Search for ways to secure your Wi-Fi and this advice almost certainly appears: list the addresses of devices allowed in, and reject the rest. It sounds convincing — like a guest list at the door.
The idea is reasonable. What makes it less effective than it looks is one small detail about how that address is transmitted.
What's actually being filtered
Every network device has a MAC address — six pairs of letters and numbers assigned at the
factory, such as A4:5E:60:1B:2C:3D. Devices use it to recognise each other within a
local network.
MAC filtering works by comparing that address against a list you create. There are two modes:
- Allow list — only listed addresses may join, everything else is rejected.
- Deny list — everything may join except the listed addresses.
So far it sounds like a meaningful layer of protection. The problem lies in when that address is checked.
Why the protection is thin
MAC addresses are transmitted before encryption engages, and remain readable even on a WPA3 network. They're part of the opening exchange that must happen in the clear so the device and router can find each other.
That means anyone within signal range who listens to the airwaves can see the list of addresses currently connected. No password needs breaking for that.
And MAC addresses can be changed. On nearly every operating system, changing one is an ordinary setting — not an exploit but a provided feature. Someone wanting in only needs to copy one of the visible addresses.
The bigger danger is false confidence. People who believe their network is protected by a device list tend to postpone the things that genuinely protect it — replacing a weak password, turning off WPS, or updating firmware. That's where the real loss lies.
The maintenance burden is real
Setting security aside, there's a daily cost rarely accounted for.
Randomised MAC addresses break the list. Android and iOS from recent years use a different address per network to prevent tracking, and some rotate it periodically. A device allowed in yesterday can be rejected today with nothing changed on your side.
To work around it, each device must be set to use a fixed address for your network — meaning turning off a privacy feature designed to protect that same user elsewhere.
Every guest becomes an errand. A visiting friend can't simply be given the password. You need to find their phone's MAC address, open the router panel, and add it manually.
New devices are always held up. Every phone, television, or smart plug that arrives needs an extra step before it can be used.
Compared with what actually works
| Measure | Protection | Maintenance |
|---|---|---|
| Long password + WPA3 | High | Set once |
| Turning off WPS | High | Set once |
| Changing the router admin password | High | Set once |
| Updating firmware | High | Every few months |
| A separate guest network | Moderate | Set once |
| Hiding the network name | Very low | Complicates every new connection |
| MAC filtering | Very low | Continuous |
The bottom two rows give the least protection for the most effort. The top four resolve nearly all the real risk, and most only need doing once. The steps are in the guide to securing a home router, and encryption choice in the guide to WPA2 vs WPA3.
When it does make sense
Interestingly, MAC filtering does have genuine uses — just not as protection against outsiders.
As an organisational tool. Stopping a television or security camera drifting onto the wrong network as signal weakens, or making sure business equipment only uses the network it should.
As a limit for children. Keeping a particular tablet off the main network, combined with schedule restrictions. A more appropriate approach for that need is covered in the guide to parental controls on a router.
As an extra layer on an already secure network. If the password is strong, WPS is off, and firmware is current, adding a device list does no harm. It simply must not replace those steps.
Better answers to the same need
Most people considering MAC filtering actually want one of three things — and each has a better route:
- "I want to know who's using my Wi-Fi." The router's device list already answers that without filtering anything — the guide to seeing who's using your Wi-Fi.
- "I want to kick out a freeloader." Changing the password disconnects everyone at once, and can't be bypassed by changing an address — the guide to changing your Wi-Fi password.
- "I want to limit one device's usage." Per-device speed limiting is far more targeted — the guide to limiting Wi-Fi speed.
In short
MAC filtering screens out devices with no intent, and barely delays anyone determined to get in. Its burden is continuous, while its protection stops at a mild inconvenience.
If your time is limited — and it usually is — do the four things at the top of that table first. Once those are handled and you still want a device list, go ahead. The only mistake is doing it instead.
Frequently asked questions
Does MAC filtering make Wi-Fi safer?
Very marginally. MAC addresses are sent unencrypted every time a device talks to the router, so anyone listening can read and imitate them. It filters out devices that wandered in by accident, not someone determined to get in.
Why does my filter list keep breaking by itself?
Because modern phones use a randomised MAC address that differs per network, and some rotate it periodically. A device allowed in yesterday can be rejected today with nothing changed.
So what actually protects a network?
A long Wi-Fi password with WPA3 or WPA2-AES encryption, WPS turned off, the router's admin password changed from the default, and firmware kept updated. Those four provide real protection.
Is there any situation where MAC filtering is still useful?
Yes, but not as a security measure. It's useful as an organisational tool — keeping smart devices from drifting onto the wrong network, or keeping a child's tablet on one particular network.
