What does the /N in CIDR notation mean?

/N is the prefix length — the number of leading bits fixed by the network address. /24 means the first 24 bits identify the network and the remaining 8 bits identify hosts (256 addresses, 254 usable).

Why is the usable host count two less than the address count?

The first address in a block is the network identifier and the last is the broadcast address, both reserved. /31 and /32 are special-cased by RFC 3021 (point-to-point) and single-host respectively.

Is the calculation local?

Yes. CIDR math runs in your browser; no DNS or network lookups happen.

cidr · subnet · network · live

Compute CIDR network ranges

Enter an IPv4 CIDR block to derive the network, broadcast, host range, netmask, and total addresses. All math runs locally in your browser.

CIDR Calculator

Input

11 B

cidr

Prefix

/24

bits

Hosts

254

usable

Status

live

input · cidr

output · range

Network10.0.0.0

Broadcast10.0.0.255

First host10.0.0.1

Last host10.0.0.254

Netmask255.255.255.0

Wildcard0.0.0.255

Total addresses256

Usable hosts254

Prefix/24

Quick Start

How to calculate a CIDR block

CIDR notation packs an IPv4 address and prefix length into one string. The prefix tells you how many bits belong to the network — the rest are hosts.

01
Enter a CIDR
Format A.B.C.D/N. The /N is the prefix length.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
inputUTF-8TextEncoderlosslesslive
input · raw bytescidr · UTF-8
```
10.0.0.0/24
```
loaded · UTF-8MIME · ready
02
Network + broadcast
The first address is the network; the last is the broadcast.
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
rangeWeb Cryptosubtledeterministiclive
network · optionsbroadcast · live
```
10.0.0.0 — 10.0.0.255
```
options applied · livelive
03
Host range
Usable hosts live between network+1 and broadcast-1.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
hostsmemoisedoptionsinstantreactive
first · encodedlast · ready
```
10.0.0.1 — 10.0.0.254
```
encoded · livelossless
04
Copy or download
Grab the full report as text for tickets or docs.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
exportclipboardblobMIME-correctclient-side
ok · copiedready · done
```
Copied
```
shipped · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When CIDR math matters

Subnetting, firewalls, cloud VPCs, capacity planning.

VPC sizing

Plan AWS/GCP/Azure subnets without overlap. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Firewall rules

Translate /N prefixes into IP ranges for ACLs. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

DHCP scopes

Pick first/last host for static reservations. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Log filtering

Match log lines against subnet boundaries. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Capacity planning

Count usable hosts before you outgrow a block. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Documentation

Standardise network docs with derived ranges. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

What does /24 mean?

The first 24 bits identify the network; the remaining 8 are hosts — so 256 addresses, 254 usable.

Why do /31 and /32 show zero hosts?

A /32 is a single address; /31 is reserved for point-to-point links per RFC 3021 and has no broadcast.

What's the wildcard mask?

The bitwise inverse of the netmask. Cisco ACLs use it to match address ranges.

Does this support IPv6?

Not in this tool — use the IPv6 Converter for IPv6 prefixes.

Is anything sent to a server?

No. Everything runs locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!