Subnet Calculator
Calculate IPv4/IPv6 network address, broadcast, mask, host range, and CIDR — entirely in your browser.
What is a Subnet Calculator?
A subnet calculator is a tool that takes an IP address paired with a CIDR prefix or subnet mask and derives the network's structural properties: network address, broadcast address, usable host range, total host count, and the binary boundary between network and host bits. Network engineers, sysadmins, and developers reach for one whenever they need to plan VLSM allocations, write firewall rules, troubleshoot "why can't these hosts talk to each other," or configure routing tables. The math is bitwise AND/OR against the mask — trivial in principle, error-prone in practice, especially across IPv4 and IPv6, whose addresses are 32 bits and 128 bits respectively. This calculator runs entirely in your browser using BigInt arithmetic, so it handles full IPv6 (/0 to /128) without precision loss, and never sends the address you paste to any server.
How to Use
Steps
- Pick IPv4 or IPv6 with the toggle at the top.
- Enter an IP address in the input field — for example, 10.0.0.42 or 2001:db8::1.
- Adjust the prefix length using the number input or the slider; results update instantly.
- Click any result tile to copy that value to your clipboard.
- For IPv4, optionally split the network into smaller subnets by setting a longer target prefix.
Common Pitfalls
- /31 networks are not broken — RFC 3021 explicitly allows them on point-to-point links, where both addresses are usable.
- /32 represents a single host (a host route), not an empty network. Same for IPv6 /128.
- The "broadcast address" concept does not exist in IPv6; the field shows the last address of the prefix instead, which serves the same role for range checks.
- Wildcard masks (used in Cisco ACLs) are simply the bitwise NOT of the subnet mask — 0.0.0.255 is the wildcard for 255.255.255.0.
Use Cases
Technical Principle
An IPv4 address is 32 bits, IPv6 is 128 bits. CIDR notation (RFC 4632, August 2006) attaches a prefix length /n to the address, declaring the leftmost n bits to be the network identifier and the remaining bits to be the host identifier. The subnet mask is a bit pattern with n consecutive 1s followed by 32−n (or 128−n) zeros — for /24 that is 11111111.11111111.11111111.00000000, or 255.255.255.0 in dotted decimal. CIDR replaced the older classful addressing of RFC 791 (where 0.0.0.0–127.255.255.255 was Class A with an implicit /8, with 0.0.0.0/8 reserved for "this network" and 127.0.0.0/8 reserved for loopback; 128.0.0.0–191.255.255.255 was Class B with /16; 192.0.0.0–223.255.255.255 was Class C with /24), which wasted addresses catastrophically: a 1,000-seat company assigned a Class B got 65,534 hosts when they needed 1,000, fragmenting the IPv4 space. CIDR allows any prefix length, enabling VLSM (Variable-Length Subnet Mask, originally formalized in RFC 950 in 1985) and route aggregation ("supernetting"). The core operations are bitwise: network = address AND mask; broadcast = network OR (NOT mask) = network OR wildcard. For 192.168.1.100/24, the address 0xC0A80164 ANDed with 0xFFFFFF00 gives 0xC0A80100 (192.168.1.0), and ORed with 0x000000FF gives 0xC0A801FF (192.168.1.255). Usable hosts are 2^(32−n) − 2 for IPv4 (subtracting network and broadcast); the −2 disappears at /31 (RFC 3021 reclaimed it for point-to-point links, both ends usable) and /32 (a single host route). IPv6 has no broadcast address — multicast and anycast replaced it — so the "last address" is just the upper bound of the prefix range. JavaScript's native bitwise operators are 32-bit signed, which overflows for IPv4's 0xFFFFFFFF (becomes −1) and cannot represent IPv6 at all; this calculator uses BigInt for both, ensuring identical correctness across versions. Private address space is defined in RFC 1918 for IPv4: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. IPv6 uses Unique Local Addresses (RFC 4193) in fc00::/7, plus link-local fe80::/10 for SLAAC and on-link communication. The calculator flags these so you don't accidentally publish a private range to public BGP. Common errors this tool prevents: (1) entering 192.168.1.100/255.255.255.0 versus /24 — the calculator accepts the prefix form and shows the dotted mask; (2) miscounting host capacity for /30 versus /29 (2 vs 6 hosts); (3) splitting a /24 into eight /27s and miscalculating where the fourth subnet starts (it's 192.168.1.96, not 192.168.1.97); (4) confusing wildcard 0.0.0.255 with mask 255.255.255.0 in Cisco ACL syntax. The binary visualization, with network bits highlighted, is the fastest way to internalize the boundary that makes all of these errors fall away.
