What a wildcard mask actually does
A subnet mask and a wildcard mask describe the same boundary from opposite directions. In a subnet mask, a 1 bit means "this bit is part of the network and must match," while a 0 bit means "this bit can vary." A wildcard mask flips that: a 0 bit means "must match" and a 1 bit means "don't care." They're bitwise complements of each other — which is why converting between them is as simple as subtracting each octet from 255.
For example, 255.255.255.0 (a standard /24 subnet mask) becomes 0.0.0.255 as a wildcard mask. The first three octets must match exactly; the last octet can be anything.
Where wildcard masks are actually used
You'll mostly run into wildcard masks in two places: Cisco IOS access control lists (access-list 10 permit 10.0.0.0 0.0.0.255) and OSPF network statements. Unlike a subnet mask, a wildcard mask's bits don't have to be contiguous — which means a single ACL line can, in theory, match a non-contiguous set of addresses. In practice, most wildcard masks you'll write are still just inverted subnet masks, which is exactly what this tool converts.
Frequently asked questions
What is a wildcard mask?
The bitwise inverse of a subnet mask, used mainly in Cisco ACLs and OSPF network statements. A 0 bit means "must match," a 1 bit means "ignore this bit."
How do you convert a subnet mask to a wildcard mask?
Subtract each octet from 255. 255.255.255.0 becomes 0.0.0.255.
Why do Cisco ACLs use wildcard masks instead of subnet masks?
Wildcard masks predate CIDR notation in Cisco IOS, and because they don't have to be contiguous, they give ACLs more flexibility than a plain subnet mask would.