Cron Expressions Explained: A Beginner's Guide with Examples

Cron is the half-century-old syntax that still schedules almost everything — Linux crontab, GitHub Actions, Kubernetes CronJob, AWS EventBridge. It looks cryptic until you learn the one pattern underneath, and then you can read any schedule at a glance.

Build and verify any expression with the Cron Builder, and browse ready-made ones on Cron Examples.

The five fields

A cron expression is five fields separated by spaces:

minute  hour  day-of-month  month  day-of-week
  *       *         *          *        *

Field	Allowed values
Minute	0–59
Hour	0–23
Day of month	1–31
Month	1–12 (or JAN–DEC)
Day of week	0–6 (0 or 7 = Sunday; or SUN–SAT)

An asterisk means "every." So * * * * * runs every minute of every day.

The special characters

• * — every value in the field's range.
• , — a list: 0,15,30,45 means those exact minutes.
• - — a range: 9-17 means 9am through 5pm.
• / — steps: */15 means every 15th (0, 15, 30, 45); 0 */2 * * * means every 2 hours on the hour.
• L — last (some schedulers): 0 0 L * * = last day of the month.

Everyday schedules

0 * * * *        # every hour, on the hour
0 2 * * *        # every day at 2:00 AM  (nightly backup)
0 9 * * 1-5      # weekdays at 9:00 AM   (Mon–Fri)
*/15 * * * *     # every 15 minutes
0 0 1 * *        # 1st of every month at midnight
0 0 * * 0        # every Sunday at midnight  (weekly)

Read them left to right: "at minute 0, of hour 2, of every day-of-month, of every month, on every day-of-week" = daily at 2 AM.

The two traps

1. Day-of-month vs day-of-week. When you set both to specific values, cron (in most implementations) treats it as OR, not AND. 0 0 13 * 5 means "midnight on the 13th OR on Friday," not "midnight on Friday the 13th." To get the AND behavior you usually need a wrapper script. Leave one of the two as * unless you understand how your scheduler combines them.

2. Time zones. Cron runs in the server's local time (or the timezone your platform forces, like UTC for GitHub Actions and AWS EventBridge). A "2 AM daily" job means different wall-clock times in different regions; set the timezone explicitly where the platform allows it.

The 6th field and friendly aliases

Some systems add a leading seconds field (6-field cron) or a trailing year field. Many platforms also accept English aliases:

• @daily / @midnight = 0 0 * * *
• @hourly = 0 * * * *
• @weekly = 0 0 * * 0
• @monthly = 0 0 1 * *

These are conveniences layered on top; the underlying engine is still the five-field expression.

A safe habit

Hand-writing cron is where "every Friday at noon" quietly becomes "every day at noon." Always run the expression through the Cron Builder to see the next few fire times in plain English before you paste it into a scheduler, and keep a library of tested schedules on Cron Examples to copy from.