What the number after the slash means
An IPv4 address is 32 bits long. The CIDR prefix length says how many of those bits are fixed (the "network" portion) versus free to vary (the "host" portion) within that block. /24 fixes the first 24 bits, leaving 8 free — that's exactly one full octet, which is why /24 blocks are so common and intuitive: they correspond neatly to "the first three numbers stay the same, the last number varies," e.g. everything from 192.168.1.0 to 192.168.1.255.
Why smaller prefixes mean bigger blocks (and vice versa)
This is the part that trips people up: a smaller prefix number means more host bits are free, which means a larger address block. /16 (16 network bits, 16 host bits) covers 65,536 addresses; /24 (24 network bits, 8 host bits) covers 256 addresses; /30 (30 network bits, 2 host bits) covers only 4 addresses. Going from /24 to /23 doesn't add a little more room — it doubles the block size, because you've freed up one more bit, and each additional host bit doubles the address count.
A worked comparison across common prefix sizes
/24 gives 256 total addresses (254 usable, after reserving the network and broadcast addresses). /26 gives 64 total addresses (62 usable) — a quarter of a /24, since it fixes 2 more bits (2² = 4× smaller). /30 gives 4 total addresses (2 usable) — commonly used for point-to-point links between two routers, where exactly 2 usable addresses is all that's ever needed and allocating a full /24 for a 2-device link would waste 252 addresses.
Why organizations subnet into smaller blocks at all
Subnetting into smaller CIDR blocks (rather than using one huge flat network) lets network administrators size each network segment to its actual device count, isolate broadcast traffic between segments, and apply different security or routing policies per segment. A single /16 for an entire organization would work technically, but a router-to-router link, an office floor with 40 devices, and a data center with thousands of servers have very different address-count needs — CIDR lets each get an appropriately sized block instead of one size fitting (and wasting space for) all of them.
CIDR notation is also used for allocating whole networks, not just subnetting
The same notation describes both a single organization's internal subnetting scheme and how the internet's regional registries allocate address blocks to ISPs and large organizations — a company might be allocated a /20 by its ISP, then subnet that /20 into many smaller /26 or /27 blocks internally for different departments or sites. The arithmetic is identical at every scale; only the size of the block being divided changes.