Free subnet calculator

Type 10.0.0.4/31 into most subnet calculators and they will tell you it has zero usable hosts. That answer is twenty years out of date. RFC 3021 made both addresses on a /31 usable precisely so router-to-router links stop wasting two addresses each, and there are probably a few dozen /31s in your network right now carrying traffic that the calculator says cannot exist. This one reports two.

We sell asset-tracking software, so read the pitch above with a raised eyebrow. The calculator has nothing to do with it — it is arithmetic in your browser.

Where the plan check earns its keep

The single-address mode is table stakes; every tool on this page of results does it. The third tab is the one worth your time.

Paste your IP plan — the spreadsheet, the wiki table, the output of whatever your team keeps VLANs in — and every block gets checked against every other block, not just the one above it. That ordering matters more than it sounds. Somebody adds 10.0.0.0/16 at the bottom of the sheet as a "site summary" six months after the /24s were carved, and a check that only compares neighbours sails straight past it. Here it lights up against all of them.

Column order does not matter either. Feed it VLAN 30, 10.0.30.0/24, printers or the other way round; whatever on the line is not a network becomes the label, and the label survives into the CSV so the export still says which row was the printers.

The output also names the range each block sits in. Private per RFC 1918, obviously, but also carrier-grade NAT (100.64.0.0/10), APIPA link-local (169.254.0.0/16), documentation ranges, and multicast. Finding 169.254 in a plan usually means somebody wrote down what a machine picked up when DHCP failed.

CIDR to range, and range back to CIDR

Half the people who land here are not subnetting at all — they have 10.0.20.0/22 in a ticket and need to know which addresses that actually covers, so they can write a firewall rule or hand a range to whoever is doing the scanning. The Calculate tab answers that directly: paste the block, read the IP range off the top row.

Two ranges get shown, and the difference matters more often than people expect. The IP range is the whole block, network and broadcast included — that is what an allow-list or a firewall object wants. The usable range is what you can put on an interface, which is two addresses narrower everywhere except /31 and /32. Writing a firewall rule against the usable range quietly excludes the broadcast address, and finding that out later is not fun.

It works the other way too, and this is the half most calculators skip. Type a range — 10.0.0.5 - 10.0.0.20 — and you get back the CIDR blocks that cover it exactly. Usually there is more than one, because an arbitrary range is almost never a subnet: those sixteen addresses take four blocks, and 172.16.5.3 to 172.16.9.200 takes thirteen. A firewall rule or an RIR form needs all of them, and getting that list by hand is where the afternoon goes.

Give it an address with a dotted mask instead and the CIDR notation comes back, which is the other direction people mean by a CIDR converter.

Two things it refuses to do

010.0.0.1 gets rejected rather than interpreted. That string is 8.0.0.1 to anything that reads the leading zero as octal and 10.0.0.1 to anything that does not, and quietly picking a side is how a firewall rule ends up on a network nobody intended. Strip the zero and try again.

A bare address becomes a /32, not a classful guess. Nothing has honoured class A/B/C since CIDR arrived in 1993, and answering "/8" for a 10.x host is a wrong answer wearing a helpful expression.

Splitting

Give it a block and a target prefix and you get the list — CIDR, network, usable range, broadcast — plus a CSV to paste into the plan you are actually maintaining. It caps at 512 rows, because a /8 divided into /30s is four million lines and nobody wants that in a browser tab. IPv6 works in the calculator, not the splitter; carving a /48 into /64s produces 65,536 rows that are more usefully described by a sentence than a table.

Want the whole prefix table to read rather than one answer at a time? That is the subnet cheat sheet, /32 down to /0 on one page.

Doing the reverse — labelling the physical boxes those addresses belong to — is a different job. The MAC address lookup names the manufacturer behind an address you found on the wire, and the bulk barcode generator prints the asset tags.