Subnet calculator
The subnet calculator takes a network in CIDR notation — or an address with its dotted mask — and returns everything that follows from it: the network and broadcast addresses, the netmask and its wildcard, the first and last usable host, the total number of addresses and the reverse DNS zone. It handles IPv4 and IPv6, and it can split a block into equal subnets of the prefix you ask for.
Run — free
Runs in your browser. Free, unlimited — your data never leaves this page.
The arithmetic nobody should be doing by hand
Every network question that starts with a slash ends in binary: how many hosts fit in a /26, which address is the broadcast, where one subnet stops and the next begins. Doing it in your head is a two-minute detour that goes wrong about as often as it goes right, and a wrong answer here is a firewall rule that silently covers the wrong machines. Send the block, get the whole picture back: network, mask, wildcard, broadcast, first and last usable host, and the count of addresses.
Three ways to write the same network
The calculator accepts a network the way people actually copy it. Standard CIDR — 192.168.1.0/24 — is the obvious one. An address with its dotted mask, as it appears in an interface configuration, works too: 192.168.1.10 255.255.255.0. So does a bare address, which is read as a single host. In all three cases the address is masked down to its network first, so 10.0.5.37/20 answers about 10.0.0.0/20, which is almost always the question actually being asked.
The edge cases that are usually wrong
A /31 is not a broken /30. Under RFC 3021 it is a point-to-point link whose two addresses are both usable, and there is no broadcast; a calculator that reports zero usable hosts there is repeating a rule that stopped being true in 2000. A /32 is a single address with neither network nor broadcast. A mask whose ones are not contiguous — 255.255.0.255 — is not a mask at all, and it is rejected rather than quietly producing a plausible, wrong result. Those three cases are where most tools disagree, so they are where this one is explicit.
IPv6 without rounded numbers
An IPv6 block does not fit in the numbers most tools count with: a single /64 holds more than eighteen quintillion addresses, well past the point where floating point starts rounding. Here the arithmetic is done on exact integers and the total is returned as a string, so the last address of a range is the address that really ends it. Addresses come back in canonical form — lowercase, zeros collapsed once — plus the fully expanded version, which is what you want when you are comparing two of them by eye.
Splitting a block
Ask for a longer prefix and the block comes back divided into equal subnets, each with its own range: a /24 split into /26 gives four, a /16 split into /24 gives 256. This is the step where planning goes wrong on paper, because the boundaries are not where intuition puts them. A single response is capped at 1024 subnets, which keeps the answer readable; beyond that, split in two passes.
What you can do with it
Plan an address range before you configure anything
Decide how a block is divided while it is still a decision, not a running network that has to be renumbered.
Check a firewall or ACL rule
Confirm exactly which addresses a rule covers before it goes live, instead of after somebody loses access.
Read a network you inherited
Turn an address and mask from an old interface configuration into the range, host count and reverse zone they imply.
Validate input in your own tooling
Call the API to check that a customer-supplied block is well formed before it reaches your provisioning system.
FAQ
What does it cost?
It is free to use on this page, in your browser: nothing is sent anywhere. Through the API it costs $0.002 per request, billed against your balance.
Does my network data leave my machine?
Not when you use the tool on this page — the calculation runs entirely in your browser. Through the API, the block you send is processed and discarded; nothing is stored.
Does it support IPv6?
Yes. IPv6 blocks are calculated with exact integer arithmetic, and the total number of addresses is returned as a string so nothing is rounded.
Why does a /31 show two usable hosts?
Because RFC 3021 defines a /31 as a point-to-point link where both addresses are usable and there is no broadcast. The older rule of subtracting two does not apply.
Can I split a network into smaller subnets?
Yes. Give the prefix you want and each resulting subnet comes back with its own range. A single response returns at most 1024 subnets.
What happens with an invalid mask?
It is rejected with an explanation. A mask whose ones are not contiguous, such as 255.255.0.255, is not a valid mask, and returning a result for it would be worse than returning an error.
Why is there no reverse zone for some networks?
The in-addr.arpa zone only falls on a whole octet — /8, /16 or /24. Anything else needs RFC 2317 delegation, so a single zone name would be misleading and none is given.
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/dev/subnet \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"items":["valor-1","valor-2"]}'const res = await fetch("https://api.kit.forhosting.com/dev/subnet", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"items": [
"valor-1",
"valor-2"
]
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/dev/subnet",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"items": [
"valor-1",
"valor-2"
]
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/subnet", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"items":["valor-1","valor-2"]}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/subnet", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"items": [
"valor-1",
"valor-2"
]
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "dev.subnet",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_subnets | 1024 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |