everyday mac tools

Private Wi-Fi address on a Mac explained, and when to turn it off

· 6 min read

A private Wi-Fi address is a made-up hardware address your Mac shows to a Wi-Fi network instead of the one built into its wireless chip. It stops networks from recognizing your Mac across places by one permanent number. Leave it on for almost every network. Turn it off, or set it to Fixed, only when a network manages access by address and your Mac can’t get online.

What the address is, and why it’s hidden

Every network interface has a hardware address, also called a MAC address, a string of six pairs of characters such as a1:b2:c3:d4:e5:f6. Every Wi-Fi network you join sees it, and a permanent one lets a network, or anyone who runs several networks, recognize the same device in a cafe, an airport and a hotel.

With a private address, macOS uses a different address for each network, generated for that network only. Each network sees its own address and can’t match it to the Mac’s real hardware address or to the other networks you’ve joined.

The three choices

Apple’s support page lists the choices for the Mac as Off, Fixed and Rotating:

  • Off. “When set to Off, your device uses its hardware MAC address.” Apple’s Mac User Guide spells out the cost: the Mac “can be identified and tracked on this network, and across other networks.”
  • Fixed. The Mac uses a private address for that network, and it doesn’t rotate, regardless of the network’s security or how long it has been since the Mac last joined. That network can recognize your Mac from visit to visit; other networks can’t link it.
  • Rotating. The private address rotates to a different one every 2 weeks, so even the same network sees a new device from time to time.

macOS picks for you when you join a new network. Apple says it chooses Fixed for a network that uses WPA2 or stronger security, and Rotating for a network with weak security or none. The setting is stored per network, so changing it for your home Wi-Fi doesn’t change the cafe’s.

On the Mac, Apple lists macOS Sequoia 15 or later for these three choices. If you tell your Mac to forget a network, it also forgets the private address it used there, so the next join gets a new one (Apple’s page notes an exception if you forgot the same network less than 24 hours earlier).

Where to find it

  1. Choose Apple menu, then System Settings.
  2. Click Wi-Fi in the sidebar.
  3. Click the Details button next to the network you’re connected to. On some versions the button reads More Info. For a saved network you aren’t on, click the More button next to its name, then Network Settings.
  4. Choose Off, Fixed or Rotating from the “Private Wi-Fi address” pop-up menu, then click OK.

If the menu is dimmed or missing, the Mac may be managed by a school or organization. Apple says a managed Mac may not be able to change the setting, and that organizations can turn the feature off for enrolled devices with a network profile. The Wi-Fi menu can then report “Private Wi-Fi address is turned off for this network, by your network provider.”

When to turn it off or use Fixed

Most people never need to. Reach for it when something tied to the Mac’s identity stops working.

  • Home router filtering by address. If you set the router to allow only listed devices, or reserved a fixed IP address for the Mac, the router sees an address it doesn’t know. Either add the private address to the list, or set that network to Off.
  • Parental controls or schedules that are tied to a device’s address.
  • A captive portal that keeps asking you to sign in again. It remembers your Mac by address, and a rotating address looks like a new device. Fixed is the gentler change, since the address stays the same.
  • Office or campus networks that only allow registered devices. Ask the network’s administrator whether the Mac’s private address can be registered.

macOS knows about this problem. When a network has no internet, the Wi-Fi menu’s advice includes: “If your network access is managed by Wi-Fi address (also known as ‘MAC Address’), you may need to turn off private Wi-Fi Address or modify your network settings.” If your Mac joined the network but nothing loads, that note is where to start. For networks you don’t run, Apple’s position is that the organization should update its Wi-Fi security to work with private addresses.

See the address your Mac is using

In Terminal, run:

ifconfig en0 | grep ether

It prints one line starting with ether, followed by the address. On many laptops en0 is Wi-Fi, but that isn’t guaranteed. networksetup -listallhardwareports lists each port with its device name, so look for the Wi-Fi entry if the line looks wrong. Run it again after changing the setting to see whether the address changes.

A private address is usually recognizable: its first byte has the “locally administered” bit set, which shows up as a 2, 6, A or E in the second character, as in a6:... on this Mac. A hardware address from the manufacturer doesn’t follow that pattern.

If you travel with a Mac and use many public networks, setting up a Mac you will travel with has more on getting ready. The Mac firewall and naming your Mac cover other things public networks can learn about it.

Questions

What is a private Wi-Fi address on a Mac? It’s a made-up hardware (MAC) address that macOS uses for a Wi-Fi network instead of your Mac’s real one. Each network sees a different address, so networks can’t recognize your Mac across locations by one permanent number.

Should I turn off the private Wi-Fi address? Usually not. Turn it off, or use Fixed, only if a network controls access by hardware address, such as router filtering, parental controls or an office network, and your Mac can’t connect or keeps being asked to sign in.

What’s the difference between Fixed and Rotating? Fixed keeps the same private address for a network, regardless of how long since you last joined. Rotating changes it every 2 weeks, according to Apple. Fixed is the default on WPA2 or stronger networks, Rotating on weak or open ones.

Why is the private Wi-Fi address option dimmed? The Mac is probably managed by an employer or school, and an administrator has set a policy for the network. Ask your administrator. The setting is also per network, so check you’re on the Details pane for the network you want.