IPv6 prefix checker

Enter an IPv6 address and a prefix such as 2001:db8:1234::/48. The checker compares the high-order network bits, returns a clear true or false result, and shows the normalized network plus its first and last addresses. Compressed, expanded, and IPv4-embedded IPv6 notation are handled with exact 128-bit arithmetic, so even boundary addresses and unusual prefix lengths are evaluated without rounding.

What IPv6 prefix membership means

An IPv6 prefix divides a 128-bit address into network bits and host bits. The number after the slash states how many high-order bits identify the network. For example, a /48 fixes the first 48 bits while leaving the remaining 80 bits available inside that block. An address belongs to the prefix when all fixed network bits match; the textual spelling is irrelevant. That distinction matters because IPv6 allows omitted leading zeroes, compressed runs written as ::, and different-looking strings that represent exactly the same value. This checker parses both values into exact integers, builds the mask for the requested prefix length, and compares only the bits that define membership. It also normalizes the supplied prefix to its true network boundary. If someone enters a host address such as 2001:db8:1234:99::1/48, the compared network is still 2001:db8:1234::/48. The result therefore reflects CIDR semantics instead of relying on fragile string prefixes or colon-group comparisons.

Reading the Boolean result and network range

The primary result is in_prefix, a Boolean that can be used directly in code, validation rules, routing checks, or audit reports. The response also returns the canonical address and canonical prefix so you can see exactly what was compared. The first_address and last_address fields describe the inclusive limits of the network, while matched_network_range presents those same limits as a compact readable range. These fields are returned for both true and false results: when the answer is false, the range explains the block that the address failed to enter. Boundary behavior is exact. The first and last addresses of a prefix both count as members because IPv6 does not reserve a broadcast address. A /128 contains one address, so its first and last values are identical. A /0 covers every IPv6 address. No floating-point values are involved; all masking and range calculations use exact 128-bit integer operations, including ranges far larger than JavaScript's safe integer limit.

Valid input and common mistakes

Provide address as a bare IPv6 address and prefix as an IPv6 network followed by a slash length from 0 through 128. Standard compressed notation such as 2001:db8::1, fully expanded notation, and IPv4-embedded endings such as ::ffff:192.0.2.1 are accepted. The checker deliberately rejects ambiguous or out-of-scope input. The address field cannot include its own slash length, the prefix must include one, IPv4-only values are not treated as IPv6, and zone identifiers such as %eth0 are rejected because they identify an interface context rather than part of the 128-bit address. Invalid hexadecimal groups, multiple :: compressions, groups longer than four digits, and prefix lengths outside the allowed range produce an input error instead of a guessed answer. This strictness is useful in automation: malformed configuration fails visibly before it can become an incorrect allow-list decision. For security-sensitive authorization, remember that membership is only one fact; apply your separate identity, trust, and policy checks as well.