# Wildcard Mask Calculator

> A wildcard mask is the bitwise inverse of a subnet mask, and it is what Cisco IOS access lists and OSPF network statements take instead of a netmask. A /24 has a subnet mask of 255.255.255.0 and a wildcard mask of 0.0.0.255. Enter an address in CIDR notation and the wildcard mask comes back first.

Source: https://rankcert.com/tools/wildcard-mask-calculator
Free, no signup. Updated: 2026-09-08

## How to use it

1. Enter the network in CIDR notation, for example 10.0.0.0/16.
2. Read the wildcard mask at the top, with the subnet mask and range beneath it.
3. Paste the wildcard mask into your ACL or OSPF network statement.

## Common prefixes and their wildcard masks

Subtract each subnet mask octet from 255 and you have the wildcard mask. A 0 bit in a wildcard mask means the bit must match; a 1 bit means it is ignored.

| Prefix | Subnet mask | Wildcard mask | Addresses |
| --- | --- | --- | --- |
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 |

## Questions

### What is a wildcard mask?

The bitwise inverse of a subnet mask, used by Cisco IOS to say which address bits matter. A 0 means the bit must match exactly; a 1 means ignore it. It is the opposite convention to a subnet mask, which is why they are so easy to mix up.

### How do I convert a subnet mask to a wildcard mask?

Subtract each octet from 255. 255.255.255.0 becomes 0.0.0.255; 255.255.240.0 becomes 0.0.15.255. That is all there is to it.

### Where do I need a wildcard mask instead of a subnet mask?

Cisco IOS access control lists, OSPF and EIGRP network statements, and route maps. Interface addressing still takes a normal subnet mask, which is the source of most of the confusion.

### What does a wildcard mask of 0.0.0.0 mean?

Match this exact address and nothing else - the equivalent of a /32. In an ACL you can write it as the keyword host instead, and most style guides prefer that for readability.

### What does 255.255.255.255 mean as a wildcard mask?

Ignore every bit, so match any address at all. IOS lets you write this as the keyword any.

### Can a wildcard mask be non-contiguous?

Yes, and that is the one real capability a subnet mask lacks. A wildcard of 0.0.0.254 matches only even-numbered hosts. It is legal, occasionally useful, and worth a comment in the config because the next engineer will assume it is a typo.

### Why does Cisco use wildcard masks at all?

They came from the original ACL implementation, where inverting the mask made the bit test cheaper in hardware. The convention outlived the reason, and newer platforms such as NX-OS and ASA accept prefix lengths directly.

### Is a wildcard mask the same as an inverse mask?

Yes - inverse mask, wildcard mask and, in older Cisco documentation, don't-care bits all describe the same thing.

## Related tools

- [Regex Tester](https://rankcert.com/tools/regex-tester): Test a JavaScript regular expression against sample text, see every match with its position and capture groups, and get real errors for invalid patterns.
- [Base64 Encode / Decode](https://rankcert.com/tools/base64-encode-decode): Encode text to base64 or decode it back, with full UTF-8 support and automatic handling of base64url input. Runs entirely in your browser.
- [Diff Checker](https://rankcert.com/tools/diff-checker): Paste two versions of a text and see every added and removed line highlighted, computed in your browser with no upload.
- [CSV to JSON](https://rankcert.com/tools/csv-to-json): Turn a CSV into an array of JSON objects in your browser, with proper handling of quoted fields, embedded commas and custom delimiters.
- [JSON to CSV](https://rankcert.com/tools/json-to-csv): Convert a JSON array into a CSV you can open in Excel or Google Sheets, with headers taken from every key that appears.
- [Password Generator](https://rankcert.com/tools/password-generator): Generate strong random passwords in your browser using the Web Crypto API, with an entropy figure so you can see how strong they actually are.