How to Read and Write Cron Expressions: The Five Fields and Common Examples

The five fields

A standard Unix cron expression has five space-separated fields: minute (0–59), hour (0–23), day of month (1–31), month (1–12) and day of week (0–7, where both 0 and 7 are Sunday). The job runs whenever all the fields match.

For example, 0 2 * * * means minute 0, hour 2, every day, every month, any weekday—2:00 a.m. daily. An asterisk means 'every value'.

┌───── minute (0-59)
│ ┌─── hour (0-23)
│ │ ┌─ day of month (1-31)
│ │ │ ┌ month (1-12)
│ │ │ │ ┌ day of week (0-7, Sun=0 or 7)
│ │ │ │ │
0 2 * * *

Four special characters

Combining these four covers most schedules. Some systems also accept names such as MON and JAN.

• * (any): * in the hour field means every hour.
• , (list): 1,15 means the 1st and the 15th.
• - (range): 1-5 in the weekday field means Monday to Friday.
• / (step): */10 in the minute field means 0, 10, 20 … every ten minutes. You can also give a start, as in 5-59/15.

Common examples

After writing an expression, work out the next few run times to confirm it does what you intend. Remember that steps count from zero, not from when the job starts: */45 in the minute field runs at :00 and :45 each hour, not every 45 minutes.

*/5 * * * *      every 5 minutes
0 * * * *        every hour on the hour
30 9 * * 1-5     09:30 on weekdays
0 0 1 * *        midnight on the 1st of each month
0 18 * * 5       18:00 every Friday
0 3 * * 0        03:00 every Sunday
0 9,18 * * *     09:00 and 18:00 daily
0 0 1 1 *        midnight on 1 January

Common traps

The best-known trap involves setting both day-of-month and day-of-week. 0 0 13 * 5 looks like 'Friday the 13th', but in standard cron, when neither field is *, they combine with OR: the job runs on the 13th of every month and on every Friday.

The second is 'the last day of the month'. Standard five-field cron has no symbol for it; a common workaround is to run on days 28–31 and have the script check whether tomorrow is the 1st. Some schedulers such as Quartz support L, but they use a six- or seven-field format with seconds that is not compatible with standard cron.

Which time zone does cron use?

Cron follows the server's system time zone. Most cloud servers run in UTC, so a report meant for 9 a.m. in Korea can go out at 6 p.m. Korean time. 9 a.m. KST is midnight UTC, so on a UTC server you would write 0 0 * * *.

GitHub Actions and Kubernetes CronJobs also default to UTC. If a schedule is tied to a region with daylight saving time, expect the local run time to shift by an hour twice a year.

Operational tips

In the AIBIZAP cron generator you pick 'daily' or 'weekly' and the expression is built for you, so you get the schedule right without memorising the syntax.

• Spread heavy jobs across minutes such as :07 or :23 rather than all starting at :00.
• If a run might not finish before the next one starts, add a lock to prevent overlap.
• Cron's environment and PATH differ from your interactive shell, so use absolute paths in scripts.
• Log each run's output so failures never go unnoticed.