- RFC 4632 (August 2006) defines CIDR — Classless Inter-Domain Routing — replacing the classful A/B/C scheme of RFC 791. The /n notation declares the network prefix length; the remaining bits are the host portion. CIDR enables VLSM (originally formalized in RFC 950, 1985) and route aggregation, both essential for IPv4 conservation and the modern BGP table.
- Network address = IP AND mask; broadcast = network OR wildcard (where wildcard = NOT mask). For /24: mask 0xFFFFFF00, wildcard 0x000000FF. Usable hosts = 2^(32−n) − 2, except /31 (RFC 3021, both addresses usable on point-to-point links) and /32 (single host route).
- IPv6 (128 bits) has no broadcast — multicast (ff00::/8) and anycast replaced it. The conventional minimum prefix is /64 (for SLAAC, 18 quintillion addresses per subnet); /56 or /48 per site; /32 per ISP. IPv6 address space prioritizes routing aggregation over conservation.
- Reserved ranges beyond RFC 1918: 127.0.0.0/8 is loopback, 169.254.0.0/16 is IPv4 link-local (auto-IP / APIPA), 224.0.0.0/4 is multicast, 240.0.0.0/4 is reserved for experimental use. IPv6 also reserves fe80::/10 for link-local SLAAC, ff00::/8 for multicast, and ::1/128 for loopback. The calculator distinguishes private from public ranges so you can tell at a glance whether the address you typed is routable on the public internet.
- JavaScript bitwise operators are 32-bit signed: (0xFFFFFFFF & 0xFFFFFF00) returns −256, not 0xFFFFFF00. This calculator uses BigInt throughout to handle the full IPv4 range and 128-bit IPv6 without precision loss. The same code path computes both versions; only the mask width differs.
- Common Cisco/Juniper gotcha: ACL syntax takes a wildcard mask (0.0.0.255), not a subnet mask (255.255.255.0). EIGRP and OSPF "network" statements also use wildcards. An inverted mask matches the complement of the intended network — silently in routing protocols (no adjacency forms), exploitably in ACLs (wrong traffic permitted).
- VLSM example: a /24 split into 4 equal subnets becomes 4 × /26 (64 addresses each), with usable hosts 62 per subnet. Adjacent /26s start at offsets 0, 64, 128, 192 — NOT 0, 63, 127, 191. The calculator's split tool generates these boundaries so you don't have to translate them mentally.
Examples
Standard /24 (most common LAN)
Input: 192.168.1.100/24
Network: 192.168.1.0
Broadcast:192.168.1.255
Mask: 255.255.255.0
Wildcard: 0.0.0.255
Hosts: 192.168.1.1 - 192.168.1.254 (254 usable)
Class: C, Private (RFC 1918)
Binary: 11000000.10101000.00000001.01100100
(network bits = leftmost 24; host bits = rightmost 8)Point-to-point /31 (RFC 3021)
Input: 10.0.0.1/31
Network: 10.0.0.0
Broadcast:10.0.0.1
Mask: 255.255.255.254
Hosts: 10.0.0.0 - 10.0.0.1 (2 usable, both ends of the link)
Before RFC 3021, /31 was "unusable" because 2 - 2 = 0. Modern
routers allow both addresses for point-to-point links, saving
half the address space on transit segments.VLSM split: /24 into four /26s
Input: 192.168.1.0/24, split to /26
Subnet 1: 192.168.1.0/26 hosts .1 - .62
Subnet 2: 192.168.1.64/26 hosts .65 - .126
Subnet 3: 192.168.1.128/26 hosts .129 - .190
Subnet 4: 192.168.1.192/26 hosts .193 - .254
Note the boundaries: 0, 64, 128, 192 — each /26 holds 64
addresses (62 usable). A common mistake is to start subnet 2
at .63 (the broadcast of subnet 1, +1) — but .63 is the
broadcast itself; the next subnet starts at .64.IPv6 /64 (standard leaf network)
Input: 2001:db8:1234:5678::1/64
Network: 2001:db8:1234:5678::
Last: 2001:db8:1234:5678:ffff:ffff:ffff:ffff
Mask: ffff:ffff:ffff:ffff::
Hosts: 18,446,744,073,709,551,616 (2^64)
A single /64 holds the same count of addresses as the entire
IPv4 space squared (2^64 = (2^32)²). SLAAC requires /64 because
the lower 64 bits encode the interface identifier (EUI-64 or
random per RFC 7217).FAQ
Why does /24 give 254 usable hosts instead of 256?
