CIDR Subnet Calculator

Features

• Accepts a prefix or a mask: /24, 255.255.255.0, or an address followed by a mask
• A mask on its own works too: enter /26 or 26 to get the mask, wildcard and host count
• Network address, broadcast address, subnet mask and wildcard mask in one pass
• Usable range and host count, with /31 and /32 handled per RFC 3021
• Address type: private, loopback, link-local, carrier-grade NAT, multicast, reserved, documentation, public
• A non-contiguous mask is rejected instead of quietly producing a wrong subnet
• The wildcard mask can be pasted straight into a Cisco ACL or firewall rule
• Optional binary expansion, so you can see where the network bits are cut
• Examples copied from documentation survive the quotes and full-width characters
• Batch sort and dedupe: paste many IPv4/IPv6 addresses and subnets (one per line or comma-separated) and get them sorted numerically, IPv4 and IPv6 in separate groups, duplicates removed and every dropped entry reported

How to use

1. Paste 192.168.1.0/24, or 192.168.1.0 255.255.255.0
2. Results appear as you type — no button to press
3. Turn on the binary expansion to line the network bits up against the mask
4. With only a mask, just enter /26 or 26 — no need to invent an address
5. For many entries, turn on Batch sort & dedupe and put one address or subnet per line to get a sorted, deduplicated list
6. Copy a single line, or copy the whole result

FAQ

Why is the host count for /31 and /32 not total minus two?

Subtracting two comes from the old rule that the network and broadcast numbers each consume an address. But a /32 holds a single address, which is itself usable, and /31 is defined by RFC 3021 as a point-to-point link where both addresses are usable and there is no network or broadcast number. Those two prefixes are exactly what you type when configuring a host route or a point-to-point link, and the old rule would report zero usable addresses for them.

What is the difference between a subnet mask and a wildcard mask?

A subnet mask is a run of 1s followed by a run of 0s (255.255.255.0); the wildcard mask is its bitwise inverse (0.0.0.255). Cisco ACLs, OSPF announcement ranges and a number of firewall rules take the wildcard form — pasting the subnet mask into them is one of the most common configuration mistakes, so both are listed here.

I have a mask but no address — can I still convert it?

Yes — enter `/26` or `26` (the two are equivalent) and you get the subnet mask, the wildcard mask, the usable host count and the total address count. ⚠️ The network address, broadcast address and usable range are not shown: all of those need an address to mean anything. The first line of the output says “mask-only conversion” so you do not think rows went missing. ⚠️ One deliberate boundary: a bare dotted quad is still an address. `255.255.255.0` and `192.168.1.1` are parsed by the same path, so reinterpreting the former as a mask would be a silent behaviour change. To use it as a mask, keep the slash (`/255.255.255.0`) or just give the prefix length.

Why is 255.0.255.0 rejected?

It is not a valid mask: the binary form must be a run of 1s followed by a run of 0s with no 0 in between. A bitwise AND with it produces a result that looks well-formed, but the boundary it describes is recognised by no device — and it would most likely be carried straight into a firewall configuration. So it is reported as an error rather than silently interpreted.

Is the subnet I type recorded?

No. The whole calculation happens in the browser: the page sends no requests and there is no backend involved, so even your internal addressing plan never leaves the machine.

How does batch sort and dedupe order the entries?

With Batch sort & dedupe on, each entry is one per line (comma or whitespace separated also works). IPv4 and IPv6 form separate groups and are sorted independently, IPv4 first — mixing the two address spaces is meaningless. Sorting is numeric, not lexical: string order would put `10.0.0.10` before `10.0.0.2`, which is wrong. Subnets sort by their network address (so `10.0.0.5/24` and `10.0.0.0/24` land together); ties go to the shorter prefix, the larger block. Deduplication works on the normalised entry: a subnet becomes “network address/prefix”, so `192.168.1.1/24` and `192.168.1.0/24` collapse into one, as do a bare address and its `/32` form; every dropped duplicate is listed individually rather than silently discarded.