nullcipher

MAC addresses (00:1A:2B:3C:4D:5E)

Six hex pairs joined by colons or dashes, or Cisco's 001a.2b3c.4d5e; IPv6, times and hashes are left alone. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: MAC address

What an AI chat would receive after masking

[MAC_1]

1 × MAC address found and masked.

How nullcipher recognises it

Exactly six pairs of hex digits joined by one kind of separator throughout — colons (00:1A:2B:3C:4D:5E) or dashes (00-1A-2B-3C-4D-5E) — or three groups of four hex digits joined by dots as Cisco writes them (001a.2b3c.4d5e, which must contain at least one letter a–f so a dotted version number is not taken). The run must not continue into more hex groups, so IPv6 addresses (masked first by their own rule), times like 12:34:56.789, git hashes and colon-separated fingerprints are left alone. ff:ff:ff:ff:ff:ff and 00:00:00:00:00:00 identify nothing and are skipped. Pattern-based: misses a MAC written without separators (001A2B3C4D5E) or with spaces between the pairs; may flag six two-digit numbers joined by colons or dashes that are not a MAC.

This is the rule text of the “MAC address” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

00-00-5E-00-53-2A

nullcipher replaces it with [MAC_1]. 00-00-5E-00-53-00 through 00-00-5E-00-53-FF is the block IANA sets aside for documentation (RFC 7042, kept unchanged by RFC 9542, which replaced it in 2024), so this address belongs to no device.

Why it matters in an AI chat

A MAC address is the hardware address of one network interface. Its first three bytes are the maker's registered prefix (the OUI), so anyone can look up whether a4:83:e7:… is an Apple, Intel or Raspberry Pi interface, and the rest was burned in for that one card. Unlike an IP address it does not change when the machine moves between networks — except where the operating system deliberately randomises it for Wi-Fi.

That makes it a tracking handle: the same MAC in two logs is the same device. Some networks also use it as a key, letting a device in or giving it a fixed address because of its MAC; the address is sent in the clear on the local network and is easy to copy onto another device, so knowing it is enough to impersonate that device to such a network.

Output from ip link, ifconfig, ipconfig /all, DHCP logs and switch tables is full of them, and the AI rarely needs the value to explain the problem. nullcipher gives each address its own placeholder, so the AI can still tell two interfaces apart. The rule is strict on purpose — exactly six pairs, one separator — because times like 12:34:56.789, IPv6 addresses and git hashes are also runs of hex and colons.

If it already leaked

  1. There is nothing to revoke, and a built-in MAC cannot be changed for good.
  2. If a network lets devices in because of their MAC address, do not rely on that alone: a known MAC can be copied. Use WPA2/WPA3 or 802.1X credentials instead.
  3. For a phone or laptop, turning on the operating system's private (randomised) Wi-Fi address for that network gives it a different MAC there from then on.

Sources

  1. RFC 7042: IANA Considerations and IETF Protocol and Documentation Usage for IEEE 802 Parameters (section 2.1.2: 00-00-5E-00-53-00 through 00-00-5E-00-53-FF for documentation) — checked 2026-09-26.
  2. RFC 9542, which obsoletes RFC 7042 and keeps the same documentation range — checked 2026-09-26.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 242 detectors, with a page for 59 secret types, and how to delete a chat you already sent.

Made with AI tools.