Network · Developer
Wildcard mask calculator.
Enter a subnet mask (255.255.255.0), a CIDR prefix (/24) or a wildcard mask (0.0.0.255). Get the wildcard, the subnet mask and the prefix length. Add a network address to see the range it matches.
Inputs
Result
Enter a mask, prefix or wildcard.
What a wildcard mask is
A wildcard mask is the bitwise inverse of a subnet mask. Where the subnet mask has a 1 (network bit), the wildcard has a 0; where the subnet mask has a 0 (host bit), the wildcard has a 1. To calculate it by hand, subtract each octet of the subnet mask from 255: 255.255.255.0 gives 0.0.0.255, and 255.255.255.192 gives 0.0.0.63.
Some router and firewall configuration formats take a network address plus a wildcard mask instead of a prefix length, where 0 bits must match and 1 bits are ignored. Check your device's documentation for the exact syntax. This tool only converts the numbers. It accepts contiguous masks only: a wildcard that mixes 0 and 1 bits in the middle can match a non-contiguous set of addresses and has no single prefix length.
A value such as 0.0.0.255 or 255.255.255.0 is told apart by whether the leading bits are ones (a subnet mask) or zeros (a wildcard). The edge cases: 0.0.0.0 is read as a wildcard (a /32 host match) and 255.255.255.255 as a subnet mask (also /32); type /0 to get the /0 mask 0.0.0.0. See also the subnet mask cheat sheet.
Sources (retrieved 2026-10): RFC 4632 (classless inter-domain routing (CIDR)).
Frequently asked questions
How do I calculate a wildcard mask?
Subtract each octet of the subnet mask from 255. For 255.255.255.224 that gives 0.0.0.31.
What is the wildcard mask for /24?
0.0.0.255. For /16 it is 0.0.255.255, for /8 it is 0.255.255.255, and for /30 it is 0.0.0.3.
What is the wildcard mask for a single host?
0.0.0.0, the inverse of the /32 mask 255.255.255.255. Every bit must match.
Can this convert non-contiguous wildcard masks?
No. A wildcard like 0.0.254.255 has no single CIDR prefix. This tool converts contiguous masks only.
Pure arithmetic — no network access
This tool performs standard IPv4 subnet arithmetic entirely in your browser. It does not look anything up, and it doesn't check whether an address or subnet is actually routed, reachable, or assigned to anyone.