Cron expression

A cron expression is a five-field syntax — minute hour day-of-month month day-of-week — used by the Unix cron daemon to schedule when a recurring job runs. It's a de facto standard (there's no single RFC; behavior follows the traditional Vixie cron implementation and its crontab(5) man page) shared by nearly every Unix-like scheduler, and imitated by tools far beyond the original daemon — CI pipelines, Kubernetes CronJobs, and cloud schedulers all accept the same five-field syntax.

How it works

Each field accepts a value, a range, a list, a step, or a wildcard:

• minute (0–59), hour (0–23), day-of-month (1–31), month (1–12), day-of-week (0–6, where both 0 and 7 mean Sunday)
• * — any value
• , — a list (1,15)
• - — a range (9-17)
• / — a step (*/15 = every 15 units)

A job runs only in the minute where all five fields match the current time simultaneously. When both day-of-month and day-of-week are restricted (not ), most cron implementations run the job if either* condition matches — a frequent source of confusion. Many modern schedulers also support non-standard shorthand like @daily or @hourly, which are convenience aliases, not part of the original five-field grammar.

Example:

30 2 * * 1-5    → 02:30, every weekday (Monday–Friday)
*/15 * * * *    → every 15 minutes
0 0 1 * *       → midnight on the 1st of every month

Common pitfalls

• The daemon runs jobs in the server's local time zone unless explicitly configured otherwise — a schedule that looks right in UTC can fire at the wrong hour after a daylight-saving shift.
• Combining a restricted day-of-month and day-of-week (e.g. 0 0 13 * 5) triggers on the OR of both, not the AND most people expect.
• There's no seconds field in standard cron — sub-minute scheduling requires a different tool (e.g. Quartz's 6–7 field format, which is a different dialect).
• Off-by-one confusion between 0 and 7 for Sunday is common when porting expressions between systems.

Related terms

• UTC — the time zone convention that avoids the daylight-saving ambiguity cron schedules are prone to.
• Unix timestamp — the absolute-time representation a scheduler resolves each cron field against internally.
• ISO 8601 — a more explicit alternative when logging exactly when a cron job actually fired.

See also

• Tool: Cron Explainer — decode any cron expression into plain English, validate each field, and preview upcoming run times.