CIDR to Subnet Mask Converter

Background.

Two notations describe the same 32 bits, and network equipment is inconsistent about which one it wants. A cloud console asks for 10.0.0.0/16. A Windows adapter dialog asks for 255.255.0.0. A Cisco access list asks for 0.0.255.255. A packet capture prints 0xFFFF0000. This converter moves between all four, in both directions, without asking you for an IP address.

That last point is the design decision worth stating. Most subnet tools insist on an address before they will tell you anything, but the mask is a property of the prefix alone: /26 is 255.255.255.192 whether you are working in 10.x, 172.16.x or 192.168.x. When your question is "what mask is /26?" or the reverse, "255.255.254.0 — what prefix is that?", an address field is friction and the reverse direction is not even possible on a tool built around one. If your question is instead "which network does 192.168.10.37/26 belong to, and what host addresses can I use?", that is address-dependent and belongs on the companion IP subnet calculator, which this page links to.

The underlying relationship is defined in RFC 4632, the current CIDR specification. A prefix is written as a four-octet quantity followed by a slash and "a decimal value between 0 and 32 that describes the number of significant bits", and the corresponding mask is "a 32-bit value where the most significant 16 bits are ones and the least significant 16 bits are zeros" for the /16 case. Set the first p bits to one, the remaining 32 − p to zero, and read the result out eight bits at a time. That is the whole conversion. RFC 1878 tabulated every row of it back in 1995, and the numbers this page returns match that table.

Mask validity matters in the reverse direction. RFC 950, which introduced the address mask, recommended "that the subnet bits be contiguous and located as the most significant bits of the local address", and CIDR's prefix model makes contiguity mandatory — a prefix length simply cannot express a mask with holes in it. So 255.255.255.192 is a valid mask and 255.0.255.0 is not, and neither is 255.255.255.253, whose last octet is 11111101. This converter rejects both rather than inventing a prefix for them.

The address counts come with one standards-driven wrinkle. For any prefix of /30 or shorter, two addresses per block are reserved — the all-zeros network address and the all-ones broadcast address — so a /24 holds 256 addresses but only 254 hosts. At /31 that rule stops: RFC 3021 permits 31-bit prefixes on point-to-point links, where "only two possible addresses may result" and both "MUST be interpreted as host addresses". A /31 therefore has 2 usable hosts, not zero, and a /32 host route has exactly 1. Tools that apply the minus-two rule to every prefix report 0 and −1 for these two cases, which is a real and frequently copied error.

Everything here is IPv4. IPv6 uses the same slash notation over 128 bits with no broadcast address and different conventions entirely, so it is not folded into this page.

What is cidr to subnet mask converter?

A subnet mask is a 32-bit value whose leading bits are ones across the network portion of an address and zeros across the host portion. A CIDR prefix length is the count of those leading one bits. They are two spellings of one fact: /26 and 255.255.255.192 both say "the first 26 bits identify the network".

RFC 950 introduced the mask form in 1985, instructing implementations to "use a bit mask ('address mask') to identify which bits of the local address field indicate the subnet number" and recommending that those bits be contiguous and left-aligned. RFC 4632 later replaced classful addressing with the prefix form, which can only express contiguous left-aligned masks — so the recommendation became a requirement in practice.

The wildcard mask, sometimes called the inverse mask, is the bitwise complement: where the subnet mask has a one, the wildcard has a zero. Cisco IOS access lists and OSPF network statements are written with wildcard masks, which is why 192.168.10.0 0.0.0.255 in a config means the same block as 192.168.10.0/24. Getting the two forms confused is one of the most common configuration errors in access-list work, which is why both are shown side by side here.

How to use this calculator.

