Cron Syntax Explained, Field by Field

A standard cron schedule is five space-separated fields, minute hour day-of-month month day-of-week, and each field accepts a single value, a star for every value, a range, a list, or a step, which together express almost any recurring schedule. Cron looks cryptic only until you read it one field at a time. This article explains each field, every operator you can put in it, the notorious day-of-month versus day-of-week gotcha, and a set of common schedules you can reuse.

What are the five fields of a cron expression?

A classic cron line has five time fields followed by the command to run, and the fields always appear in the same order. Reading left to right:

So the expression 30 2 * * * reads as “at minute 30 of hour 2, every day”, meaning 2:30 in the morning daily. The command that follows the five fields is what actually runs; the fields only decide when. Note that many systems accept three-letter names for months and weekdays, and that in the day-of-week field both 0 and, on some implementations, 7 mean Sunday. A cron builder that translates an expression into plain English as you type is the fastest way to confirm you have the fields in the right order.

What does the asterisk mean?

An asterisk means “every value this field can take”, placing no restriction on that field. In the hour field it means every hour; in the day-of-month field it means every day. The famous * * * * * is five asterisks, one per field, so it matches every minute of every hour of every day, which schedules a job to run once a minute. The asterisk is the starting point for most expressions: you begin with all stars, then replace the fields you want to constrain. For example, to run at the top of every hour you constrain only the minute field to 0 and leave the rest as stars: 0 * * * *.

How do ranges work?

A range uses a hyphen to match every value between two endpoints inclusive. In the hour field, 9-17 means every hour from 9 through 17, so 0 9-17 * * * runs at the top of each hour from 9:00 to 17:00. Ranges work in any field: 1-5 in the day-of-week field means Monday through Friday, and 0 8 * * 1-5 runs at 8:00 on weekdays only. Ranges are inclusive of both endpoints, so 9-17 is nine distinct hours, not eight.

How do steps work?

A step uses a slash to run at regular intervals within a field, written as */n or range/n. The value after the slash is the interval. In the minute field, */15 means every fifteenth minute, matching 0, 15, 30, and 45, so */15 * * * * runs four times an hour. A step can also apply to a range rather than the whole field: 0-30/10 in the minute field matches 0, 10, 20, and 30 only, stopping at the end of the range. In the hour field, */6 matches 0, 6, 12, and 18, running every six hours. Steps are how you express “every n units” without listing each value.

How do lists work?

A list uses commas to match several specific values in one field. In the minute field, 0,30 matches minute 0 and minute 30, so 0,30 * * * * runs on the hour and the half hour. Lists combine with the other operators: in the day-of-week field 1,3,5 means Monday, Wednesday, and Friday, and you can even mix a range into a list, as in 0,15-20,45. Lists are the right tool when the values you want are not evenly spaced, since a step only produces evenly spaced values.

What is the day-of-month and day-of-week gotcha?

When you restrict both the day-of-month field and the day-of-week field, most cron implementations combine them with OR, not AND, so the job runs whenever either field matches. This is the single most common cron mistake. Consider 0 0 13 * 5. You might read it as “midnight on Friday the 13th”, expecting both conditions to be required. In practice cron runs it at midnight on the 13th of every month and also at midnight every Friday, because either match triggers the job. The AND-style reading only holds when at least one of the two fields is a star. So 0 0 13 * * genuinely means “the 13th of every month” and 0 0 * * 5 genuinely means “every Friday”, but combining specific values in both day fields broadens the schedule rather than narrowing it. If you truly need the intersection, such as only Friday the 13th, cron alone cannot express it cleanly; the usual workaround is to schedule on the day of month and add a check inside the command for the weekday.

What are some common cron schedules?

Most real schedules are variations on a handful of patterns. This table collects the ones you will reuse constantly:

Read each one field by field and it decodes cleanly. Take 0 9 * * 1-5: minute 0, hour 9, any day of month, any month, days of week Monday through Friday, which is 9:00 AM on weekdays. Because only one of the two day fields is restricted here, the OR gotcha does not apply and the schedule means exactly what it looks like.

How do you build and check a cron expression?

Build cron expressions in a tool that runs in your browser and shows a plain-English translation and the next run times, so you catch mistakes before they reach a live server. The operators are simple individually, but the day-field gotcha and off-by-one errors on ranges make it easy to write an expression that looks right and fires at the wrong time. A client-side cron builder lets you assemble each field, see the resulting schedule described in words, and confirm the upcoming run dates without pasting anything about your infrastructure into a remote service. Since cron lines often accompany commands that reference internal paths, hostnames, and scripts, keeping that work local avoids leaking details about your systems while you get the timing exactly right.

Cron is far less arcane than it first appears. Learn the five fields and their order, memorise the five operators, star, range, step, list, and single value, and stay alert to the day-of-month versus day-of-week OR behaviour, and you can read or write any standard schedule with confidence.