MAC Address Lookup
Paste the device list from your router, arp -a or ip neigh and this names the maker behind every MAC address, flags camera, microphone, wearable and smart home vendors, and marks randomised and virtual addresses.
Nothing you paste leaves this tab. The registry downloads once; every lookup runs locally. Registry: waiting to load.
No addresses yet
Paste the client list from your router's DHCP or Attached Devices page, or tap a sample to see what a result looks like.
How the MAC lookup works
The first six hex digits of a MAC address (the OUI) are assigned to a manufacturer by the IEEE. This page downloads a copy of that registry once, about 380 KB compressed, and keeps it in your browser tab. Every lookup after that runs locally, so the addresses you paste are never sent anywhere.
The parser finds every address in the text, in any of these spellings: aa:bb:cc:dd:ee:ff, the macOS form a:b:c:d:e:f, AA-BB-CC-DD-EE-FF, Cisco aabb.ccdd.eeff and bare aabbccddeeff. Duplicates collapse into one row, and the rest of each line (an IP, a hostname, a port) is kept as the row's label.
An IPv6 address whose interface ID contains ff:fe (EUI-64) embeds the device MAC. The page recovers it by removing fffe and flipping the local bit back.
Data is the Wireshark manuf file, tracking the IEEE listing: about 39,800 24-bit (MA-L) prefixes. On 28-bit and 36-bit blocks the vendor shown is the 24-bit holder, often a contract manufacturer. Categories are ours, applied to a short list of well-known vendors. An untagged vendor is simply untagged.
How to read the result
- A vendor names who made the network chip. It says nothing about what the device is doing. Vendors relabel, so a camera sold under one brand often carries its chipset maker's prefix.
- Flagged rows come from a camera, microphone or speaker, wearable or smart home vendor. Match each one to something you own.
- Randomised means the local bit (second-lowest bit of the first octet) is set: a second hex digit of 2, 6, A or E. Phones do this per network by default since iOS 14 and Android 10. Windows and Linux can do it too when the setting is switched on. There is no manufacturer to look up.
- Virtual rows match well-known hypervisor or container conventions (VMware, VirtualBox, Hyper-V, Xen, QEMU/KVM, Docker). Multicast rows (odd first octet) are destinations such as IPv4 or IPv6 multicast groups and LLDP, and are no device at all.
- No registry entry means unidentified. Read it as unknown, since an unlisted prefix says nothing about whether the device is safe.
Getting the list out of your router. Routers list clients under DHCP, Attached Devices or Client List. Paste the table whole. On a computer: arp -a (Windows, macOS, Linux), ip neigh (Linux, includes IPv6 neighbours), show mac address-table (Cisco switch). These miss quiet devices, guest networks and anything on its own cellular modem.
MAC lookup FAQ
Does the MAC lookup send my addresses anywhere?
No. The page downloads the vendor registry once and every lookup runs in your browser tab. Nothing you paste is sent to pwnsy or anyone else.
Can a MAC vendor tell me a device is a hidden camera?
No. A vendor names who made the network chip, which says nothing about what the device is doing. Vendors relabel, so a camera sold under one brand often carries its chipset maker's prefix. A camera vendor flag is a lead to follow up, and an untagged vendor is simply untagged.
What does a randomised MAC address mean?
The device chose its own address: the second hex digit is 2, 6, A or E. Phones do this per network by default since iOS 14 and Android 10. Windows and Linux can do it too when the setting is switched on. Either way there is no manufacturer to look up.
Which formats can I paste?
Colon, hyphen, Cisco dotted and bare hex MACs, the macOS arp form with leading zeros dropped, and IPv6 addresses with an EUI-64 interface ID. Paste a whole router table, arp -a, ip neigh or show mac address-table output; the rest of each line is kept as a label.
What does no registry entry mean?
The prefix is absent from the 24-bit registry: newly assigned, part of a 28-bit or 36-bit block, or made up. Read it as unknown, since an unlisted prefix says nothing about whether the device is safe.
Vendor prefixes from the Wireshark manuf file (IEEE MA-L registry). Categories are ours. No address is sent to pwnsy or anyone else.