1. 01Choose which direction you need: you have a prefix and want the mask, or you have a mask and want the prefix.
2. 02In prefix-to-mask mode, enter the number after the slash — 0 to 32. The mask field is ignored.
3. 03In mask-to-prefix mode, enter the dotted-decimal mask. The prefix field is ignored. Masks with non-contiguous bits are rejected with an explanation rather than silently accepted.
4. 04Copy the wildcard mask when you are writing a Cisco-style access list or an OSPF network statement — those take the inverse form, not the subnet mask.
5. 05Use the binary mask to see the boundary directly. Counting the ones is the fastest way to sanity-check a mask you were handed verbally.
6. 06Check the usable-hosts figure before you commit to a prefix. A /29 holds 8 addresses but only 6 hosts, and the gateway takes one of those.
7. 07If you also need the network address, broadcast address and host range for a specific IP, use the IP subnet calculator instead — it takes an address, which this page deliberately does not.

The formula.

Start from the block size: a prefix of p leaves 32 − p host bits, so the block holds 2^(32−p) addresses. The mask as a 32-bit unsigned integer is 2^32 − blockSize, which is arithmetically identical to p ones followed by 32 − p zeros. Converting that integer to dotted decimal is repeated division by 256, most significant octet first.

For /26: blockSize = 2^6 = 64; mask = 4,294,967,296 − 64 = 4,294,967,232; dividing that down by 256 four times yields the octets 255, 255, 255, 192 — the mask 255.255.255.192.

The wildcard mask is the complement, 2^32 − 1 − mask, which simplifies to blockSize − 1. For /26 that is 63, or 0.0.0.63. The binary form is the same 32 bits printed as four groups of eight; the hexadecimal form is the same four octets printed as two hex digits each, giving 0xFFFFFFC0.

The reverse direction parses the dotted-decimal mask into its 32-bit value m and computes blockSize = 2^32 − m. The mask is valid only if that block size is an exact power of two, which is the arithmetic statement of "the 1-bits are contiguous and left-aligned". The prefix is then the exponent: 32 − log2(blockSize), found by an exact integer search rather than a floating-point logarithm so that no rounding can shift the answer by one bit. A mask like 255.0.255.0 produces a block size that is not a power of two and is rejected.

Host counting branches at the top of the range. Below /31, the network and broadcast addresses are reserved, so usable = blockSize − 2. At /31, RFC 3021 makes both addresses host addresses on a point-to-point link, so usable = 2. At /32 there is one address and one usable host.

All arithmetic is performed on exact integers rather than with JavaScript's bitwise operators, which coerce their operands to signed 32-bit values — under those operators 0xFFFFFFC0 evaluates to −64, and every mask shorter than /32 comes out negative.

A worked example.

Frequently asked questions.

References& sources.

1. [1]Fuller, V. & Li, T. (2006). RFC 4632, "Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan". IETF BCP 122. Defines the slash notation as "a decimal value between 0 and 32 that describes the number of significant bits" and states that /16 corresponds to a mask "where the most significant 16 bits are ones and the least significant 16 bits are zeros" — the exact relationship implemented by this converter.
2. [2]Pummill, T. & Manning, B. (1995). RFC 1878, "Variable Length Subnet Table For IPv4". The canonical prefix-to-mask table: /24 = 255.255.255.0 = 256 addresses, /30 = 255.255.255.252 = 4 addresses, /31 = 255.255.255.254 = 2 addresses, /32 a single host route. The address counts include the network and broadcast addresses, matching this page's "addresses in the block" output.
3. [3]Mogul, J. & Postel, J. (1985). RFC 950, "Internet Standard Subnetting Procedure". Introduces the address mask — "use a bit mask ('address mask') to identify which bits of the local address field indicate the subnet number" — and recommends "that the subnet bits be contiguous and located as the most significant bits of the local address", the rule this converter enforces when validating a mask.
4. [4]Retana, A., White, R., Fuller, V. & McPherson, D. (2000). RFC 3021, "Using 31-Bit Prefixes on IPv4 Point-to-Point Links". States that a 31-bit prefix yields "only two possible addresses" which "MUST be interpreted as host addresses" — the basis for reporting 2 usable hosts at /31 rather than 0.