MikroTik hotspot MAC authentication: automatic login by MAC address
Last updated: 2 October 2026
With MAC authentication the router tries to log a device in by itself, using its MAC address as the username, as soon as the device joins the network. The customer never sees the login page, but still has a user with a speed and limits.
How it works
When a new device appears in the hotspot host list, the router looks for a user whose name is the device's MAC address. If the login is accepted, the device is online. If it is refused, the device simply gets the normal login page, so MAC login can be mixed with ordinary usernames and vouchers on the same hotspot.
This is different from bypassing a device with IP binding. A bypassed device is outside the user system. A MAC-login device is a normal user: it shows in the active list and its profile, time and data limits apply.
Before you change a live router: take a backup (how) and turn on Safe Mode in Winbox, so a mistake that locks you out is undone by itself.
1. Turn on MAC login in the hotspot profile
/ip hotspot profile print
/ip hotspot profile set hsprof1 login-by=mac,cookie,http-chap,http-papReplace hsprof1 with the name of your profile. login-by replaces the whole list, so keep the methods you already use.
2. Choose what is sent as the password
| Setting | Username | Password |
|---|---|---|
mac-auth-mode=mac-as-username | the MAC address | the text in mac-auth-password (empty unless you set it) |
mac-auth-mode=mac-as-username-and-password | the MAC address | the MAC address again |
/ip hotspot profile set hsprof1 mac-auth-mode=mac-as-username mac-auth-password=MySharedWordor
/ip hotspot profile set hsprof1 mac-auth-mode=mac-as-username-and-password3a. With users stored on the router
Create a user whose name is the MAC address, written in capitals with colons, and whose password matches the mode you chose:
/ip hotspot host print
/ip hotspot user add name=AA:BB:CC:DD:EE:FF password=MySharedWord profile=5M comment="shop TV"With mac-as-username-and-password the password is the MAC address too:
/ip hotspot user add name=AA:BB:CC:DD:EE:FF password=AA:BB:CC:DD:EE:FF profile=5MThe profile gives the speed; see hotspot user profiles.
3b. With RADIUS
If the profile has use-radius=yes, the same request goes to the RADIUS server: username is the MAC address, password as set above. The server must have a user with that name. The way the address is written is set by radius-mac-format in the hotspot profile; the default is capitals with colons.
/ip hotspot profile set hsprof1 use-radius=yes radius-mac-format=XX:XX:XX:XX:XX:XXSee how RADIUS works with MikroTik for the server side.
Check that it worked
/ip hotspot active print
/log print where topics~"hotspot"A MAC login shows mac in the login-by column of the active list. A refused attempt is written to the log with the reason.
The private MAC address on phones
Modern phones and laptops use a private (random) MAC address, different for each Wi-Fi network and, on some settings, changing over time. The router only ever sees that private address. Two things follow:
- Take the MAC address from the router's host list while the device is connected, not from the label or the "about" screen of the device.
- If the customer forgets the network, resets network settings or has the address set to change, the MAC login stops matching and the login page comes back. Ask them to turn off private address for your network, or register the new address.
Do not treat it as security
A MAC address can be read from the air and copied to another device. Anyone who copies a registered address is logged in as that user. Use MAC login for convenience (TVs, consoles, long-stay customers), keep shared-users=1 on the profile, and do not put anything valuable behind it.
Where RadiusNest fits
In RadiusNest, MAC auto-login is a mode you can switch on per customer. That customer's device goes online without the login page and still has its package: speed, data, time and end date apply as for any other customer. The private-address caveat above is the same, because the router only reports the address the phone shows it.
Start the free trial See pricing
Questions and answers
What password does MikroTik send with a MAC login?
With mac-as-username it sends the text in mac-auth-password, which is empty by default. With mac-as-username-and-password it sends the MAC address as the password as well.
Why does the login page still appear for a registered device?
The MAC login was refused. Usual causes: the phone is using a different private MAC address, the user name is not written exactly like the address in the host list, or the password does not match the mode.
Is MAC authentication the same as IP binding bypass?
No. A bypassed device has no user and no limits. A MAC-authenticated device is logged in as a user, so its profile and limits apply.