CIDR and Subnet Calculator
Expand a CIDR block into its range, mask and size, and check whether an address falls inside it.
About this tool
Takes CIDR blocks and reports what each one covers: first and last address, netmask, wildcard, and how many addresses are in it. Optionally checks whether a specific address falls inside any of them.
The everyday use is a firewall rule or an SPF record. Somebody gives you `203.0.113.64/26` and the question is which addresses that is. One bit out in either direction either admits a range you meant to exclude or locks out half the addresses you meant to allow, and neither failure announces itself.
IPv6 is handled properly. A `/48` holds more addresses than fits in any integer type, so the arithmetic is done on the packed binary form rather than in floating point — which is where other calculators start returning round numbers that are not the right ones.
Common questions
What does the number after the slash mean?
How many leading bits are fixed. A /24 fixes the first 24 bits of an IPv4 address, leaving 8 to vary — 256 addresses. Every extra bit halves the block.
Why is the usable count two lower than the total for IPv4?
The first address in a block is the network address and the last is the broadcast address, and neither is assignable to a host. This does not apply to /31 and /32, or to IPv6 at all.
How do I use this with SPF?
An ip4 mechanism takes a CIDR block. Expanding it here shows exactly which addresses you are authorising to send as your domain, which is worth checking before publishing rather than after.
Why does an IPv6 block show such a large number?
Because it is that large. A single /64 holds about 18 quintillion addresses — more than the entire IPv4 internet squared. The count is exact, not rounded.