I build toolz.dev, and alongside the WordPress plugins and Laravel APIs I have spent a fair share of time in cloud consoles carving up VPCs and writing firewall rules. Subnetting is one of those skills where the theory is simple and the arithmetic is fiddly, and the fiddly part is exactly where mistakes hide. I have shipped a security group that allowed a /16 when I meant a /24, opening a network far wider than intended, because I did the mask math in my head and got a bit wrong. The IP Subnet Calculator exists so that never happens by hand again. This guide explains what it computes, why the numbers come out the way they do, and the edge cases that trip up both people and the naive calculators they trust.
TL;DR: An IPv4 subnet calculator takes an address and a CIDR prefix, such as
192.168.1.10/24, and derives the network address, broadcast address, first and last usable host, subnet mask, wildcard mask, and total and usable address counts. It works by treating the address as a 32-bit integer and applying the mask with bitwise operations. It correctly handles the two edge cases that matter, treating a/31as a two-host point-to-point link per RFC 3021 and a/32as a single host, and it accepts a dotted mask in place of the prefix. It runs entirely in your browser, so no address you enter is uploaded.
What is a subnet and what does the prefix mean?
An IPv4 address is 32 bits, written as four decimal octets like 192.168.1.10. A subnet is a contiguous block of those addresses that share the same leading bits. The CIDR prefix, the number after the slash, says how many of the 32 bits are fixed as the network portion. The remaining bits are free to vary and identify individual hosts. So /24 fixes the first 24 bits and leaves 8 for hosts, /16 fixes 16 and leaves 16, and /30 fixes 30 and leaves just 2.
The number of addresses in a block is two raised to the power of the host bits. A /24 has 8 host bits, so 2 to the 8th, which is 256 addresses. A /16 has 16 host bits, so 65,536 addresses. A /30 has 2 host bits, so 4 addresses. This is the whole basis of the math, and once you internalize "addresses equal two to the power of thirty-two minus the prefix," most of subnetting stops being mysterious.
CIDR, which stands for Classless Inter-Domain Routing, was introduced in RFC 4632 to replace the old classful system, where an address's class was fixed by its first octet. Classful addressing wasted enormous amounts of space, because you had to take a whole Class A, B, or C block even if you needed something in between. CIDR lets you pick any prefix length and size a network to what you need. The classful labels A, B, and C still show up in tools, including mine, but they are informational now; the prefix is what decides the network boundary.
Why are two addresses in every subnet not usable?
In a normal subnet, the first and last addresses are reserved and cannot be assigned to a host. The first address, with all host bits set to zero, is the network address, and it names the subnet itself. The last address, with all host bits set to one, is the broadcast address, and a packet sent to it reaches every host on the subnet at once. Because those two are spoken for, the usable host count is the total number of addresses minus two.
That is why a /24 has 256 total addresses but only 254 usable ones, and why a /30, with 4 addresses, gives you exactly 2 usable hosts. The /30 is the classic choice for a link between two routers, because a point-to-point link needs exactly two addresses and nothing more. The calculator spells the network and broadcast addresses out explicitly, along with the first and last usable host, so you never have to work out which addresses are off-limits.
How does the calculator compute the numbers?
Under the hood it is bitwise arithmetic on 32-bit integers, which is both the fastest and the least error-prone way to do it. The address is packed into a single unsigned integer by shifting each octet into place. The mask for a prefix is a run of ones followed by zeros, produced by shifting 0xFFFFFFFF left by 32 minus the prefix. From there, every value is one operation:
- The network address is the address bitwise-ANDed with the mask, which zeroes out the host bits.
- The broadcast address is the network ORed with the inverse of the mask, which sets all the host bits.
- The wildcard mask is simply the bitwise inverse of the subnet mask.
- The first usable host is the network address plus one, and the last is the broadcast minus one.
