Convert between a CIDR prefix and a dotted-decimal subnet mask, either direction.
A subnet mask and a CIDR prefix length are two different notations for exactly the same information — which bits of an IP address are the network portion. /24 and 255.255.255.0 mean precisely the same thing; this tool converts between them in either direction, since different tools, router configs, and documentation use one convention or the other.
It also shows the wildcard mask (the bitwise inverse of the subnet mask), which is the format Cisco access control lists and some routing protocols expect instead of a standard subnet mask — a detail that trips people up specifically because it looks similar but means the opposite thing.
Not every dotted-decimal value is a valid subnet mask — a valid mask must be a contiguous run of 1-bits followed by 0-bits (like 11111111.11111111.11111111.00000000), never mixed. This tool checks for that and tells you if what you entered isn't a valid mask.
Worked example: /24 converts to the subnet mask 255.255.255.0 — 24 bits set to 1 (the network portion) followed by 8 bits set to 0 (the host portion), read as four 8-bit octets. The wildcard mask is the bitwise inverse of that: 0.0.0.255, found by subtracting each octet from 255 (255−255=0, 255−255=0, 255−255=0, 255−0=255). A common mistake is entering a Cisco ACL's wildcard mask into a field expecting a standard subnet mask, or vice versa — since both are valid-looking dotted-decimal values, nothing will visibly error, but the configuration will behave backwards from what was intended.
A wildcard mask is the bitwise inverse of a subnet mask (0.0.0.255 instead of 255.255.255.0 for a /24). Cisco ACLs and some OSPF configurations use wildcard masks instead of subnet masks — easy to mix up since the notation looks identical.
A valid subnet mask must be a contiguous block of 1-bits followed by 0-bits with no gaps, like 255.255.255.0. Something like 255.255.0.255 isn’t contiguous and isn’t a valid mask, even though it’s a valid-looking IP-style number.
Yes — /0 means no bits are fixed (the entire address space, used for default routes), and /32 means all 32 bits are fixed (a single specific host).