CIDR subnet calculator
Enter an address with a prefix and instantly see the network, mask, range, address count and a binary view with the network boundary. The prefix slider recalculates everything live. Next to it: subnetting and VLSM, list merging, overlap detection with an address-space map, and an “is this address in range” check.
Free, no sign-up
192.168.1.10/24, 10.0.0.0 255.255.255.0, 10.0.0.0 0.0.0.255 (wildcard) or IPv6: 2001:db8::/48.
Drag the slider or sweep across the bits — everything updates instantly.
| CIDR | 192.168.1.0/24 | |
|---|---|---|
| Network | 192.168.1.0 | |
| Netmask | 255.255.255.0 (/24) | |
| Wildcard (inverse mask) | 0.0.0.255 | |
| First host | 192.168.1.1 | |
| Last host | 192.168.1.254 | |
| Broadcast | 192.168.1.255 | |
| Range | 192.168.1.0 – 192.168.1.255 | |
| Total addresses | 256 | |
| Usable hosts | 254 | |
| Type | private network · 192.168.0.0/16 RFC 1918 | |
| Class (historic) | C | |
| Reverse DNS zone | 1.168.192.in-addr.arpa | |
| Address PTR name | 10.1.168.192.in-addr.arpa |
Reverse DNS zones (1)
- 1.168.192.in-addr.arpa
How to use it
Address
Input forms: 192.168.1.10/24, an address and mask separated by a space (10.0.0.0 255.255.255.0), an ACL-style wildcard (10.0.0.0 0.0.0.255), IPv6 with a prefix (2001:db8::/48), an address with a zone (fe80::1%eth0/64). Errors point to the exact place in the string.
Prefix
Use the slider or the bits themselves: sweep across the binary view to move the network boundary, and the mask, range and counts update.
Subnetting
Into N equal subnets or into subnets of a given prefix; VLSM sizes subnets by host count with an allocation map and free blocks.
Lists
Paste networks and ranges: the calculator merges them into the minimal CIDR set, finds duplicates, nesting and overlaps, and draws an address-space map.
Export
Tables as Markdown (copy or download) and CSV for Excel/Google Sheets, lists as text.
Standards and formulas
Address notation: IPv4 — RFC 791 (octets with a leading zero are rejected: some software reads “010” as octal 8), IPv6 — RFC 4291 §2.2, output in the RFC 5952 canonical form. Classless addressing — RFC 4632, /31 for point-to-point links — RFC 3021, reverse zones — in-addr.arpa (RFC 1035, classless delegation RFC 2317) and ip6.arpa (RFC 3596).
Netmask
- How it is computed
- p ones from the left, then n − p zeros
Wildcard (inverse mask)
- How it is computed
- the inverted mask: n − p ones from the right
Network address
- How it is computed
- address AND mask
Last address / IPv4 broadcast
- How it is computed
- network OR wildcard
Total addresses
- How it is computed
- 2^(n − p) — an exact integer (BigInt), including 2^128 for ::/0
Usable hosts, IPv4
- How it is computed
- 2^(32 − p) − 2 for p ≤ 30; 2 for /31 (RFC 3021); 1 for /32
Usable hosts, IPv6
- How it is computed
- 2^(128 − p): IPv6 has no broadcast
Split into N subnets
- How it is computed
- new prefix = p + ⌈log₂ N⌉
VLSM
- How it is computed
- size = the nearest power of two ≥ hosts + 2 (IPv4); allocated largest first, aligned to the size
Range → CIDR
- How it is computed
- take the largest aligned block starting at the range start that does not pass the end; repeat to the end
Merging a list
- How it is computed
- sort, join overlapping and adjacent ranges, then “range → CIDR” (aggregation per RFC 4632)
0.0.0.0/8
- Purpose
- “This network”
- Type
- unspecified
- Standard
- RFC 791, RFC 1122
10.0.0.0/8
- Purpose
- Private-use
- Type
- private network
- Standard
- RFC 1918
100.64.0.0/10
- Purpose
- Shared address space (CGNAT)
- Type
- CGNAT (shared address space)
- Standard
- RFC 6598
127.0.0.0/8
- Purpose
- Loopback
- Type
- loopback
- Standard
- RFC 1122
169.254.0.0/16
- Purpose
- Link-local (APIPA)
- Type
- link-local
- Standard
- RFC 3927
172.16.0.0/12
- Purpose
- Private-use
- Type
- private network
- Standard
- RFC 1918
192.0.0.0/24
- Purpose
- IETF protocol assignments
- Type
- IETF protocol assignment
- Standard
- RFC 6890
192.0.2.0/24
- Purpose
- TEST-NET-1
- Type
- documentation
- Standard
- RFC 5737
192.88.99.0/24
- Purpose
- Former 6to4 relay anycast (deprecated)
- Type
- reserved
- Standard
- RFC 7526
192.168.0.0/16
- Purpose
- Private-use
- Type
- private network
- Standard
- RFC 1918
198.18.0.0/15
- Purpose
- Network benchmarking
- Type
- benchmarking
- Standard
- RFC 2544
198.51.100.0/24
- Purpose
- TEST-NET-2
- Type
- documentation
- Standard
- RFC 5737
203.0.113.0/24
- Purpose
- TEST-NET-3
- Type
- documentation
- Standard
- RFC 5737
224.0.0.0/4
- Purpose
- Multicast
- Type
- multicast
- Standard
- RFC 5771
240.0.0.0/4
- Purpose
