing Architecture, IETF Draft Standard (R. Hinden, S. Deering), 2006-02.
- RFC 8981: Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6, IETF Standards Track (F. Gont, S. Krishnan, T. Narten, R. Draves), 2021-02.
- RFC 7844: Anonymity Profiles for DHCP Clients, IETF Standards Track (C. Huitema, T. Mrugalski, S. Krishnan), 2016-05.
- Hardware-derived interface identifiers in the public RIPE Atlas probe register, HProxy measurement, 2026-09-20.
Back to the full glossary.