IPv6 ULA Generator: Create RFC 4193 Private /48 Prefixes Online
Generate RFC 4193 IPv6 Unique Local Addresses (fd00::/8) from a MAC address and timestamp via SHA-1. Get your /48 prefix with first and last host — reproducible and fully in-browser.
Table of Contents
Every IPv6 project eventually needs private address space — a homelab, an isolated test bench, a site-to-site VPN — and guessing a prefix by hand invites collisions later. RFC 4193 answers this with Unique Local Addresses (ULAs), the IPv6 equivalent of RFC 1918 private IPv4 ranges, all living inside fd00::/8. The free IPv6 ULA Generator builds a standards-based /48 for you in seconds.
Instead of inventing a memorable-looking prefix like fdab:1234::/48, the tool follows the RFC 4193 recipe: it combines your MAC address with an NTP-style timestamp and hashes the result with SHA-1, computed entirely in your browser. The output is an fd00::/8 ULA /48 prefix (for example, fd9f:3ac2::/48) together with the first and last host of that allocation.
Generation is also deterministic: supply the same MAC plus the same numeric seed (a timestamp in milliseconds) and you get exactly the same prefix every time. That makes results auditable, re-derivable, and safe to embed in documentation or automation — and nothing ever leaves your machine.
Why Use the IPv6 ULA Generator?
- Standards-compliant by construction — the tool applies the RFC 4193 algorithm, folding a MAC address and an NTP-style timestamp through SHA-1 so your global ID behaves as the spec intends.
- Reproducible seeding — the same MAC plus the same seed always yields the same /48, ideal for runbooks, IPAM records, and config-as-code.
- Complete output in one pass — you receive the /48 prefix plus the first and last host, eliminating manual hexadecimal math.
- Fully private processing — SHA-1 runs locally in your browser; nothing is sent to a server and no signup is required.
- Collision-aware randomness — 40 bits of hashed entropy slash the odds of overlapping another network, unlike hand-picked "neat" prefixes.
- Free and instant — open the page, enter a MAC, and generate as many prefixes as you need.
Key Features
The generator wraps the RFC 4193 algorithm in a deliberately minimal interface.
| Feature | What it does |
|---|---|
| MAC address input | Your interface MAC supplies the per-site entropy required by RFC 4193. |
| Numeric seed | An optional timestamp in milliseconds makes results deterministic and reproducible. |
| In-browser SHA-1 | The MAC and timestamp are combined and hashed locally — no network calls. |
| /48 ULA prefix | Outputs an fd00::/8 allocation such as fd9f:3ac2::/48. |
| First and last host | Shows the exact boundaries of your /48 so the range is easy to document. |
- The seed works as a version knob: bump it to mint a fresh prefix, keep it fixed to re-derive an existing one.
- Because hashing is client-side, the page works offline once loaded and suits air-gapped or restricted environments.
- Output is copy-ready for router configurations, DHCPv6 scopes, firewall rules, and IPAM spreadsheets.
How to Generate a ULA Prefix
- Open the IPv6 ULA Generator in any modern browser — it is free and requires no signup.
- Enter a MAC address in any common format (colons, dashes, or bare hex). It anchors the global ID to your environment, exactly as RFC 4193 intends.
- Add an optional numeric seed, typically the current timestamp in milliseconds. Remember the rule: same MAC plus same seed equals same prefix.
- Click generate. The tool combines your inputs, hashes them with SHA-1 in-browser, and displays an fd00::/8 /48 prefix such as fd9f:3ac2::/48 alongside the first and last host.
- Record the result. Save the prefix and its MAC-plus-seed derivation, then deploy the /48 to your router, firewall, or VPN configuration.
Understanding RFC 4193 and fd00::/8
What ULAs are. RFC 4193 defines Unique Local Addresses as IPv6's answer to private IPv4 space. Just as RFC 1918 carved out 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for internal use, ULAs occupy fd00::/8 for networks that should never touch the public internet — yet they are statistically unique worldwide, which keeps future network merges painless.
Anatomy of fd00::/8. A ULA splits into four parts:
- Prefix byte (8 bits): fc00::/7 is reserved for ULAs; its low bit is the L flag. Locally assigned addresses set L to 1, producing the fd prefix — hence fd00::/8.
- Global ID (40 bits): a pseudo-random value distinguishing your site from every other. The RFC 4193 recipe derives it by SHA-1 hashing an NTP-format timestamp concatenated with a MAC address — precisely what this generator implements.
- Subnet ID (16 bits): your own partitioning space of 65,536 /64 subnets.
- Interface ID (64 bits): the host portion, normally handled by SLAAC or DHCPv6.
