When I planned the network for a new office, I sized it on 2 to the n minus 2: the whole working floor went to /26, 6 host bits, 64 addresses, 62 usable hosts. The day it went live, the colleague in charge of the switch asked which address the gateway would take. I said the first one in the usable range, 192.168.1.65, and he replied that the link then carries only 61 devices. What really made me doubt that formula was another case: two routers joined by a point-to-point link whose segment had been set to 192.168.1.100/31. The same formula gives 2 to the 1 minus 2 equals 0, meaning no device fits at all, yet both ends took their addresses without complaint.
The arithmetic was never the problem; the formula only holds across part of the prefix range. Line 193 of the tool template computes usable hosts with three branches: usable = prefix <= 30 ? total - 2 : (prefix === 31 ? 2 : 1) — the minus 2 applies only while the prefix is at most 30, /31 returns 2 outright, /32 returns 1, and both are hardcoded exceptions.
The network address and the broadcast address each eat one
Take 192.168.1.100/26 apart and the whole chain shows itself. Line 190 fixes the size first, total = Math.pow(2, 32 - prefix): 32 minus 26 leaves 6 host bits, and 2 to the 6 is 64. Line 189 does not use a bitwise AND for the network address but Math.floor(ip / 2^(32 - prefix)) * 2^(32 - prefix): 3232235876 divided by 64, floored, then multiplied back, lands on 3232235840, which reads as 192.168.1.64. The broadcast address sits on line 191 as net + total - 1, which is 3232235903, and that reads as 192.168.1.127. Usable hosts go from 64 down by 2 to 62, and the usable range is 192.168.1.65 ~ 192.168.1.126.
The two subtracted addresses each have a job. The network address has every host bit at 0 and is the name the routing table uses for the whole block; the broadcast address has every host bit at 1, and anything sent to it must be handled by every host inside the block. The binary comparison panel makes this plainest: the /26 mask expands to 11111111.11111111.11111111.11000000, with 26 ones followed by 6 zeros, and two hosts are in the same subnet exactly when each one ANDed with that mask gives the same result.
Figure 1. Of the 64 slots, only the 62 in the middle can go to machines.
Past /30 the minus 2 stops holding
Push the prefix upward and the other branch only starts working past 30. Walking the prefixes one by one, all 33 of them run and not one throws an error: /0 through /30, 31 prefixes in all, follow 2 to the n minus 2, and only /31 and /32 step outside it. /31 plainly has 2 addresses and still allows 2; /32 has 1 left and still allows 1.
Back to that inter-router link. Type 192.168.1.100/31 and the measurement gives the network address as 192.168.1.100 and the broadcast address as 192.168.1.101, usable hosts 2, total addresses 2, and the two ends of the usable range are exactly those addresses, with mask 255.255.255.254 and wildcard 0.0.0.1, matching the RFC 3021 reading of a point-to-point link. The range no longer shrinks inward because the two prefix <= 30 tests on lines 194 and 195 take the other branch: the first usable address is net, the last one is bcast. /32 is more extreme still: the network address and the broadcast address are both 192.168.1.100, the ends of the range are the same address, and usable hosts is 1.
Figure 2. On /31 and /32 the green bar fills the outline completely.
Common prefixes side by side
| Prefix | Host bits | Total addresses | Usable hosts |
|---|---|---|---|
| /20 | 12 | 4,096 | 4,094 |
| /24 | 8 | 256 | 254 |
| /25 | 7 | 128 | 126 |
| /26 | 6 | 64 | 62 |
| /27 | 5 | 32 | 30 |
| /29 | 3 | 8 | 6 |
| /30 | 2 | 4 | 2 |
| /31 | 1 | 2 | 2 |
| /32 | 0 | 1 | 1 |
Those last two rows are the entire exception list: the 2 under /30 is what stays of 4 addresses once both ends are removed, while the 2 under /31 means both addresses are assignable.
Gateways, VLANs, and the prefix you did not type
The usable host cell never counts the gateway. Line 193 subtracts only those 2, the network address and the broadcast address; the template reserves no gateway and no DHCP pool, and none of the 9 result rows is a gateway field, so that 1 slot is yours to subtract yourself. Of the 62 usable slots the router takes the leading 192.168.1.65, and 61 cable ports are left. Cutting out a VLAN moves the whole block: the same 192.168.1.100 switches from /26 to /27, the network address slides from 192.168.1.64 to 192.168.1.96, and usable hosts drop from 62 to 30.
A bare IP with no prefix picks up /24 from line 126: 8.8.8.8 is treated as 8.8.8.0/24 and 10.0.5.130 as 10.0.5.0/24, both giving 254 usable addresses, and neither falls back to the natural mask 10.0.0.0/8 and 16,777,214. The error messages mind their own branches as well. 256.1.1.1/33 reports that the IPv4 prefix length cannot exceed 32, because an out-of-range prefix is checked before the address itself, while 192.168.1.100/100 gets the message that the prefix length should be a number from 0 to 32, for example /24.
Trust the address type row a little less: what line 208 hands to scopeOf is the input IP, not the computed network address, so for 192.168.1.100/8 the tool does work out the network address 192.0.0.0 while the label still reads Private address (192.168.0.0/16), and any range it does not cover falls back to Public address.
Every one of these boundary values was tried out one prefix at a time in the Subnet Calculator: it accepts both IP/prefix length and IP subnet mask, so 192.168.1.100/26 and 192.168.1.100 255.255.255.192 land on the same 192.168.1.64/26, and a single more character recalculates the whole table. To see how a bit count meets a mask, read how subnet masks and host counts line up; to check an octet against its decimal value on its own, run it through the Number Base Converter.
Q: How many machines fit in a /26?
The template says 62: 6 host bits, 64 addresses, 1 subtracted for the network address and 1 for the broadcast address. The gateway then claims another usable slot, so 61 cables are what is left.
Q: Does /31 really carry two devices?
On a point-to-point link it does. Measured usable hosts 2, and the range is 192.168.1.100 ~ 192.168.1.101 with nothing subtracted; /32 leaves 1, its network address and broadcast address both being 192.168.1.100.
Q: Can it list those 62 usable IPs, or cut a large block for me?
Neither. The usable host range is a single string, first ~ last, one input at a time with no batch entry point, and none of the 9 output rows says how many subnets a block can be split into, so the splitting stays a human decision.
Remembering the boundaries is enough: total - 2 holds only while the prefix is at most 30, /31 gives 2, /32 gives 1, and that 1 gateway slot always comes off the usable side separately. Before you size a budget, ask three questions: what the prefix is, whether the gateway sits inside the block, and how many devices need fixed addresses. The machine standing between 62 and 61 is lost exactly there.