A /24 subnet has 2^8 = 256 addresses, but two of them are reserved: the network address (192.168.1.0) identifies the subnet itself in routing tables, and the broadcast address (192.168.1.255) is used for messages addressed to every host on the subnet. Both are unusable as host IPs, leaving 254 assignable addresses. The same −2 rule applies to all IPv4 prefixes from /1 through /30. Exceptions: /31 has 2 usable addresses (RFC 3021, point-to-point), /32 has 1 (single host route).
What is the difference between a subnet mask and a wildcard mask?
A subnet mask has 1s in the network portion and 0s in the host portion — for /24, it's 255.255.255.0. A wildcard mask is the bitwise NOT — for /24, it's 0.0.0.255. Cisco IOS access-lists, EIGRP, and OSPF use wildcards because the original ACL implementation used a "don't care" model (1 bits in the wildcard mean "this bit doesn't have to match"). Other vendors and most modern Cisco syntax accept the subnet mask form as well, but legacy configs you inherit will use wildcards.
Does IPv6 have a broadcast address?
No. IPv6 deliberately removed broadcast and replaced it with multicast (ff00::/8) and anycast. The "all-nodes" scope is ff02::1, which behaves like the link-local broadcast of IPv4 but only reaches nodes that have joined the multicast group. For IPv6 the calculator therefore labels this value "Last Address" instead of "Broadcast"; you cannot send packets to it the way you would to 255.255.255.255 in IPv4 — there is no protocol-level concept that delivers them to every host.
Why is /31 useful if it has "no usable hosts" by the old formula?
Pre-2000 textbooks said a /31 has 2^1 − 2 = 0 usable hosts and was therefore invalid. RFC 3021 (December 2000) re-specified /31 for point-to-point links, where there are exactly two endpoints and no need for a separate broadcast — the link itself defines the broadcast scope. Modern routers (IOS 12.2+, Junos, FRR, Linux) all support /31. Using /31 instead of /30 on transit links halves the address space consumed by core network infrastructure, which adds up across thousands of links in a large network.
Why do all my IPv6 subnets seem to be /64?
By convention, the smallest IPv6 unit assigned to a leaf network is /64. The lower 64 bits are reserved for the interface identifier — SLAAC (RFC 4862) generates these from the MAC address (EUI-64), a stable hash of the network prefix and a per-host secret (RFC 7217), or short-lived random values (RFC 4941 privacy extensions). Using a /126 or /127 on a point-to-point link technically works for static configuration, but breaks SLAAC and many automatic features. /64 is recommended for every subnet that hosts end stations; /127 is used only on router-to-router links where you have full control.
Does this tool send my IP address to a server?
No. All calculations run client-side in your browser using JavaScript BigInt arithmetic. No address, prefix, or computed result is transmitted to any backend. You can verify this by opening the browser DevTools network tab — there are no outbound requests during calculation. This matches the privacy expectation of every browser-based ToolAct utility.
What is the difference between /24 and 255.255.255.0?
Nothing functionally — they are two notations for the same mask. /24 (CIDR notation, RFC 4632) counts the number of leading 1 bits; 255.255.255.0 (dotted decimal mask) writes those bits out as a four-octet number. Most modern OS and router configs accept either form. The calculator displays both for any prefix you enter so you can copy-paste whichever your target system requires.
Why does this calculator reject inputs like 010.0.0.1?
Leading zeros (010, 04, 0001) are rejected because the same string means different things in different IP parsers — glibc's inet_aton historically interpreted leading-zero octets as octal (010 = 8), while modern Python (3.9.5+) and the JavaScript runtime treat them as decimal (010 = 10). The cross-stack disagreement has caused real SSRF bypass vulnerabilities (CVE-2021-29921 and family) where a service treats 010.0.0.1 as 8.0.0.1 in its allow-list check but a downstream library connects to 10.0.0.1. To avoid implying a particular interpretation, this calculator rejects any octet with leading zeros — strip the zero (010 → 10) before pasting.