IP Subnet Calculator

Calculate network, broadcast, and host ranges from CIDR notation.

This tool runs entirely in your browser. Your data is never uploaded, never stored, and never leaves your device.

This calculator turns an IPv4 address and CIDR prefix into the full subnet picture — network and broadcast addresses, the first and last usable host, both masks, and how many hosts the prefix actually buys you.

How to use it

1Enter the block in CIDR form, for example 192.168.1.0/24. The prefix is required; a bare address with no slash is rejected.
2Read the nine rows, from the network address down to the class and scope of the block.
3Change only the prefix to resize the block — the fastest way to check whether /26 leaves you enough hosts before you commit to it.

Example

Input: 10.20.30.200/26
Output: network 10.20.30.192 · broadcast 10.20.30.255 · hosts 10.20.30.193 to 10.20.30.254 · mask 255.255.255.192 · wildcard 0.0.0.63 · 62 usable of 64 total · Class A, Private (RFC 1918)

Note that .200 is not the network address: any address inside the block is masked down to it, so you can paste an address straight off a machine and find out which subnet it sits in. Usable is total minus two — one for the network address, one for the broadcast — everywhere except the two prefixes where that arithmetic is wrong. A /31 is a point-to-point link under RFC 3021 with both addresses usable, and a /32 is a single host route; for both, the broadcast row shows an em dash and a line beneath the table names the case. IPv4 only — an IPv6 prefix is not recognised.

What happens to your data

This tool runs entirely in your browser. Your input is never uploaded to a server, never stored, and never logged. The four octets are packed into one 32-bit integer and masked with bitwise AND and OR — that is the whole computation, and class and scope come from ranges compiled into the page rather than a registry. No DNS lookup, no WHOIS request, no geolocation call: working out a customer's internal addressing here discloses it to nobody.

Last updated August 2026

Someone hands you a range and tells you to make it work: a /26 for a branch office, a VPN pool that must not collide with head office, a firewall rule reading 10.0.8.0/21 that nobody can now explain. The arithmetic is binary, the errors stay invisible until traffic stops, and doing it in your head late in the day is how two subnets end up overlapping.

Decide first which of two jobs you are doing. One is reading a block that already exists — you have an address off a running machine or out of a config and you want its boundaries. The other is sizing a block you are about to build, which runs the opposite way: start from how many devices will live there, add the router, leave room for growth, and only then choose a prefix.

The notation also cannot give you an arbitrary size. Each prefix is half the one below it, so a network for 100 machines is a /25 of 128 addresses with 126 usable — there is no way to ask for 100. Blocks must begin on their own boundary as well: /26s start at .0, .64, .128 and .192 and nowhere else, so a range written as 192.168.1.100/26 is describing a host rather than a network.

The mistake that costs an afternoon is quieter than any of that. A mask copied from another site's configuration — 255.255.255.0 where the block is really a /22 — leaves every machine convinced its neighbours are somewhere else, and the symptom looks like a routing fault rather than a typo.

How it works

Toolvore turns the prefix into a mask by sliding a run of ones leftwards — a /26 is twenty-six ones followed by six zeros — and the wildcard mask is that same value flipped bit for bit, which is why it always reads as one less than the size of the block. Counts are computed as powers of two rather than tallied, so a /0 reports all 4,294,967,296 addresses without effort, and the figures update on every keystroke: there is no button to press, and a half-typed entry sits behind an error message until it parses. Two weaknesses are worth knowing. The class and scope line is read from the address you typed rather than from the network address it belongs to, so 192.168.1.1/8 is labelled private even though the block 192.0.0.0/8 is not. And nothing warns you when host bits are set, which is helpful when you are identifying a machine's subnet and misleading when you meant to type a network and slipped. Leading zeros are read as decimal, so 010 means ten rather than eight.

