Make a random unique local /48 prefix (fd00::/8) for your network, as RFC 4193 asks, and see the /64 for each VLAN. Everything runs in your browser. Nothing is sent to a server.
Your site prefix
Generate once, write it down, and keep using it. The point of a ULA is that it never changes.
| VLAN | Subnet (/64) | Router ::1 | Server ::10 |
|---|
A ULA has 128 bits, like every IPv6 address: fd (8 bits), a random Global ID (40 bits),
a Subnet ID (16 bits) and an Interface ID (64 bits). The first three parts make your /48.
The 16-bit Subnet ID gives you 65,536 /64 networks, one per VLAN or LAN.
This tool takes the 40 bits from crypto.getRandomValues, the browser's secure random number generator.
RFC 4193 also describes a method based on a timestamp and a
MAC address and a hash. Both give you a random-looking Global ID, which is what matters.
::10 or ::53, and put those ULA addresses into internal DNS and firewall rules.Not sure you need a ULA at all? Read ULA vs GUA: which IPv6 addresses to use inside your network. It covers changing ISP prefixes, single /64s, and why many devices still prefer IPv4 over ULA. To split the /48 in other ways, use the IPv6 subnet calculator.
A ULA (unique local address) prefix is a private IPv6 /48 from fd00::/8. It is not routed on the internet, so you can use it for internal addresses that never change. It is made of fd, a 40-bit random Global ID, and then 16 bits you use for your subnets.
RFC 4193 says the 40-bit Global ID must be random and must not use well-known numbers. If two networks both pick an easy prefix like fd00::/48, their addresses clash the day they are joined by a VPN or a merger, just like two 192.168.1.0/24 networks.
No one hands out or registers ULA prefixes, so it is not guaranteed unique. But with 40 random bits the chance of a clash is tiny: RFC 4193 puts it at about 4.5 in 100 billion for 10 connected sites.
This tool writes the VLAN number as the 4th group of the address, so VLAN 10 becomes fdxx:xxxx:xxxx:10::/64 and VLAN 4094 becomes fdxx:xxxx:xxxx:4094::/64. The digits are read as hex, which keeps them easy to recognise. Every VLAN from 0 to 4094 fits.
Usually your ISP's global (GUA) prefix plus a firewall. Add ULA when your ISP prefix changes, for VPNs and management networks, or for networks that must never reach the internet. The ULA vs GUA guide on this site explains each case with worked examples.
Everything you need for IPv6 addressing — free, client-side, no signup.
Free tools for network engineers — no signup, no rate-limit walls.