🌐 IPv4 Subnet Calculator — CIDR breakdown & the smallest prefix that fits N hosts

Which addresses a network block holds

Two questions that are easy to get wrong by hand. Forward: “this host is 172.16.5.130/20 — where does its network actually start and stop, and what is the broadcast?” Backward: “I need to address 254 devices — which prefix is big enough without wasting a whole lot of space?”

The top half breaks a CIDR into network address, usable host range, broadcast, netmask, wildcard mask, host and total counts, plus a one-line read of which IANA special-purpose range the address sits in. The bottom half runs it in reverse from a host count and shows how much slack you are left with.

How input is parsed

• The CIDR box is the main one. Write IP/prefix, e.g. 192.168.1.0/24. Feeding it a host address instead of the network address — 192.168.1.77/24 — is not treated as an error: the calculator resolves the containing network (192.168.1.0/24) and says so plainly, because that mismatch is the single most common real-world confusion.
• The netmask box is optional and only consulted when the CIDR box has no slash. Give a bare IP there and a dotted mask like 255.255.248.0 in the mask box, and the mask is converted to a prefix (masks must be contiguous). If the CIDR box already carries a /prefix, that prefix wins and the mask box is ignored — so the two boxes can never silently disagree.
• The parser is strict on purpose. Exactly four dot-separated octets, each a plain integer 0-255; no signs, no letters, no internal spaces. Leading zeros are rejected outright (192.168.01.1): a leading zero is read as octal by some resolvers and decimal by others, so the meaning is not fixed and guessing would be worse than refusing. Prefix lengths reject /33, /24.5, /00 and an empty /, naming the token at fault.
• Only the outer whitespace is tolerated. A stray space at the start or end (common when pasting) is trimmed, but a space in the middle (192.168.1.0 /24) is still an error — that usually means two separate values got pasted together.

How hosts are counted

For ordinary prefixes (/30 and coarser) usable hosts = 2^(32−prefix) − 2. The two subtracted addresses are the network address (all host bits 0) and the broadcast address (all host bits 1); both are reserved by the protocol and cannot be assigned to an interface. That is the rule most charts quote and the one applied for those sizes.

Two sizes deliberately do not follow 2^n − 2:

• /31 — RFC 3021 point-to-point links. With only two addresses in the block there is no room to reserve a network and a broadcast, and a two-router link does not need them, so both addresses are usable. The result shows usable hosts = 2 for a /31 (naively it would be 2¹−2 = 0). The table still lists the network and broadcast values so the rows line up, but a note says they are not truly reserved on a /31.
• /32 — a single host route. Network, broadcast and host are the same address, so usable hosts = 1, not 2⁰−2.

Total addresses is always 2^(32−prefix); for /0 that is 2³² = 4,294,967,296, exactly representable in double-precision. The code keeps the arithmetic in integer form and uses >>> 0 only where an unsigned value matters, precisely so that masks near 2³² (like the /0 mask, 0.0.0.0) never turn negative the way a raw signed shift would.

When to feed this to something else

• This is math, not a routing decision. A /20 offering 4,094 hosts does not mean your site should be a /20. Gateways, VLAN boundaries, DHCP scopes, and whether the block can be aggregated with its neighbours are network-design questions the calculation cannot see.
• It assumes one prefix, one size. Real layouts use VLSM (variable-length subnets carved from a bigger block at differing sizes) and supernetting (several contiguous networks summarised into one coarser route). Neither is expressible as a single CIDR line, so treat each result as one block in isolation.
• IPv4 only. Every boundary and special case here is IPv4; it has nothing to do with IPv6 /64s, SLAAC, or 128-bit masks.
• Ranges are for orientation. 0.0.0.0/0 reporting 4,294,967,296 addresses is the default route, not a subnet you own; CGNAT, documentation and link-local labels come from the IANA special-purpose registry and are reference, not a ruling on your addressing.

Questions

Why are the network and broadcast addresses excluded? The all-zeroes host portion names the network itself, and the all-ones host portion is the limited broadcast for that link. Both carry link-level meaning, so they are taken out of the pool for classic prefixes — which is exactly why /31 is the exception: a point-to-point link has no broadcast to protect, so RFC 3021 hands those two addresses back.

What is a wildcard mask for? It is the netmask with every bit flipped (a /24 netmask 255.255.255.0 becomes wildcard 0.0.0.255), where a 1 means “any value in that bit”. Router ACLs match on it, and OSPF network <address> <wildcard> area statements use a wildcard rather than a subnet mask. Unlike a netmask, a wildcard can describe non-contiguous matches, e.g. 0.0.255.255 matches any address in the top two octets.

What prefix do I get for 254 hosts, and why not the next size up? A /24, because it yields exactly 254 usable hosts — the tightest fit. A smallest-sufficient check runs on every answer ("/24 holds 254 ≥ 254, while a finer /25 holds only 126") and prints that proof, so you get the most specific prefix that still fits rather than a whole extra block thrown away.

Does my input get sent anywhere? No. The parsing, mask maths and range classification all run in JavaScript on this device; the addresses, masks and host counts you type never leave this device.