Why /48 allocations. The recommended site allocation is a /48 — the fd byte plus the full 40-bit global ID — leaving the entire 16-bit subnet ID for you. That yields 65,536 /64 subnets, ample for any homelab and most enterprises.
Why randomness matters. When two organizations independently choose fd01:2345::/48 because it looks tidy, a later VPN merge becomes an addressing nightmare. Hash-derived global IDs make collisions vanishingly unlikely without any central registry or coordination.
Reproducible seeding. A cryptographic hash is deterministic: feed it the same MAC and timestamp and it returns the same 40 bits. The generator exposes this as a seed, so a prefix can always be recomputed rather than hunted through old notes.
A typical result looks like:
ULA prefix: fd9f:3ac2::/48 First host: fd9f:3ac2:: Last host: fd9f:3ac2:ffff:ffff:ffff:ffff:ffff:ffff
Practical Use Cases
Homelab IPv6 Rollout
Dual-stack your home network without waiting on your ISP. Assign the generated /48 to your router, then carve one /64 per VLAN — management, servers, IoT, guests. Because ULAs are independent of provider delegations, internal addressing stays stable even when the ISP's global prefix rotates, and the first/last host output gives you clean boundaries for firewall rules.
VPN Mesh Addressing
WireGuard-style meshes need stable internal space across sites. Generate one /48 per site from that router's MAC with a distinct seed, then reuse the same subnet ID per VLAN on both ends of the tunnel. Hash-derived global IDs keep the odds of two sites colliding vanishingly small as the mesh grows.
Lab and Test Environments
Cloned VMs and restored snapshots inherit old configurations; a ULA namespace isolates labs from production global addresses and from each other. Reproducible seeds shine here: continuous-integration jobs that rebuild a topology with the same MAC and seed land on the identical prefix, so saved configs apply without edits.
Migrating from RFC 1918 IPv4
Moving an RFC 1918 estate to IPv6? Map your VLAN numbering straight into the subnet ID — VLAN 10 becomes subnet 000a, VLAN 20 becomes 0014, and so on — then run dual-stack while applications catch up. Use the first and last host values to size address ranges and update ACLs methodically. Remember that ULAs are not NAT: nothing translates them, which is exactly the point.
Best Practices
- Document the derivation, not just the prefix. Store the MAC and seed beside the /48 in your IPAM so anyone can re-derive it.
- Always set a seed. It makes your prefix auditable and reproducible instead of a one-off output you cannot recreate.
- Allocate one /48 per site. Subdivide using the 16-bit subnet ID rather than inventing extra global IDs.
- Keep ULAs inside your perimeter. Filter fd00::/8 at border routers; ULAs are never meant for global routing.
- Stick to /64 subnets. SLAAC and many tools assume a /64 boundary, and 65,536 available subnets leaves no reason not to.
- Check for collisions before merging networks. Compare prefixes across sites; regenerate with a new seed if any overlap appears.
Ready to Generate Your ULA Prefix?
Whether you are wiring a homelab, stitching together a VPN mesh, or planning an IPv6 migration, a well-chosen ULA /48 saves hours of renumbering pain. Head to the IPv6 ULA Generator, drop in a MAC address, add a seed, and take home a standards-compliant, fully reproducible fd00::/8 prefix — computed entirely in your own browser.
Related Tools You Might Like:
Explore these companions: IPv6 Expander for expanding compressed IPv6 addresses into full form, Subnet Calculator for masks, ranges, and host counts, and MAC Address Lookup to identify the vendor behind any MAC you feed the generator.
Happy networking!
Frequently Asked Questions
Q: Are ULA addresses routable on the public internet?
A: No. RFC 4193 ULAs are designed for site-internal use — LANs, labs, and VPNs — and should be filtered at your border. They never substitute for globally unique addresses from your ISP or RIR.
Q: Why does the tool use SHA-1 instead of a newer hash?
A: SHA-1 is exactly what RFC 4193 specifies for deriving the 40-bit global ID from a timestamp and MAC. The construction needs only a well-distributed deterministic hash, so compliance, not password security, is the goal.
Q: What happens if I change the seed?
A: The hash input changes, producing a different global ID and therefore a different /48. The same MAC plus the same seed, however, always reproduces the identical prefix.
Q: Is fd00::/8 the same as fc00::/8?
A: Not quite. ULA space is fc00::/7, and its low bit is the L flag. Locally assigned addresses must set L to 1, which yields the fd prefix — so fd00::/8 is the only range you should self-assign.
Q: Can I share one /48 across multiple sites?
A: You can, but the RFC intends one /48 per site. Since generation is free, mint a separate prefix per site from that site's MAC and keep the subnet ID for VLANs.