Six bytes, and why the spelling never matches
A MAC address is 48 bits, written as 12 hexadecimal digits. Everything else about the notation is convention, and the conventions disagree. Colons between single bytes is the most widespread form. Hyphens between single bytes is what IEEE documents and Windows tooling use. Four digits separated by dots, in three groups, is the Cisco form. Bare with no separators turns up in logs, filenames and anywhere a separator would have been inconvenient. Case is decorative and both are accepted everywhere, though lowercase has become the default in most current tooling.
Since none of the formats carries information the others lack, the only reason this matters is that configuration interfaces are picky. A field that wants colons will reject dots without explaining why, and a text comparison between two spellings of one address fails. Normalise before storing, and store one form.
The two bits that change what the address means
The last two bits of the first octet are flags, and reading them is the difference between understanding an address and copying it.
The lowest bit is the individual/group bit. Zero means the address identifies one interface. One means it is a group address — a multicast destination that many interfaces may accept, or the all-ones broadcast address. A group address is never valid as the source of a frame, so seeing one in a source field means something is broken or forged.
The second-lowest bit is the universal/local bit. Zero means the address was assigned from a block allocated to a manufacturer, and the first three octets identify that block. One means the address was chosen locally by software, and the first three octets identify nothing at all. In hex this shows up in the second character of the address: 0, 4, 8 and c in that position are universal individual addresses, while 2, 6, a and e are locally administered ones. Once you have seen it, 02: at the start of an address is unmistakable.
Randomised addresses, and why device tracking got harder
Locally administered addresses used to be rare — a virtual interface, a container, a bonded pair, an appliance that generated its own. Now they are ordinary, because phones and laptops generate a fresh random address per network to avoid being followed between locations by their hardware identifier. Those addresses have the local bit set and the group bit clear, so they look like 02:, 06:, 0a: or 0e: in the first octet, with random bits after.
Anything that identified a device by its address needs rethinking in that light. An access list keyed on a MAC will not recognise a phone that rotates, an inventory keyed on one will grow duplicates, and a manufacturer lookup on a randomised address returns nothing useful even when it returns something. This is a change in what the field means, not a fault to be worked around.
OUI, and what a lookup can and cannot say
The first three octets of a universally administered address are an Organisationally Unique Identifier, a block bought from IEEE by whoever makes the hardware. The remaining three octets are the manufacturer's to allocate. Knowing the OUI tells you which company registered the block. It does not tell you what the device is: the company may be a chipset vendor whose parts sit inside hardware from a hundred other names, and a block is often decades old and reassigned internally many times over.
This tool does not include the OUI list and does not look one up, because everything here runs in the page and no request is made anywhere. The list is published and is large; identifying a block means consulting it separately, and reading the answer with the caveats above in mind.
EUI-64, and the bit that gets flipped
IPv6 originally derived a 64-bit interface identifier from a 48-bit MAC by inserting ff:fe between the third and fourth octets and inverting the universal/local bit. The insertion is easy to spot. The inversion is the part that surprises people: a manufacturer address has the bit clear, so the derived identifier has it set, and the first octet changes value in a way that looks like an error. 00:1a:2b becomes 02:1a:2b, and an address that was never locally administered ends up with the local bit set in its IPv6 form.
The derivation is largely historical now. Current operating systems generate an opaque, stable-per-network identifier instead, or a temporary one that rotates, precisely because embedding a hardware identifier in a globally routable address made devices trivially trackable across networks. The derivation is shown here because it still appears in older documentation, in fixed appliance configurations, and in link-local addresses on some equipment — not because it is what you should expect to see on a modern interface.
Questions people ask
What does an address starting 02: mean?
That the locally administered bit is set: the address was chosen by software rather than taken from a manufacturer block. Virtual interfaces, containers, bonded links and randomised client addresses all look like this. The practical consequence is that the first three octets are not a manufacturer identifier, so a registry lookup on them is meaningless, and the address may not be stable — a device that randomises will present a different one on a different network.
Why do the same devices show different MAC addresses on different networks?
Because most current phones and laptops generate a random, locally administered address per network by default. It stops a device being followed between locations by a permanent hardware identifier. The address is usually stable for that one network so the device keeps its lease, and different everywhere else. Anything that keys on a MAC to recognise a device has to account for this rather than treating it as a fault.
Can two devices have the same MAC address?
They are not supposed to, and it happens. Manufacturer blocks are allocated to avoid it, but duplicates appear from cloned hardware, from virtual machines whose configuration was copied, and from locally administered addresses generated with a poor source of randomness. On one link a duplicate causes traffic to be delivered to the wrong place intermittently, which is a distinctive and unpleasant symptom. Addresses only need to be unique on a single link, since they are not carried beyond a router.
Which format should I store an address in?
Pick one and normalise everything to it on the way in. Lowercase with colons is the most widely accepted and the most common in current tooling. What matters is not which you choose but that you choose, because comparisons are string comparisons and 00:1A:2B and 001a.2b3c are not equal to anything expecting the other form. Reformat only at the boundary where a particular interface demands its own shape.
Does this tell me the manufacturer?
No. Doing that means consulting the published OUI registry, which is a large external dataset, and this page makes no requests at all — everything you type stays in the browser. It will tell you whether the first three octets are a manufacturer block in the first place, which is the more useful answer, because on a locally administered or randomised address no lookup can return anything meaningful.