diff --git a/bouncer/.gitignore b/bouncer/.gitignore
index d82d8f5..2ad94f4 100644
--- a/bouncer/.gitignore
+++ b/bouncer/.gitignore
@@ -1,4 +1,6 @@
 authorizer
 host-authorizer
+hash_mac_addr
+host-hash_mac_addr
 http_bouncer
 host-http_bouncer
diff --git a/bouncer/Makefile b/bouncer/Makefile
index f579e10..bda3d81 100644
--- a/bouncer/Makefile
+++ b/bouncer/Makefile
@@ -9,7 +9,7 @@
     fi \
 )
 
-TARGETS=authorizer http_bouncer
+TARGETS=authorizer hash_mac_addr http_bouncer
 
 HOST_TARGETS=$(addprefix host-,$(TARGETS))
 
diff --git a/bouncer/authorizer.py b/bouncer/authorizer.py
index ab727a0..f355917 100755
--- a/bouncer/authorizer.py
+++ b/bouncer/authorizer.py
@@ -67,7 +67,7 @@
 
   def check(self):
     """Check if a remote service knows about a device with a supplied MAC."""
-    logging.info('Checking TOS for %s', self.hashed_mac_addr)
+    logging.info('Checking TOS for %s', self.mac_addr)
     http_client = tornado.httpclient.HTTPClient()
     response = http_client.fetch(self.url, ca_certs=opt.ca_certs)
     response_obj = tornado.escape.json_decode(response.body)
@@ -79,7 +79,7 @@
       if accepted_time + (opt.max_age * 86400) > time.time():
         accepted = True
         if self.callback: self.callback.stop()
-        logging.info('TOS accepted for %s', self.hashed_mac_addr)
+        logging.info('TOS accepted for %s', self.mac_addr)
 
         known_users[self.mac_addr] = response_obj
         result = ip46tables('-A', opt.filter_chain, '-m', 'mac',
@@ -91,12 +91,12 @@
                         self.mac_addr)
       else:
         logging.info('TOS accepted too long ago for %s: %r',
-                     self.hashed_mac_addr, accepted_time)
+                     self.mac_addr, accepted_time)
 
     elif self.callback and self.tries > MAX_TRIES:
       if not accepted:
         logging.info('TOS not accepted for %s before timeout.',
-                     self.hashed_mac_addr)
+                     self.mac_addr)
       self.callback.stop()
 
     return response, accepted
diff --git a/bouncer/hash_mac_addr.py b/bouncer/hash_mac_addr.py
index 84fed1a..961bf10 100755
--- a/bouncer/hash_mac_addr.py
+++ b/bouncer/hash_mac_addr.py
@@ -6,14 +6,34 @@
 import re
 import sys
 
+import options
+
+optspec = """
+hash_mac_addr -a ##:##:##:##:##:##
+--
+a,addr= MAC address to hash
+"""
+
 
 def hash_mac_addr(maybe_mac_addr):
   if re.match('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$', maybe_mac_addr):
     mac_addr = maybe_mac_addr.lower()
   else:
-    raise ValueError('%r not a MAC address', maybe_mac_addr)
+    raise ValueError('%r not a MAC address' % maybe_mac_addr)
 
   return mac_addr, hashlib.sha1(mac_addr).hexdigest()
 
+
 if __name__ == '__main__':
-  print 'SHA1(%s): %s' % hash_mac_addr(sys.argv[1])
+  o = options.Options(optspec)
+  opt, unused_flags, unused_extra = o.parse(sys.argv[1:])
+
+  if not opt.addr:
+    o.usage()
+
+  try:
+    _, hashed_mac_addr = hash_mac_addr(str(opt.addr))
+    print hashed_mac_addr
+  except ValueError as e:
+    print >>sys.stderr, 'error:', e.message
+    sys.exit(1)
diff --git a/bouncer/test-hash_mac_addr.sh b/bouncer/test-hash_mac_addr.sh
new file mode 100755
index 0000000..3c84424
--- /dev/null
+++ b/bouncer/test-hash_mac_addr.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+. ./wvtest/wvtest.sh
+
+WVSTART "hash_mac_addr test"
+
+HASH_MAC_ADDR=./host-hash_mac_addr
+
+WVFAIL $HASH_MAC_ADDR
+WVFAIL $HASH_MAC_ADDR -a nonsense
+
+WVPASSEQ "$($HASH_MAC_ADDR -a 00:00:00:00:00:00)" \
+  85cce83032eb6bd39ddea68e0be917e4665b5d26
+
+WVPASSEQ "$($HASH_MAC_ADDR -a aa:bb:cc:dd:ee:ff)" \
+  "$($HASH_MAC_ADDR -a AA:BB:CC:DD:EE:FF)"