Doing it this way sidesteps the mistakes that creep in when people convert to binary strings by hand. It also makes the reverse conversion trivial: to turn a dotted mask like 255.255.255.0 back into a prefix, you count the leading one-bits, and the calculator does that when you enter a mask instead of a slash notation. Everything stays as unsigned 32-bit integers throughout, which matters in JavaScript because you have to force unsigned interpretation to avoid negative numbers creeping in on the high bit.
What are the edge cases most tools get wrong?
Two prefixes break the simple "minus two" rule, and a surprising number of calculators handle them incorrectly.
The first is /31. Under the original rules a /31 would have two addresses, both reserved, leaving zero usable hosts, which is useless. RFC 3021 fixed this by allowing a /31 on point-to-point links, where there is no need for a broadcast address, so both of its two addresses become usable. This calculator reports a /31 as two usable hosts with the network and broadcast addresses doubling as the two host addresses, which is what modern routers do on serial and point-to-point interfaces.
The second is /32. A /32 is a single address, a host route. It represents exactly one machine, which is how loopback addresses, host-specific firewall rules, and individual routes are expressed. The calculator reports it as one usable host with the network address equal to the address itself and no separate range. A tool that blindly subtracts two would report negative or zero hosts for both of these, which is nonsense, and I made sure this one does not.
How to use the subnet calculator
Step 1: Enter an address and prefix
Type an IPv4 address with a CIDR prefix, such as 10.0.0.0/8 or 192.168.1.10/24. The prefix can be anything from 0 to 32. If you paste an address with no prefix, the tool assumes a /24, the most common default, and you can adjust from there.
Step 2: Or use a dotted subnet mask
If you have a mask rather than a prefix, enter the address and mask separated by a space, like 192.168.1.10 255.255.255.0. The calculator counts the leading one-bits in the mask, converts it to the matching prefix, and rejects any mask whose ones are not contiguous, because such a mask is not a valid CIDR mask.
Step 3: Read the results
You get the network address, the broadcast address, the usable host range, the subnet mask, the wildcard mask, the total and usable address counts, the classful range, and whether the address is private under RFC 1918. There is also a binary view of the address and the mask, which is the fastest way to see exactly where the network boundary falls.
Step 4: Copy what you need
Each value has a copy button, so you can lift the CIDR notation into a route table, the host range into documentation, or the wildcard mask into a Cisco access list without retyping and risking a transposed octet.
Subnet mask and prefix reference
This is the table I keep coming back to, and the calculator generates it live so the numbers are never stale.
| CIDR | Subnet mask | Total addresses | Usable hosts |
|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
The pattern is worth memorizing: each step up in prefix halves the block. A /25 is half a /24, a /26 is a quarter, and so on. When you are splitting a network, that halving is the mental model, and the calculator confirms the exact boundaries so you do not have to trust the mental model alone.
How do you split one network into smaller subnets?
The most common real task is not calculating a single subnet but dividing a larger block into several smaller ones, and this is where the calculator earns its keep. Say you are handed 10.0.0.0/16 for a cloud VPC and need to carve it into subnets for a public tier, a private tier, and a database tier. Each step up in prefix doubles the number of subnets and halves their size, so moving from /16 to /18 gives you four equal blocks of 16,384 addresses each: 10.0.0.0/18, 10.0.64.0/18, 10.0.128.0/18, and 10.0.192.0/18. You can check every one of those boundaries by pasting it into the calculator and confirming the network and broadcast addresses line up with no gaps and no overlaps.
The trap here is that subnets must fall on their natural boundaries. A /26 block cannot start at just any address; it has to begin at a multiple of 64 in its last octet, because 64 is the block size for a /26. If you try to start it at .30, the network address the calculator reports will not match what you typed, which is the fastest way to catch the mistake. When I plan a VPC, I paste each intended subnet in turn and read back the network address; if the tool shows a different network address than the one I meant to define, I know my boundary is wrong before I ever apply it. The same discipline works for a router's static routes and for firewall rules, where an off-boundary block silently covers addresses you did not intend.
