Subnet mask calculator

Two ways of writing the same boundary

A subnet mask and a CIDR prefix describe the identical thing — where an address stops being "network" and starts being "host" — in two different notations. The mask spells it out octet by octet (255.255.255.0), while the prefix just counts the leading 1-bits (/24). Network gear and cloud consoles are maddeningly inconsistent about which one a given field wants, so converting between them on the fly is one of the most common reasons engineers reach for a calculator. Type either form here and the page fills in the other, along with the wildcard, host count and binary view, so you can paste whatever the box in front of you expects.

Why a mask must be contiguous

A legal IPv4 mask is always a solid run of 1-bits followed by a solid run of 0-bits — never a mix. That is what makes 255.255.255.0 valid (twenty-four 1s, then eight 0s) and 255.255.0.255 illegal: its bits go 1s, then 0s, then 1s again, which no prefix length can represent. The reason is structural — the network portion has to be the leading bits so a router can compare addresses with a single bit-shift, so the 1s can only sit on the left. This tool rejects non-contiguous masks rather than silently accepting them, which catches typos like a transposed octet before they reach a device that would also reject them.

Wildcard masks and the off-by-one octets

The wildcard mask is the bitwise inverse of the subnet mask — a /24 has the wildcard 0.0.0.255 — and it is what Cisco access lists and OSPF expect, where a 1 bit means "ignore this position when matching". It is easy to mistype because it is not simply the mask with octets swapped; each bit flips. Watch the boundary octets too: a /26 mask is 255.255.255.192, not a clean 255 or 0, because the split falls mid-octet (192 is 11000000). Seeing the binary alongside makes those non-obvious values obvious. Everything is computed in your browser. To expand a full block into its address range, use the CIDR calculator.