Every fact about an IPv4 or IPv6 block, plus splitting, merging, range to CIDR, and which special-purpose range an address falls in
Initializing in your browser…
Find your public IP address, location, timezone, and ISP information instantly via the ipapi.co lookup service
Focus timer using Pomodoro technique with work/break sessions, circular progress, presets (Classic 25/5, Deep Work, 52/17), stats tracking, and auto-start options
Build a PKCS#10 certificate signing request with subject alternative names, RSA, ECDSA or Ed25519. Signed and verified in the page before you send it to a CA.
Someone hands you 172.16.5.5/12 and asks whether it is routable, how big the block is, and where it ends. Then you have to write a firewall rule for 192.168.1.5 through .20, which is not a power of two.
Typed
172.16.5.5/12
Everything about the block
172.16.5.5 is in 172.16.0.0/12: Private use RFC 1918. A unicast packet sent to an address here does not cross the public Internet. CIDR 172.16.0.0/12 Network address 172.16.0.0 Broadcast address 172.31.255.255 First host 172.16.0.1 Last host 172.31.255.254 Netmask 255.240.0.0 Wildcard mask 0.15.255.255 Addresses 1,048,576 Usable hosts 1,048,574 Host bits 20 Network 10101100.00010000.00000000.00000000 Mask 11111111.11110000.00000000.00000000 172.16.5.5 has bits set below the /12 boundary, so it is a host inside the block rather than the block itself. Range to CIDR, 192.168.1.5 to 192.168.1.20, 16 addresses: 192.168.1.5/32 192.168.1.6/31 192.168.1.8/29 192.168.1.16/30 192.168.1.20/32
Two things here are easy to get wrong by hand and easy to get wrong in code. The first is which address decides the answer: 172.16.5.5 is private because it is inside 172.16.0.0/12, and it stays private whatever prefix you write after it, but the /12 network address is 172.16.0.0 and a tool that reads the flag off the masked network rather than off the address you typed gets a different answer as soon as the prefix moves. The second is the range: sixteen addresses starting at .5 do not fall on a power of two boundary, so they need five blocks of four different sizes, and each one is the largest block that both starts where the previous one ended and does not run past .20. Every number here is checked against Python's ipaddress module in the project's tests, including the address counts, which are exact integers: an IPv6 /65 holds 9,223,372,036,854,775,808 addresses, and a floating point number would report ...776,000.
Subnet arithmetic done wrong under pressure is how an outage gets longer. Paste a block in any form (192.168.1.130/24, 10.0.0.0/255.0.0.0, 2001:db8::1/64, or a bare address with the slider) and every fact about it appears at once: network address, broadcast, first and last host, netmask, wildcard mask, the address count as an exact integer however large, the binary, and which of the special-purpose ranges of the IANA registry the address falls in, with the RFC that defines it. Four more tools sit beside it: split a block into equal subnets, ask whether an address is inside a block, merge a list of blocks into the fewest that cover them, and turn a start and end address into the exact CIDR blocks that cover the range.
The arithmetic is done on the address bytes and on BigInt, never on a floating point number, and every field is compared against Python's `ipaddress` module in the project's test suite: 290 assertions in the module and 223 in the browser, covering 264 IPv4 networks and 90 IPv6 networks with six and four fields each. A double is exact only up to 2^53, so an IPv6 /65 holds 9,223,372,036,854,775,808 addresses and a double reports 9,223,372,036,854,776,000; a /1 holds 2^127, which a double cannot express at all. Both are printed here in full.
Addresses are parsed strictly. An IPv4 octet with a leading zero is refused rather than accepted, because `inet_aton` and several resolvers read 0177.0.0.1 as octal and land on 127.0.0.1, so the address is ambiguous rather than merely unusual. IPv6 follows RFC 4291 section 2.2 including the dotted-quad form, so ::ffff:192.0.2.1 and 64:ff9b::192.0.2.1 both parse; an address with nine groups, or with three and no ::, is refused with the count rather than quietly padded. A zone identifier such as fe80::1%eth0 is refused by name, since a zone belongs to a host rather than to a block. The canonical output follows RFC 5952: lower case, no leading zeros, the longest run of zero groups elided and never a single one, and the mixed dotted form only for the IPv4-mapped range ::ffff:0:0/96, which is what Python does too.
The host count follows the rule that applies. A /30 has two usable hosts because the first address is the network and the last is the broadcast. A /31 has two, because RFC 3021 does away with both on a point to point link, and the page says so. A /32 has one. IPv6 has no broadcast address at all, so every address in a block is usable, and the all-zeros address is the Subnet-Router anycast address of RFC 4291 section 2.6.1 rather than a host.
The special-purpose lookup is over the IANA IPv4 and IPv6 registries that RFC 6890 defines, longest prefix first, so 100.64.0.1 is named as carrier-grade NAT space from RFC 6598 rather than lumped in with RFC 1918, and 192.0.2.1 is named as TEST-NET-1 from RFC 5737. Twenty IPv4 blocks and fifteen IPv6 blocks are covered. The lookup is done on the address you typed, not on the masked network address, which matters: 172.16.5.5 is a private address whatever prefix you put after it, while 172.0.0.0 is not.
The A, B and C class letter is still shown, because certification exams still ask for it, and the caveat travels with it: classful addressing was replaced by CIDR in 1993 by RFC 1518 and RFC 1519, and nothing on the Internet has routed by class since.
Split a /16 into /24s or a /32 of IPv6 into /48s and see the count before you commit. The list is copyable.
Range to CIDR turns 192.168.1.5 through 192.168.1.20 into the five blocks that cover it exactly, which is the calculation people get wrong by hand.
Paste the blocks and Aggregate merges every adjacent pair and drops anything already covered by something larger.
Contains answers whether the address is in the block at all, and the special-range note says whether the address can be routed across the Internet in the first place.
The binary view lines the mask up with the network, and the class letter is there with an explanation of why it no longer decides anything.
Because RFC 3021 says so. On a point to point link a /31 has no network address and no broadcast address, so both of its two addresses are usable. A /30 in the same position wastes two of its four.
IPv6 has none. RFC 4291 replaced broadcast with multicast, so the page shows the last address of the block instead and every address in the block is usable. The all-zeros address of a subnet is the Subnet-Router anycast address, which is reachable but is not one host.
Because the address is private, whatever prefix you write. 172.16.0.0/12 is the RFC 1918 block, and 172.16.5.5 is inside it. The /8 network address, 172.0.0.0, is not private, and reading the flag off the network address rather than off the address you typed is a common way to get this wrong.
Because it is ambiguous. `inet_aton` and several resolvers read a leading zero as octal, so 0177.0.0.1 becomes 127.0.0.1 rather than an error. Modern parsers refuse the form outright, and so does this one.
Shared address space from RFC 6598, used between a subscriber and a carrier-grade NAT. It is not RFC 1918 private space and it is not globally routable either, which is why it gets its own name here rather than being lumped in with 10.0.0.0/8.
Any of them. The counts are exact integers, so an IPv6 /1 reports 170,141,183,460,469,231,731,687,303,715,884,105,728 addresses rather than an approximation.
No. Classes A, B and C were replaced by CIDR in 1993 (RFC 1518 and RFC 1519) and nothing routes by class. It is shown because certification exams still ask for it, with that note attached.
This runs as client-side JavaScript. Keys, tokens, payloads, and other inputs never leave your device.