Wildcard Mask Converter
Convert subnet mask, wildcard and CIDR three ways, with the Cisco ACL context.
This wildcard mask converter turns a subnet mask, a wildcard mask or a CIDR into all three at once. Paste 255.255.255.0, 0.0.0.255 or /24 and it works out which one you gave it, then shows the other two plus the usable host count and the binary. It's the tool you want when you're writing a Cisco ACL or an OSPF network statement, because those take the wildcard (the inverse of the mask) and getting them backwards is a quiet, painful bug. Everything runs in your browser, and a one-click link hands the prefix straight to the subnet calculator when you need the full network math.
100% in your browser. Nothing you type ever leaves this page.
- Usable hosts
- 254
- Mask (hex)
- 0xFFFFFF00
- Wildcard (hex)
- 0x000000FF
- Mask (binary)
- 11111111.11111111.11111111.00000000
- Wildcard (binary)
- 00000000.00000000.00000000.11111111
How it reads in a config
Cisco ACL: access-list 10 permit 192.168.1.0 0.0.0.255
OSPF: network 192.168.1.0 0.0.0.255 area 0
Same boundary, described from the other side
A subnet mask and a wildcard mask are the same fact written two ways. The mask 255.255.255.0 says "the first 24 bits are the network". The wildcard 0.0.0.255 says "the first 24 bits must match, the last 8 are free". One uses 1 bits for the fixed part, the other uses 0 bits for it. Flip every bit of one and you get the other, which is exactly what this tool does, in whichever direction you paste.
The ACL gotcha worth remembering
Here is where people get burned. Cisco access lists and OSPF
network statements expect the wildcard, not the mask. Type
255.255.255.0 where a wildcard belongs and the device does not error, it
just matches a single host instead of the whole subnet, or nothing at all.
The rule of thumb: in an ACL or an OSPF area statement, you want the form
with the zeros on the left. Paste your mask here, copy the wildcard, done.
When a conversion is not enough
This tool answers one question fast: what is the wildcard, mask and CIDR for this boundary. When you need the rest, the network and broadcast address, the usable range, splitting a block into subnets, hit open in subnet calculator and the prefix carries straight over. The two are meant to be used together.
Frequently asked questions
What is a wildcard mask?
A wildcard mask is the bit-for-bit inverse of a subnet mask. Where a subnet mask uses 1 bits to fix the network part, a wildcard uses 0 for "must match" and 1 for "anything goes". So 255.255.255.0 becomes 0.0.0.255. Same boundary, described from the opposite side.
Where do wildcard masks actually show up?
Mostly Cisco IOS. Access control lists and OSPF network statements take a wildcard, not a subnet mask: "access-list 10 permit 192.168.1.0 0.0.0.255" matches the whole /24. Swap the mask and the wildcard by accident and the ACL quietly matches the wrong range, which is a classic late-night bug.
Can a wildcard mask be non-contiguous?
Yes, and that is the real difference from a subnet mask. A wildcard can put 1 bits anywhere, so you can match only odd subnets or a single octet. This converter handles the standard contiguous case that maps to a CIDR; if you are crafting discontiguous bits, you are working at the bit level anyway.
How does this relate to CIDR and the subnet calculator?
All three say the same thing: /24 is mask 255.255.255.0 is wildcard 0.0.0.255. Type any one here and you get the other two plus the host count. For full network math (ranges, broadcast, splitting), send it to the subnet calculator with one click.
Does it run offline?
Yes. It is plain JavaScript in your page, nothing is sent anywhere, and once the page has loaded it keeps working with no network.