How to Change a MAC Address on Windows, Linux, macOS and Mobile Devices
A MAC address is a 48-bit network interface identifier used by devices to recognize one another inside a local network. People change it to reduce tracking on public Wi-Fi, remove a local device binding or test a network configuration during troubleshooting. Two limits matter: the address is visible only as far as the nearest router, while a remote website works with IP, cookies and the browser fingerprint.
What is a MAC address and can a website see it over the internet?
A regular website cannot obtain your MAC address. The address works at the data-link layer and appears only in frames traveling between the device and nearby equipment such as an access point, switch or router. The router takes that frame apart and creates a new one with its own address, so your identifier does not continue along the internet route.
The address is 48 bits long and is written as twelve hexadecimal digits, for example 00:11:22:AA:BB:CC. The first three octets are the OUI, a prefix assigned to the network controller vendor. The two least significant bits of the first octet have special roles: one marks a group address and the other marks a locally administered address. Randomization in Android and NetworkManager sets the locally administered bit and clears the group bit. The system is explicitly telling the network that the address was generated instead of burned into the hardware.
What does a website see instead? It receives the source IP address, cookies, HTTP headers including the User Agent, and browser parameters such as fonts, resolution, interface language and time zone. None depends on the MAC address. Changing the MAC address in Windows therefore does not change how an advertising platform fingerprints the browser.
How do you find the current MAC address?
Record the existing value before changing anything. Save it outside the network settings because you may need it if connectivity breaks. A remote site requires an IP and browser fingerprint test, not this procedure.
The table shows commands and settings for five systems. It also distinguishes the hardware address from a private address generated for one network. Every major system includes a native method, so third-party software is unnecessary.
| System | Where to check | What it shows |
|---|---|---|
| Windows 10 and 11 | run getmac /v /fo list in Command Prompt | physical address for each adapter and connection name |
| Linux basic tools | run ip link show wlp3s0 and ethtool -P wlp3s0 | current address in link/ether and factory address in Permanent address |
| Linux NetworkManager | run nmcli -f GENERAL.HWADDR device show wlp3s0 | address currently presented to the network |
| macOS Sequoia 15 and later | System Settings > Wi-Fi > Details | Private Wi-Fi Address mode for the selected network |
| iPhone and iPad with iOS 14 and later | Settings > Wi-Fi > More Info beside the network | Private Wi-Fi Address mode for that network |
| Android 10 and later | Network details for the selected network | randomization state and current connection address |
Keep the two concepts separate. The physical address is stored in the controller, remains the same for that interface, and appears under ethtool -P in Linux. A private address is what a particular network sees. A phone can use one private address at home and another in a coworking space. A browser fingerprint report will not show a MAC address because it operates at another layer of the stack.
How do you change or randomize a MAC address in Windows 11?
The native method is to enable Random hardware addresses in the Wi-Fi settings. Microsoft documents two independent controls, one global and one for an individual network. Both depend on support from the Wi-Fi adapter.
The global control applies while scanning and connecting to networks. Enable it in four steps.
- open the Settings app;
- select Network & internet;
- open Wi-Fi;
- enable Random hardware addresses
The narrower option enables a private address only for one saved network and takes effect at the next connection.
- open Network & internet;
- select Wi-Fi;
- open Manage known networks;
- choose the required network;
- enable Random hardware addresses for that network
A manual change is also possible, but it is a driver feature rather than a universal Windows feature. The adapter's advanced properties may contain a Network Address field, an NDIS keyword that accepts a value in XX-XX-XX-XX-XX-XX format, often without separators. The keyword is optional, so its absence does not mean the adapter is broken. If it exists, watch the second hexadecimal character: a locally administered unicast address normally uses 2, 6, A or E in that position, and drivers often reject other values.
After reconnecting, check the address again with getmac; otherwise, you have not verified that the change took effect.
How do you change a MAC address temporarily or persistently in Linux?
