Free CIDR & Port API - Keyless JSON, no limits

Endpoints

Every endpoint is a plain static JSON file. Fetch it, cache it, ship it. Because it is served statically, there is nothing to throttle.

Endpoint	Returns
/api/index.json	API index with version and the full endpoint list.
/api/cidr.json	All 33 CIDR prefixes with mask, wildcard, and host counts.
/api/cidr/{n}.json	One prefix (0 to 32): its mask, wildcard, total and usable hosts.
/api/ports.json	The port reference: 153 ports with number, service, protocol, category, a security flag, and a flag for whether the port is one people commonly look up.
/api/reserved.json	Reserved and special-purpose address blocks, 16 for IPv4 and 14 for IPv6, each with the RFC that defines it.
/api/openapi.json	OpenAPI 3.1 description of every endpoint above, with the full field schema for each response.

Example: look up a prefix

fetch("https://subnetkit.dev/api/cidr/24.json")
  .then((r) => r.json())
  .then((data) => {
    // { prefix: 24, mask: "255.255.255.0", usableHosts: 254, ... }
    console.log(data.mask, data.usableHosts);
  });

From the terminal

curl -s https://subnetkit.dev/api/cidr/24.json | jq
curl -s https://subnetkit.dev/api/ports.json | jq '.ports[] | select(.port == 443)'
curl -s https://subnetkit.dev/api/reserved.json | jq '.ipv4.blocks[] | .cidr'

Real responses

Both blocks below are generated from the live files at build time, so what you read here is what the endpoint returns. Version 1.1.0.

/api/cidr/24.json, in full

{
  "updated": "2026-08-05",
  "prefix": 24,
  "mask": "255.255.255.0",
  "wildcard": "0.0.0.255",
  "totalHosts": 256,
  "usableHosts": 254,
  "role": "Standard LAN size"
}

/api/ports.json, first two entries

{
  "dataUpdated": "2026-08-05",
  "sourceVerified": "2026-07-26",
  "count": 153,
  "ports": [
    {
      "port": 7,
      "name": "Echo",
      "protocol": "TCP/UDP",
      "service": "Echo Protocol",
      "category": "Legacy protocols",
      "description": "Port 7 is the Echo Protocol, which simply sends back whatever data it receives. It was designed for testing round-trip network connectivity and is rarely enabled today because it can be abused for denial-of-service amplification.",
      "secure": false,
      "official": true,
      "common": false
    },
    {
      "port": 9,
      "name": "Discard",
      "protocol": "TCP/UDP",
      "service": "Discard Protocol",
      "category": "Legacy protocols",
      "description": "Port 9 is the Discard Protocol, a service that silently drops any data sent to it. Like other early diagnostic protocols, it was useful for testing but offers no value on a modern network and should stay closed.",
      "secure": false,
      "official": true,
      "common": false
    }
  ]
}

Field reference

The full schema, with a type and a meaning for every field, lives in the OpenAPI 3.1 document. The fields you are most likely to reach for:

Field	Type	Meaning
prefix	integer	Prefix length in bits, 0 to 32.
mask	string	Subnet mask in dotted-quad form.
wildcard	string	The bitwise complement of the mask, as used in access lists.
totalHosts	integer	Addresses in the block, which is 2 to the power of (32 minus prefix).
usableHosts	integer	Assignable addresses: total minus two, except a /31 which is 2 under RFC 3021 and a /32 which is 1.
protocol	string	One of TCP, UDP or TCP/UDP: the transport the port carries in practice, which is not always what IANA registers.
secure	boolean	True when traffic on the port is encrypted by default, not when it can optionally be encrypted.
common	boolean	True for the hand-picked set of ports people actually look up, so you can filter out the legacy entries.
dataUpdated	date	When an entry in the dataset last changed.
sourceVerified	date	When the list was last checked against the IANA registry. A different event from dataUpdated, so it is a different field.

Licence and attribution

The data is published under CC BY 4.0, commercial use included. The one condition is attribution: keep a visible link to subnetkit.dev wherever you show the data. This is the snippet to paste.

<a href="https://subnetkit.dev">Network data by SubnetKit</a>

Changes to the dataset are logged on the changelog, so you can tell whether a value you cached is still current.

Using it in your own tool

The CIDR endpoint is handy for build-time address planning, and the ports endpoint pairs well with a firewall or scanning script. If you just want to show a calculator on your page without any code, the embeddable widget does it in one line.

Frequently asked questions

Is there a rate limit on the API?

No. Every endpoint is a static JSON file on a CDN, so you can fetch it as often as you like. Caching it on your side is still polite and fast.

Do I need an API key?

No key, no sign up, no auth. The endpoints are plain public files. Fetch them from a browser, a script, or a build step.

Can I use the API in a commercial project?

Yes, commercial use included. The data is published under CC BY 4.0, and the one condition is attribution: a visible link to subnetkit.dev wherever the data is shown.

How current is the port data?

The list holds 153 curated ports. An entry last changed on 2026-08-05, and the list was last checked against the IANA registry on 2026-07-26. Both dates are in every response as dataUpdated and sourceVerified.

Why does the port list have 153 entries and not all 65,535?

Because the value is in the curation, not the volume. The IANA registry is far larger and far rawer. This list covers the ports people actually look up, each with a category, a plain-English explanation, and a flag for whether it is encrypted by default. How entries are selected is written up on the about page.

Is there an OpenAPI specification?

Yes, at /api/openapi.json, written against OpenAPI 3.1. It documents every endpoint and the full field schema for each response, so you can generate a client or validate against it.