BYTETOOLS

Wildcard Mask Calculator

Convert a subnet mask or CIDR prefix to a Cisco wildcard mask and back, with a ready-to-paste ACL line and binary view. Free, private, in-browser.

Wildcard mask result

Subnet mask
255.255.255.192
Wildcard mask
0.0.0.63
CIDR prefix
/26
Mask (binary)
11111111.11111111.11111111.11000000
Wildcard (binary)
00000000.00000000.00000000.00111111
Addresses matched
64

In a wildcard mask, 0 bits mean "must match exactly" and 1bits mean "don't care" — the exact opposite of a subnet mask.

Ready-to-paste Cisco ACL line

access-list 10 permit ip 192.168.1.0 0.0.0.63

What is the Wildcard Mask Calculator?

The Wildcard Mask Calculator converts a subnet mask or CIDR prefix into the wildcard (inverse) mask used by Cisco ACLs, OSPF and EIGRP statements — and converts wildcards back the other way.

  • Two-way conversion: mask or prefix ↔ wildcard mask
  • Binary view showing exactly which bits are matched vs ignored
  • Ready-to-paste Cisco access-list line with the network auto-aligned
  • Explains non-standard wildcards instead of guessing a mask
  • Shows how many addresses the wildcard matches
  • 100% client-side bit arithmetic — works offline

How to use the Wildcard Mask Calculator

  1. 1

    Choose whether you are entering a subnet mask/prefix or an existing wildcard mask.

  2. 2

    Type the value — 255.255.255.192, /26 or 0.0.0.63 all work.

  3. 3

    Optionally enter the network address for the generated ACL line.

  4. 4

    Copy the wildcard mask or the complete access-list statement.

About the Wildcard Mask Calculator

The Wildcard Mask Calculator converts a subnet mask or CIDR prefix into the wildcard (inverse) mask used by Cisco ACLs, OSPF and EIGRP statements — and converts wildcards back the other way. Enter 255.255.255.192 or /26 and get 0.0.0.63 immediately, with both shown in binary so you can see exactly which bits are "don't care".

Give it an optional network address and it also builds a ready-to-paste access-list line, with the network properly zeroed to the mask boundary so the rule means what you intended. That removes the classic off-by-one errors that creep in when inverting masks by hand at 2 a.m.

Like every ByteTools utility, it is pure bit math running locally in your browser — nothing you enter is transmitted, and the tool works offline.

Frequently asked questions

What is a wildcard mask?

A wildcard mask is the bitwise inverse of a subnet mask, used by Cisco ACLs and routing protocol statements. A 0 bit means "this bit must match exactly" and a 1 bit means "don't care". The wildcard for a /26 subnet is 0.0.0.63.

How do I calculate a wildcard mask from a subnet mask?

Subtract each octet from 255, which is the same as flipping every bit. 255.255.255.192 becomes 0.0.0.63, and 255.255.0.0 becomes 0.0.255.255. This calculator does the inversion and shows the binary so you can verify it.

Why do Cisco ACLs use wildcard masks instead of subnet masks?

Historically ACLs were designed to match arbitrary bit patterns, not just network prefixes — a wildcard can legally have non-contiguous 1s to match, say, every odd subnet. Marking the ignored bits directly made that generality possible, and the convention stuck.

What does 0.0.0.255 mean in an access list?

It matches any address whose first three octets equal the configured network — i.e. a whole /24. "permit ip 192.168.1.0 0.0.0.255" matches 192.168.1.0 through 192.168.1.255.

Can a wildcard mask have non-contiguous bits?

In Cisco ACLs, yes — it is legal and occasionally used for clever matching. But such a wildcard has no single subnet-mask equivalent, so when you enter one this tool explains that rather than inventing a wrong prefix.

Related tools