Linux offers two methods, and confusing them causes most reports that the address reverted. A one-time change uses the ip utility and lasts until a reboot or connection manager override. A persistent rule is stored in a NetworkManager profile through cloned-mac-address.
Use the temporary method first to confirm that the adapter accepts another address. Bring the interface down before changing it.
- show the current address with
ip link show wlp3s0; - record the factory address from
ethtool -P wlp3s0; - disable the interface with
sudo ip link set dev wlp3s0 down; - assign the address with
sudo ip link set dev wlp3s0 address 02:1a:2b:3c:4d:5e; - enable the interface with
sudo ip link set dev wlp3s0 up; - verify it with
ip link show wlp3s0
The persistent method works differently. NetworkManager applies the profile rule whenever it activates the connection.
- find the profile name with
nmcli connection show; - set the mode with
sudo nmcli connection modify "Home WiFi" 802-11-wireless.cloned-mac-address random; - disconnect it with
nmcli connection down "Home WiFi"; - reconnect it with
nmcli connection up "Home WiFi"; - check the result with
nmcli -f GENERAL.HWADDR device show wlp3s0
The setting accepts five modes plus an explicit address. Each produces different behavior when the connection is activated.
| Value | NetworkManager behavior |
|---|---|
preserve | keeps the current address during activation and is the default |
permanent | applies the permanent hardware address |
random | generates a new random address for every connection |
stable | derives an address from connection.stable-id and the machine key |
stable-ssid | derives an address from the SSID and works only for Wi-Fi |
| explicit address | applies a specified value such as 02:1a:2b:3c:4d:5e |
The difference between random and stable is practical. With random, the home router sees a new device every time and DHCP reservations stop working. With stable, the address remains consistent while the stable ID and machine key remain unchanged. The network can recognize the device, while another network receives a different value. Scan-time randomization is controlled by wifi.scan-rand-mac-address, which defaults to yes, and global profile defaults live in the [connection] section of NetworkManager.conf.
Verify after reconnecting, not immediately after the command. Bring the connection back up and inspect GENERAL.HWADDR. If the factory address returns, the connection profile probably overrides the manual change.
The distinction between a one-time change and a profile setting explains most cases in which the address unexpectedly returns.
How does a private Wi-Fi address work on macOS, iPhone and Android?
Apple devices and Android include MAC randomization and normally enable it by default. The system assigns a separate address to each network. No additional application, root access or jailbreak is required.
Apple calls the feature Private Wi-Fi Address. It is available on iPhone and iPad from iOS 14, on Apple Watch from watchOS 7, and on Mac from macOS Sequoia 15. Starting with iOS 18, iPadOS 18, macOS Sequoia 15, watchOS 11 and visionOS 2, the setting offers three modes. Off uses the hardware MAC address. Fixed uses a private address without rotation and is selected for networks with WPA2 or stronger security. Rotating changes the private address every two weeks and is used for weakly secured or open networks.
Change the mode in five steps.
- open Settings;
- select Wi-Fi;
- tap More Info beside the network;
- open Private Wi-Fi Address;
- choose Off, Fixed or Rotating
One detail is easy to miss. On iOS 18 and equivalent versions, forgetting a network also removes its private address only when more than 24 hours have passed since the previous forget operation.
Android introduced the feature in stages. Android 8.0 used a random address only during scanning. In Android 9, full randomization was a developer option and stayed off by default. Android 10 enables it by default for client mode, hotspot and Wi-Fi Direct, with a separate control for each network on its Network details screen. If it is disabled for that network, the device connects with its factory address.
Android supports persistent and non-persistent randomization. Persistent mode, the default, derives the address from network profile parameters such as SSID, security type and Passpoint FQDN. It remains until a factory reset, even if the network is forgotten and added again. Android 12 added non-persistent mode for two cases: an app requests it through a network suggestion, or the network is open without a captive portal and the vendor enabled a system overlay that is off by default. The address is regenerated at connection start when the DHCP lease has expired and the device has been disconnected for more than four hours, or when the current address is more than a day old. From Android 11, the Wi-Fi non-persistent MAC randomization developer option can enable that mode for all profiles.
