Last updated: 2026-06-24

CIDR to Netmask

A CIDR-to-netmask converter translates between the two ways of writing where a network ends and its hosts begin: the slash-prefix shorthand of CIDR notation, such as /24, and the dotted-decimal subnet mask it stands for, such as 255.255.255.0. Enter either form, pick the direction, and read off the matching prefix or mask along with the wildcard mask and the number of addresses the block holds. Network engineers reach for this whenever a router wants a mask but the documentation lists a prefix — or the reverse.

Two ways of writing one boundary

Every IPv4 address is 32 bits long. A network is defined by splitting those bits into a leading network portion and a trailing host portion. The subnet mask spells out that split bit by bit: a 1 marks a network bit and a 0 marks a host bit. Because the network bits always come first, the mask is a run of 1-bits followed by a run of 0-bits, which in dotted-decimal form looks like 255.255.255.0.

The CIDR prefix length is simply the count of those leading 1-bits. A mask of 255.255.255.0 has 24 one-bits, so it is written /24. Nothing is lost going either direction: a prefix length names exactly one mask, and a contiguous mask names exactly one prefix length.

From prefix to mask

Given a prefix length n, the mask has n ones followed by 32 − n zeros. Read four bytes out of that bit pattern and you get the dotted-decimal mask. For /20 the bits are 11111111.11111111.11110000.00000000, which is 255.255.240.0.

The wildcard mask is the bitwise inverse — every 1 flips to a 0 and every 0 to a 1. It is the form Cisco access-control lists and OSPF use, where a 0 bit means "must match" and a 1 bit means "ignore". For /24 the mask is 255.255.255.0 and the wildcard is 0.0.0.255.

The number of addresses the block holds depends only on the host bits:

$A = 2^{\,32 - n}$

From mask to prefix

Going the other way, count the leading 1-bits in the mask. The mask must be contiguous — an unbroken run of ones followed by an unbroken run of zeros. A mask like 255.255.0.255 has a 0-bit sitting before later 1-bits, so it corresponds to no prefix length and is rejected. Once the run is counted, the same formula gives the block size.

Worked example

Take the mask 255.255.255.192. Written in binary the last octet is 11000000, so the full mask is 11111111.11111111.11111111.11000000 — that is 26 one-bits, giving a prefix of /26. The host portion is 6 bits, so

$A = 2^{\,32 - 26} = 2^{6} = 64$

The wildcard mask is the inverse of 255.255.255.192, which is 0.0.0.63. So a /26 block carries 64 addresses, a mask of 255.255.255.192, and a wildcard of 0.0.0.63 — all three describe the same boundary.

Common prefixes

A short table covers most everyday networks.

Each step up in prefix length halves the block; each step down doubles it. Point-to-point links lean on /30 and /31, while a /32 pins down a single address for a host route or firewall rule.

Related calculators

For the full breakdown of a block — network and broadcast addresses and the usable host range — use the Subnet (CIDR) Calculator. To roll several adjacent blocks into the smallest covering route, see the IP Supernet Calculator.