There is also a real-world subtlety worth naming: cloud providers reserve some addresses inside each subnet beyond the network and broadcast pair. AWS, for example, reserves five addresses per subnet, not two, taking the first four and the last one. The calculator reports the strict RFC host range, so on AWS you subtract three more from the usable count it shows. That is a provider convention layered on top of the standard, not a flaw in the math, but it is exactly the kind of thing that leaves you two hosts short if you forget it.
Which ranges are private, and why does it matter?
RFC 1918 reserves three blocks for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These are not routable on the public internet, and they are the ranges nearly every home and office network uses behind a router doing Network Address Translation. The calculator flags whether the address you entered falls in one of them, which is a quick sanity check when you are planning an addressing scheme and want to confirm you are working inside private space rather than accidentally using an address that belongs to someone else on the public internet. It is also a useful nudge when you see a "public" flag on an address you expected to be internal, because that often means a typo in the first octet.
Where the subnet calculator fits with everything else
Networking work rarely happens in isolation. When you are configuring the infrastructure behind an application, you are also debugging HTTP responses, parsing user agents, and generating credentials for internal services. The HTTP status codes reference is the companion for the application layer, the user agent parser for figuring out what is hitting your servers, and the basic auth generator for the credentials that protect internal endpoints. If you are converting between number bases while reading masks in binary, the number base converter handles the decimal-to-binary step directly. And on the security side, the credit card validator is the front-end filter for the checkout that runs on the network you just designed.
For the broader picture, the developer productivity tools roundup covers the utilities that tend to sit open in a tab all day, and the coding tools guide puts the subnet calculator in the context of a full developer toolkit. Like everything on toolz.dev, it runs entirely in your browser, so the addresses you plan with never leave your machine.
Frequently asked questions
What does the CIDR prefix mean?
The CIDR prefix is the number after the slash, and it counts how many leading bits of the address identify the network. A /24 fixes the first 24 bits for the network and leaves 8 bits for hosts, which is 256 total addresses and 254 usable ones. A smaller prefix covers more addresses, and a larger one covers fewer.
How many usable hosts are in a subnet?
For a prefix of /30 or smaller, the usable host count is the total addresses minus two, because the first address is the network and the last is the broadcast. A /24 has 254 usable hosts, a /26 has 62, and a /30 has 2. The two exceptions are /31, which has 2 usable hosts, and /32, which has 1.
What is the difference between the network address and the broadcast address?
The network address is the first address in the block and identifies the subnet itself, with all host bits set to zero. The broadcast address is the last address, with all host bits set to one, and a packet sent to it reaches every host on the subnet at once. Neither can be assigned to an individual host in a normal subnet.
How do I convert a subnet mask to a CIDR prefix?
Count the leading one-bits in the mask. 255.255.255.0 is 24 one-bits, so it is /24; 255.255.240.0 is 20 bits, so /20. The calculator does this conversion automatically when you enter a dotted mask instead of a prefix, and it rejects any mask whose ones are not contiguous.
What is a wildcard mask used for?
A wildcard mask is the bit-inverse of the subnet mask, so /24 gives 0.0.0.255. It is used in Cisco access control lists and OSPF network statements, where a zero bit means match this bit exactly and a one bit means ignore it. It is easy to confuse with the subnet mask, which is why the calculator shows both side by side.
Why does a /31 show two usable hosts?
RFC 3021 allows a /31 on point-to-point links, where the network and broadcast addresses are not needed, so both of its two addresses become usable host addresses. Without that rule a /31 would have zero usable hosts, which is useless. A /32 is the related edge case and represents a single host, such as a loopback or a host route.
Which IPv4 ranges are private?
RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for private networks. These are not routable on the public internet and are the ranges most home and office networks use behind a router doing NAT. The calculator flags whether the address you entered falls in one of them.
Does this calculator work for IPv6?
No, this tool calculates IPv4 subnets only. IPv6 uses 128-bit addresses and hexadecimal notation, so its subnetting works differently and needs a dedicated calculator. For IPv4 planning, firewall rules, and cloud VPC sizing, which is where most day-to-day subnet math happens, this covers the common cases.
