Introduction
An IPv4 address is not just four numbers separated by dots. It is a 32-bit unsigned integer, and that integer has a valid decimal, hexadecimal, octal, and binary representation — all of which resolve identically in network stacks and many web browsers. The address 192.168.1.1 and 0xC0A80101 and 3232235777 point to the same host. Security researchers use these alternate representations to bypass naive URL filters and WAF rules. This tool converts any IPv4 address into all four numeric forms instantly, in the browser.
What this tool does
- Converts a dotted-decimal IPv4 address (e.g., 192.168.1.1) to its 32-bit integer, hexadecimal, octal, and binary equivalents.
- Shows the DWORD (32-bit unsigned integer) representation used in Windows registry entries and some URL bypass techniques.
- Validates IPv4 input and rejects addresses with octets outside 0–255.
- All four output formats are copyable with a single click.
- Runs entirely client-side with no server requests.
How this tool works
The tool takes the four octets of the IPv4 address and assembles them into a single 32-bit integer using bit-shifting: result = (octet1 << 24) | (octet2 << 16) | (octet3 << 8) | octet4. This gives the DWORD value. From that integer, standard JavaScript toString() methods produce the hexadecimal (toString(16)), octal (toString(8)), and binary (toString(2)) representations. The hex output is prefixed with 0x and the octal with 0 to match the notation conventions used in C, Python, and most network tooling.
Validation checks that each octet parses as an integer in the range 0–255 using a standard IPv4 regex before any conversion is attempted. Invalid input produces an error rather than silently producing garbage output.
How IP address encoding works
IPv4 addressing is defined in RFC 791 (1981). The 32-bit address space was originally partitioned into Classes A, B, and C under the classful model before being superseded by CIDR (RFC 4632) in 1993. The dotted-decimal notation (e.g., 10.0.0.1) was introduced as a human-readable convenience; the underlying protocol always treats the address as a single 32-bit big-endian unsigned integer.
Operating system network stacks accept multiple notations for the same address. On Linux, macOS, and Windows, both 0.85em] font-mono">curl http://2130706433/ and curl http://127.0.0.1/ reach localhost — 2130706433 is the decimal DWORD for 127.0.0.1. The inet_aton() function in POSIX (documented in [IEEE Std 1003.1) explicitly supports four formats: dotted decimal, dotted hex, dotted octal, and full 32-bit integer.
This flexibility is studied in the context of URL filtering bypasses. OWASP's testing guide and numerous CVE reports describe bypasses where 0.85em] font-mono">http://0x7f000001/ or http://0177.0.0.1/ reach internal services behind firewalls that only blocked 127.0.0.1 as a string. Security researchers document these in [SSRF (Server-Side Request Forgery) attack taxonomy. Understanding alternate IP representations is part of any thorough SSRF mitigation review.
How to use this tool
- Enter a valid IPv4 address in dotted-decimal notation (e.g., 10.0.0.1 or 255.255.255.255) in the input field.
- Click 'Encode'. The decimal, hexadecimal, octal, binary, and DWORD representations appear below.
- Copy any representation using the copy icon next to each output.
- Use the hexadecimal or decimal forms when testing for SSRF filter bypasses or configuring network ACLs.
- For the reverse operation, take any 32-bit integer and split it into four bytes:
(n >> 24) & 0xFF,(n >> 16) & 0xFF,(n >> 8) & 0xFF,n & 0xFF.
Real-world examples
SSRF filter bypass testing
A penetration tester checks whether a web app's SSRF protection blocks only dotted-decimal 127.0.0.1 or all equivalent representations. They encode 127.0.0.1 here, getting decimal 2130706433, hex 0x7f000001, and octal 017700000001. They test each form in the target URL parameter. If the app fetches any of them, the SSRF filter is string-matching only and is bypassable. A robust fix uses inet_pton() to normalise the address to binary before comparing against blocked ranges.
Reading Windows registry IP entries
A Windows sysadmin reviews a legacy application's registry configuration and finds the IP binding stored as a DWORD value 0x0A00000A. They paste 10.0.0.10 (the known expected address) into this tool, get hex 0x0a00000a, and confirm the values match. DWORD storage of IP addresses is common in older Windows networking components and some database connection managers that predate Unicode registry values.
Teaching IPv4 subnetting with binary
A networking instructor uses the binary output to illustrate subnet masks. For 192.168.1.0 with a /24 mask (255.255.255.0), they encode both addresses to binary: 11000000.10101000.00000001.00000000 and 11111111.11111111.11111111.00000000. The AND of the two gives the network address. Seeing the 32-bit structure makes the bitwise operation concrete for students who have only memorised the decimal notation.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| Dotted decimal (192.168.1.1) | Standard notation, universally readable | Human-readable configuration, logs, documentation |
| Hexadecimal (0xC0A80101) | Compact, native to packet headers | Packet inspection, network programming, WAF bypass testing |
| Decimal DWORD (3232235777) | Single integer, platform-native | Windows registry, URL bypass vectors, database storage |
| Binary (32 bits) | Verbose, bit-level visibility | Subnetting education, bitwise ACL operations |
Limitations or considerations
This tool handles IPv4 only. IPv6 addresses are 128 bits and use a completely different notation (colon-separated hexadecimal groups defined in RFC 5952). JavaScript's 32-bit bitwise operators use signed integers internally; addresses above 2147483647 (128.0.0.0 and above) are handled correctly because the tool reads the intermediate number as unsigned before conversion, but developers should use BigInt for safety if implementing this in production code. The DWORD and decimal forms are identical for IPv4 — both are the unsigned 32-bit integer value of the address.
Frequently asked questions
Do browsers actually accept IP addresses in hex or decimal DWORD form?
Most do. Chromium-based browsers and Firefox accept http://2130706433 and redirect to http://127.0.0.1. Safari is more strict and may reject non-dotted-decimal forms. The behaviour depends on the URL parser; RFC 3986 does not mandate any specific IP notation, so parsers differ.
What is a DWORD IP address?
DWORD stands for 'double word' — a 32-bit unsigned integer. On 32-bit Windows systems, a DWORD was the native integer type. IPv4 addresses stored in the Windows registry are often saved as DWORD values. For example, 192.168.1.1 stored as DWORD is 3232235777 (big-endian) or 16885952 (little-endian, as Windows stores it internally). This tool produces the big-endian (network byte order) DWORD as used in URL bypass testing and POSIX functions.
Can I reverse a hex IP back to dotted decimal?
Yes. Take the hex value (e.g., 0.85em] font-mono">0xC0A80101), convert each byte pair: C0 = 192, A8 = 168, 01 = 1, 01 = 1 → 192.168.1.1. Or convert the entire 32-bit hex to decimal and use the [Decimal to Other Bases tool to verify.
Is this useful for IPv6?
Not directly. IPv6 has its own compressed notation rules (RFC 5952) and a 128-bit address space. The largest JavaScript integer without BigInt is 2^53-1, which cannot hold a 128-bit value accurately. A separate IPv6 tool with BigInt support would be needed.
Conclusion
An IPv4 address is a 32-bit integer. Dotted decimal is just the most readable form of it. Knowing the hex, octal, binary, and DWORD equivalents matters when reading packet captures, reviewing Windows registry configuration, testing SSRF filters, or teaching subnetting. This tool converts any dotted-decimal address to all four forms in one step. For working with individual bytes and binary data, see the Bitwise Calculator tool.