CIDR / Subnet Calculator
Enter a CIDR block to get its network and broadcast addresses, usable host range, masks, and subnet splits — for IPv4 and IPv6.
Is an address in this block?
Split into subnets
How big a subnet do I need?
Runs entirely in your browser. Nothing you paste here is uploaded, logged, or sent to analytics.
Reading a prefix length
The number after the slash is how many leading bits are fixed as the network portion. The
rest identify hosts, so a larger prefix means a smaller block: a /24 has 8
host bits and 256 addresses, a /25 has 7 and 128.
| Prefix | Netmask | Addresses | Usable hosts |
|---|---|---|---|
| /30 | 255.255.255.252 | 4 | 2 |
| /29 | 255.255.255.248 | 8 | 6 |
| /28 | 255.255.255.240 | 16 | 14 |
| /27 | 255.255.255.224 | 32 | 30 |
| /26 | 255.255.255.192 | 64 | 62 |
| /25 | 255.255.255.128 | 128 | 126 |
| /24 | 255.255.255.0 | 256 | 254 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
Usable hosts is two fewer than the total because the all-zeros address identifies the network and the all-ones address is the broadcast. Neither can be assigned to an interface.
The two exceptions to "minus two"
- /31 — RFC 3021 defines a /31 as a point-to-point link where both addresses are usable. There is no broadcast address on a link with exactly two endpoints, so reserving one would waste half the block. Router-to-router links are normally /31 for this reason.
- /32 — a single host route. There is no network or broadcast address to reserve, so it has one usable address. Loopback interfaces and BGP host routes use these.
IPv6 works differently
IPv6 has no broadcast address at all (RFC 4291) — that role is filled by multicast — so the "minus two" rule does not apply. The all-zeros host address is reserved as the subnet-router anycast address and should not be assigned to an interface, but it is not excluded from the address count.
The stronger convention is that every link gets a /64. Stateless address autoconfiguration (SLAAC) derives the interface identifier from the low 64 bits, so a prefix longer than /64 breaks it. This surprises people coming from IPv4, where conserving addresses is the whole game: a /64 holds 18 quintillion addresses and you are still meant to hand one to every VLAN.
Addresses are printed in RFC 5952 canonical form — lowercase, no leading zeros in a group,
and :: collapsing the longest run of zero groups. The expanded form is
available when you need to paste into something stricter.
Private and reserved ranges
| Range | What it is |
|---|---|
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | RFC 1918 private — not routable on the public internet. |
100.64.0.0/10 | Carrier-grade NAT (RFC 6598). Shows up in mobile and ISP networks and is often mistaken for a public address. |
169.254.0.0/16 | Link-local / APIPA — what an interface self-assigns when DHCP fails. Also where cloud metadata endpoints live. |
127.0.0.0/8 | Loopback. The whole /8, not just 127.0.0.1. |
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | Reserved for documentation. Use these in examples instead of squatting on someone's real addresses. |
fc00::/7 | IPv6 unique local addresses (RFC 4193) — the rough equivalent of RFC 1918. |
2001:db8::/32 | IPv6 documentation prefix. |
The calculator labels these automatically. If you are writing an SSRF filter, note that
blocking only 127.0.0.1 and 10.0.0.0/8 is not enough — the
link-local range above is how cloud metadata services get reached.