ForHosting KIT · Developer Utilities

CIDR prefix to subnet mask converter

A CIDR prefix is compact, but many routers, access-control lists, and network worksheets still expect dotted-decimal masks.

● BetaFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailTelegramApp soon

This converter turns any IPv4 prefix length from 0 through 32 into the corresponding subnet mask, its inverse wildcard mask, and the total number of addresses in the block. Enter the number after the slash, such as 24 for /24. The calculation is deterministic and covers the complete IPv4 range, including the boundary cases /0 and /32.

Reading an IPv4 CIDR prefix

CIDR notation writes an IPv4 network as an address followed by a slash and a prefix length, such as 192.0.2.0/24. The prefix is the count of consecutive one bits at the beginning of the 32-bit subnet mask. This converter needs only that number, so enter 24 rather than the full address or the slash. A larger prefix reserves more bits for the network and leaves fewer bits for addresses inside the block. A /8 therefore covers far more addresses than a /28. The valid IPv4 range is 0 through 32: /0 has no fixed network bits and covers the entire IPv4 address space, while /32 fixes every bit and identifies one address. The returned dotted-decimal subnet mask expresses the same boundary in the familiar four-octet form. For example, /24 becomes 255.255.255.0 because the first 24 mask bits are ones and the final eight are zeros. No IP address is needed because every given prefix always maps to exactly one subnet mask.

Understanding the mask, wildcard, and address count

The subnet mask marks network bits with ones and remaining bits with zeros. Written in dotted decimal, each group of eight bits becomes an octet from 0 to 255. The wildcard mask reverses every bit of that mask, which makes it useful in systems that describe the variable portion of an address rather than the fixed portion. Thus a /26 produces subnet mask 255.255.255.192 and wildcard mask 0.0.0.63. The two corresponding octets always add to 255. Address count comes from the number of bits left after the prefix: two raised to the power of 32 minus the prefix. A /26 leaves six bits, so its block contains 64 total addresses. This total is deliberately not labeled as a usable-host count. Traditional IPv4 subnets often reserve the network and broadcast addresses, but point-to-point links, host routes, and platform-specific policies use different rules. Reporting the complete block size avoids embedding assumptions about how a network will be deployed.

Using the result in network configuration

Use the subnet mask when a device or legacy form accepts an address and dotted-decimal mask instead of CIDR notation. Use the wildcard mask where a router rule, access list, or matching interface explicitly asks for an inverse mask. Always follow the terminology of the target system: a wildcard is not interchangeable with a subnet mask even though one is calculated by inverting the other. The address count is helpful for capacity checks, allocation plans, and quick comparisons between blocks. It tells you the mathematical size of the CIDR block before any addresses are reserved by a particular networking convention. When copying a result, keep the original prefix nearby so reviewers can confirm that the configuration and documentation describe the same network boundary. This tool converts only the prefix; it does not calculate a network address, broadcast address, host range, or whether a particular IP belongs to a subnet. Those tasks require an IPv4 address in addition to the prefix. The conversion itself uses fixed 32-bit arithmetic, so repeated requests with the same prefix always return identical values.

What you can do with it

Fill a legacy network form

Convert a prefix from modern CIDR notation into the dotted-decimal subnet mask required by older device interfaces.

Prepare an access-list wildcard

Get the inverse mask needed by network products that express matching ranges with wildcard bits.

Compare allocation sizes

Check the total number of IPv4 addresses represented by candidate prefixes before assigning address space.

FAQ

Should I include the slash?

No. Enter only the integer prefix length, such as 24 for /24.

What prefix lengths are valid?

IPv4 prefixes are whole numbers from 0 through 32, inclusive.

Is address count the same as usable host count?

No. Address count is the complete mathematical size of the block. Usable-host rules depend on the network and deployment convention.

What is a wildcard mask?

It is the bitwise inverse of the subnet mask: every one becomes zero, and every zero becomes one.

What does the API request cost?

Each API request costs $0.002. The browser version can run locally on this page.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/dev/cidr-to-netmask

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/dev/cidr-to-netmask \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prefix":24}'

const res = await fetch("https://api.kit.forhosting.com/dev/cidr-to-netmask", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "prefix": 24
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/dev/cidr-to-netmask",
    headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
    json={
    "prefix": 24
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/cidr-to-netmask", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => '{"prefix":24}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"prefix":24}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/cidr-to-netmask", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "prefix": 24
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "dev.cidr_to_netmask",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →