MAC Address Vendor Lookup
An unknown device on your home Wi-Fi, or on the router in your Airbnb or hotel room: paste its hardware address and see who made it, straight from the IEEE registry. The lookup runs in your browser; the address is not sent to us or to anyone.
The app runs this lookup on every device it finds on the Wi-Fi you are on, at home or in a rental, then adds what the address alone cannot tell you: the device's name, the services it advertises, whether it looks like a camera, and the ports it has open. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.
What a MAC address vendor lookup can and cannot tell you
The first three bytes of a hardware address are an Organizationally Unique Identifier, bought from the IEEE by whoever built the network chip. That is usually the company whose name is on the box, but not always: a smart plug shows up as Espressif or Tuya because those companies make the Wi-Fi module inside it, and a security camera from a no-name brand shows up as whichever contract manufacturer assembled the board. The lookup tells you who made the radio. Working out what the product is takes the device's hostname, its mDNS services or its open ports, which is what a network scanner adds on top.
Why so many devices show no vendor
Since iOS 14, Android 10 and Windows 10, phones and laptops use a different random address on each Wi-Fi network by default. These addresses have the locally administered bit set (the second hex digit is 2, 6, A or E) and belong to nobody. If your router's device list is full of "unknown" entries with addresses like that, they are almost certainly your own phones and laptops rather than intruders. To confirm, open the device's Wi-Fi settings and compare.
MA-L, MA-M and MA-S
IEEE sells address blocks in three sizes. MA-L is the classic 24-bit OUI with 16.7 million addresses, which large manufacturers buy. MA-M and MA-S are 28-bit and 36-bit blocks with about a million and four thousand addresses, sold to smaller companies and carved out of reserved MA-L ranges. A lookup has to try the longest prefix first, otherwise a MA-S owner is misreported as the holder of the parent block. This tool checks all three.
Reading the two flag bits
The least significant bit of the first byte marks multicast: a destination that many interfaces listen to, never a device's own address. The next bit marks a locally administered address, one set by software rather than burned in at the factory. Virtual machines, containers, bonded interfaces and the randomised addresses above all set it. A burned-in unicast address has both bits clear, which means the first hex pair is one of 00, 04, 08, 0C and so on.
Where the data comes from
The tables are generated from the IEEE's own registry files (standards-oui.ieee.org) and split by the first byte so a lookup fetches a few kilobytes rather than the full two-megabyte list. The snapshot date is shown above the input. Assignments made after that date will not resolve until the tables are regenerated.