Common use cases

Working out which subnet an address taken off a running machine belongs to
Sizing a branch office range from a device count before it is deployed
Turning a chosen mask into the wildcard form an access list needs
Checking that a new VPN pool does not overlap an existing office range
Reading a firewall rule that someone else wrote in CIDR
Confirming whether a range is private or publicly routable
Sizing a DHCP pool against the usable host count

Frequently asked questions

What does the /24 in an IP address actually mean?＋

The number after the slash counts the bits at the front of the address that identify the network; whatever is left identifies hosts inside it. A /24 fixes twenty-four bits and leaves eight, so the block holds 256 addresses and the final octet is yours to hand out. Each step up halves the block — /25 is 128 addresses, /26 is 64, /27 is 32 — and each step down doubles it. The prefix carries the same information as a dotted-decimal mask, so /24 and 255.255.255.0 say the same thing; most equipment accepts either, but mixing the two forms in your head is where slips begin.

Why can I not use the first and last address in a subnet?＋

Because the first address in a block names the network itself and the last is the broadcast address, which reaches every host on the segment at once, so neither can sit on an interface. Plan for a third loss as well: the router or default gateway takes an address out of the same block, conventionally the first or last usable one. A /29 of eight addresses therefore supports five machines and a gateway, not eight. That overhead barely registers on a /24 and dominates a /29, which is why small blocks feel so much smaller than their size suggests.

How many usable hosts does each prefix give?＋

Counting down from a /24 and its 254: a /25 gives 126, /26 gives 62, /27 gives 30, /28 gives 14, /29 gives 6 and /30 gives 2. Going the other way, /23 gives 510 and /22 gives 1,022. Pick with growth in mind, because resizing later means renumbering every static address, every firewall rule and every DHCP reservation that names the old range. A /24 is the common default for an office floor not because it is correct but because it is roomy and easy to read at a glance.

What is a wildcard mask and when do I need one?＋

A wildcard mask is the subnet mask inverted: where the mask has ones, the wildcard has zeros. A /26 has the mask 255.255.255.192 and the wildcard 0.0.0.63. Read it as a statement of which bits may vary — zero means the bit must match, one means ignore it. Cisco access lists and OSPF network statements are written this way, and entering a subnet mask where a wildcard is expected is a classic error that either matches nothing or matches far more than you meant. Both forms appear in the results, so you can take whichever the box in front of you is asking for.

What makes an IP address private rather than public?＋

Three ranges are set aside by RFC 1918 for private use and are not routed across the public internet: 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255. Others are reserved for particular jobs — 127 for loopback, 169.254 for the link-local address a machine assigns itself when DHCP fails. Private ranges can be used by every organisation at once, which is why they are translated at the border and why two companies merging so often find that both built on 10.0.0.0/8. The scope shown with the results says which category an address falls into.

Two machines are on the same switch but cannot reach each other — why?＋

The usual cause is a mask mismatch rather than a cable. A machine decides whether a destination is local by masking its own address and the destination's with its own subnet mask and comparing the two results; when they differ, the packet goes to the default gateway instead of onto the wire. Give one host a /24 and its neighbour a /25 on the same segment and you get an asymmetry — one believes the other is local, the other does not — which appears as traffic that works in one direction only. Check that every host carries the same prefix and gateway, and that the gateway sits inside the block.

Is the addressing I type here sent anywhere?＋

Nothing leaves the tab. The calculation is arithmetic on a single 32-bit number performed by the page's own JavaScript, and the component makes no request of any kind — there is no server route behind it, so there is nothing that could log the ranges you type. Nothing is stored either: what you enter lives in ordinary component state, and closing the tab is the whole of the cleanup. Being deliberate about this is reasonable in general. An addressing plan describes where things sit on your network, and pasting one into a site that does its sums on a server hands over a small piece of a map you would not otherwise publish.

How do I split a /24 into smaller subnets?＋

By halving. A /24 splits into two /25s at .0 and .128, four /26s at .0, .64, .128 and .192, eight /27s in steps of thirty-two, and onwards. Each child block starts at a multiple of its own size, which is the rule that makes the boundaries predictable once you know the step. Where departments need different sizes, allocate the largest block first and carve the remainder into smaller ones, so nothing has to start on a boundary it cannot occupy. You work one block at a time here: enter a candidate, read its range, then enter the next to see where it begins. No list is generated for you.