- Reserved for future use
- Type
- reserved
- Standard
- RFC 1112
255.255.255.255/32
- Purpose
- Limited broadcast
- Type
- limited broadcast
- Standard
- RFC 919
::/128
- Purpose
- Unspecified address
- Type
- unspecified
- Standard
- RFC 4291
::1/128
- Purpose
- Loopback
- Type
- loopback
- Standard
- RFC 4291
::ffff:0:0/96
- Purpose
- IPv4-mapped addresses
- Type
- IPv4/IPv6 translation
- Standard
- RFC 4291
64:ff9b::/96
- Purpose
- NAT64 well-known prefix
- Type
- IPv4/IPv6 translation
- Standard
- RFC 6052
64:ff9b:1::/48
- Purpose
- Local-use NAT64 prefix
- Type
- IPv4/IPv6 translation
- Standard
- RFC 8215
100::/64
- Purpose
- Discard-only
- Type
- reserved
- Standard
- RFC 6666
2001::/23
- Purpose
- IETF protocol assignments
- Type
- IETF protocol assignment
- Standard
- RFC 2928
2001::/32
- Purpose
- Teredo
- Type
- IPv4/IPv6 translation
- Standard
- RFC 4380
2001:2::/48
- Purpose
- Benchmarking
- Type
- benchmarking
- Standard
- RFC 5180
2001:db8::/32
- Purpose
- Documentation
- Type
- documentation
- Standard
- RFC 3849
2002::/16
- Purpose
- 6to4
- Type
- IPv4/IPv6 translation
- Standard
- RFC 3056
3fff::/20
- Purpose
- Documentation (extended)
- Type
- documentation
- Standard
- RFC 9637
fc00::/7
- Purpose
- Unique local addresses (ULA)
- Type
- unique local (ULA)
- Standard
- RFC 4193
fe80::/10
- Purpose
- Link-local
- Type
- link-local
- Standard
- RFC 4291
ff00::/8
- Purpose
- Multicast
- Type
- multicast
- Standard
- RFC 4291
An IPv6 address outside these ranges and outside 2000::/3 (global unicast) is marked as reserved. The tables above are generated from the same code that classifies addresses.
Limitations
- The subnet table shows the first 512 subnets (the count is exact); a list uses its first 2000 items, and pairwise overlaps are computed for the first 400.
- VLSM places subnets largest first without reordering: optimal for powers of two, but it does not know about addresses already in use — remove them from the network first or add them as subnets.
- The address type comes from the IANA registry at release time; real prefix routing (BGP, RPKI) is not checked.
- Wildcard masks with “holes” (10.0.0.0 0.0.255.0) are valid in ACLs but cannot be expressed as CIDR — the calculator reports an error.
Privacy
- Everything is computed in your browser: addresses are not sent to a server (except a short summary, if you attach it to a request yourself) or put into the page URL.
- Input and settings are kept only in this browser (localStorage) so you do not have to retype them; “Reset” deletes them.
- Analytics receives only the fact of a calculation or export and a category (IPv4/IPv6, file format) — no addresses.
- The result reaches us only if you send a request yourself and keep the “Attach the result” box ticked — the form shows exactly what will be sent. Keys, passwords and tokens are never part of the summary.
Related tools
All tools · 40
Password and passphrase generatorPasswords, passphrases from English or Russian words, PINs and patterns from a cryptographic generator, exact entropy and crack times, and a check of your own password for common weaknesses.
WireGuard config generatorA website cannot be a VPN — but here you build a real WireGuard setup for your server: X25519 keys, wg0.conf with NAT, a .conf and QR code per phone and laptop, subnet and route checks, a ZIP and setup steps. Keys never leave your browser.
SSH key generatorEd25519 and ECDSA P-256 in OpenSSH format with a passphrase (like ssh-keygen), SHA256/MD5 fingerprints and randomart, restricted authorized_keys, ~/.ssh/config and an inspector for any public key. Keys are generated on your device.
JWT decoder, verifier and builderDecode a token part by part, verify HS/RS/PS/ES/EdDSA signatures with a PEM, JWK or JWKS key, see expiry with a countdown, 16 security rules, and build test tokens.
Image compressor (WebP/AVIF)Drop images in — WebP, AVIF or JPEG by quality or a target size in KB, a 1:1 before/after slider, srcset and <picture>, batch ZIP. All in the browser.
Favicon and app icon generatorFrom an image, SVG or a letter → favicon.ico, favicon.svg with dark mode, PNGs in every size, apple-touch-icon, maskable, manifest and HTML; tab, iOS and Android previews — in one archive.Designing a network, VPN or cloud infrastructure?
Technical consulting: addressing plan, segmentation, access between networks, VPN and cloud — with concrete decisions for your project. The first short call is free.
- The first short conversation is free — we choose the format
- NDA — yours or ours
- Pricing after a brief and an agreed scope