For a phone used as a working device, MAC randomization handles one narrow problem. A different design covers the rest, including the division of tasks between a phone and a browser profile.
When should you change a router MAC and why can the internet stop working?
There is one common reason to clone a router's WAN MAC address: the internet provider has bound service to the first connected device and does not recognize a replacement router. Router firmware includes MAC Clone for that compatibility case. It is not a privacy feature.
The order matters, especially the first step.
- record the router's current WAN MAC address;
- save the record outside the router;
- open the router web interface;
- select WAN or Internet settings;
- find the option commonly called MAC Clone;
- enter the address of the device to which the connection was bound;
- save the settings and wait for the WAN connection to restart
Why can connectivity disappear? Provider equipment may hold an active DHCP lease for the old address and ignore the new one until the lease expires. Another case is worse. If you clone the address of a device that remains active in the same segment, two devices advertise the same identifier. The switch cannot decide where to send frames, so both connections become unstable. Clone an address only from a device that has been removed from the network.
A second consequence appears later. After a WAN MAC change, the provider may assign another IP from its pool, along with that IP's history. This rarely matters for ordinary home browsing, but before using sensitive platforms it can be useful to check the IP address reputation, because a poor history may trigger more CAPTCHAs or verification prompts.
The diagram marks the boundary: the MAC address stays on the local network, while the website works with IP and browser signals.
Why does changing a MAC address not provide browser anonymity?
Websites recognize browsers through another set of signals: IP address, cookies and local storage, browser and operating system versions, interface language, time zone, fonts and graphics rendering behavior. Those signals live above the data-link layer, and the MAC address does not alter them.
Consider two accounts on one platform and one laptop, with the MAC address changed between sessions. The platform still sees the same IP, time zone and fingerprint, and may also receive cookies left by the browser. The connection can be restored without using the MAC address at all. That is why changing a MAC address is not a browser anonymity method.
The browser layer requires a browser-level solution. Afina is an antidetect browser in which each working profile has its own cookies, storage, proxy and parameters used for fingerprint management. Afina does not change the operating system's MAC address and does not replace that function. They operate at neighboring but different layers. This material is for informational purposes: change an address only on a device you own or with the network administrator's permission, save the original value first and follow the network policy.
A practical combination is less dramatic than it sounds. Native MAC randomization covers the local layer in a cafe or airport, a proxy covers the network path, and an isolated profile covers the browser. Removing one layer leaves that layer's identifiers visible.
DownloadFAQ — Frequently Asked Questions
Why did the MAC address not change in the adapter settings?
The adapter driver may not support the optional NDIS Network Address keyword. Use the native Windows random hardware address feature when the field is absent.
Are administrator rights required to change a MAC address?
Yes for a manual change. Linux commands such as ip link set and nmcli connection modify require sudo, and Windows adapter properties require administrator access.
How do you restart a network interface after changing the address?
In Linux, run ip link set dev wlp3s0 down and then ip link set dev wlp3s0 up; for NetworkManager use nmcli connection down and nmcli connection up. In Windows, disable and enable the adapter.
How do you restore the factory MAC address?
In Linux, read it with ethtool -P and set the profile to permanent. In Windows, disable Random hardware addresses and clear the Network Address field.
Can you change a MAC address on a corporate network?
Only with the network administrator's permission. Corporate networks may bind access to specific addresses or use 802.1X, so a change can disconnect the device.
What happens if two devices use the same MAC address?
Connections become unstable within the same network segment because the switch cannot map frames to one device. Both devices may lose connectivity.
How is MAC spoofing different from built-in randomization?
MAC spoofing is a manual address substitution that lasts until restart or profile override. Built-in randomization generates and manages private addresses for networks automatically.
