Netmask: 255.255.255.0 Wildcard: 0.0.0.255 Prefix: /24
About Wildcard Mask Calculator — Cisco ACL Subnet Mask
A wildcard mask is the bitwise inverse of a subnet mask: where a netmask has a 1, the wildcard has a 0, and vice versa. So `255.255.255.0` becomes `0.0.0.255`. Cisco access control lists (ACLs), OSPF network statements, and route maps all match addresses using wildcard masks rather than ordinary subnet masks, which makes converting between the two a constant chore for network engineers.
This free wildcard mask calculator converts a subnet mask to its inverse wildcard mask and back, and derives both from a CIDR prefix length such as `/24`. The math is a simple per-octet complement (`255 − octet`), and it runs entirely in your browser.
Nothing you type is uploaded — the conversion happens locally and works offline, so it's safe to use with internal addressing schemes.
Features
- Convert a subnet mask to its inverse wildcard mask (and back)
- Derive both a subnet mask and wildcard mask from a CIDR /prefix
- Validates octets and rejects non-contiguous masks
- Pure bitwise math, runs entirely offline in your browser
How to use
- Type a subnet mask (255.255.255.0), a wildcard mask (0.0.0.255), or a /prefix (/24) into the input.
- The tool detects which form you entered and computes the rest.
- Read the netmask, wildcard mask, and prefix length from the output.
- Copy the value you need into your ACL or configuration.
Frequently asked questions
What is a wildcard mask?
A wildcard mask is the bitwise inverse of a subnet mask. A 0 bit means "must match" and a 1 bit means "don't care." Cisco IOS uses wildcard masks in access lists and OSPF statements instead of subnet masks.
How do I convert a subnet mask to a wildcard mask?
Subtract each octet from 255. For 255.255.255.0 that gives 0.0.0.255. This tool does the per-octet complement for you and validates the result.
Is a wildcard mask the same as a subnet mask?
No — they are inverses. A subnet mask like 255.255.255.0 corresponds to the wildcard mask 0.0.0.255. They describe the same network but the bit meanings are flipped.
Why does the calculator reject some masks?
A standard subnet mask must be contiguous: a run of 1-bits followed by a run of 0-bits (like 255.255.240.0). Masks with gaps such as 255.0.255.0 have no valid prefix length, so they are rejected.
Does my data get sent anywhere?
No. The conversion is pure bitwise arithmetic performed locally in your browser. Your input never leaves your device, and the tool works offline.
Related tools
Everything runs locally in your browser — your input is never uploaded.