What Is a Cron Expression (and How to Read One)

October 17, 2026 • NOFYI Editorial Team

If you have ever scheduled a backup, a report, or a cleanup task to run automatically, you have probably met a cron expression, even if you did not know its name. It is the short line of numbers and stars that tells a computer when to run a job. It looks cryptic at first glance, something like 0 9 * * 1-5. But once you learn that it is just five fields read from left to right, it becomes one of the most readable pieces of configuration you will meet.

This guide explains what a cron expression is, what each of its five fields means, and how to read one without guessing. You do not need a background in system administration. If you can read a clock and a calendar, you can read a cron expression.

What Is a Cron Expression?

A cron expression is a compact schedule written in a fixed format. It answers one question: when should this job run? Instead of writing out a sentence such as every weekday at nine in the morning, you write a short expression that a scheduler can parse. The scheduler, often a program called cron on Unix-like systems, checks the expression against the current time and runs the job when the time matches.

Cron expressions are used in many places. Server administrators use them to schedule backups and log rotation. Developers use them to run periodic tasks such as sending digests, cleaning up old data, or refreshing a cache. Cloud platforms and automation tools often accept cron-like schedules for the same purpose. The exact tool differs, but the five-field format described here is the classic form, and it is the one you are most likely to meet.

One thing to understand from the start is that a cron expression describes a repeating pattern, not a single date. It does not say run once on a specific day. It says run whenever the time matches this pattern. That is why a star, which means every value, appears so often. A pattern with stars in the day, month, and weekday fields repeats every day.

The Five Fields, Left to Right

A classic cron expression has five fields, separated by spaces, in this order:

Minute: 0 to 59
Hour: 0 to 23, using a 24-hour clock
Day of month: 1 to 31
Month: 1 to 12
Day of week: 0 to 6, where Sunday is usually 0

Read them in that order and the expression starts to make sense. The first field is the minute within the hour. The second is the hour of the day. The third is the day within the month. The fourth is the month of the year. The fifth is the day of the week. Every field must be present, and the order never changes, so once you memorise the sequence, minute, hour, day of month, month, weekday, you can decode any classic expression.

A helpful way to remember the order is that it goes from the smallest unit of time to the largest, with one twist. Minute and hour come first, then day of month and month, then day of week. The day-of-week field sits at the end because it is an alternative way of picking days, not a further narrowing of the month. That distinction matters, and it is explained below.

How to Read Each Field

Each field can contain a single number, a star, a list, a range, or a step value. A number means exactly that value. A star means every possible value for that field. A list, written with commas, means any of the listed values. A range, written with a dash, means every value from the first to the second. A step, written with a slash, means every nth value starting from a given point.

Here are the pieces in plain language. The star in the minute field means every minute. The value 0 in the minute field means at the top of the hour. The list 0,30 in the minute field means at the top of the hour and at half past. The range 1-5 in the weekday field means Monday through Friday. The step value */15 in the minute field means every fifteen minutes, at 0, 15, 30, and 45 minutes past the hour.

Two fields deserve extra attention because they are easy to mix up. The hour field uses a 24-hour clock, so 9 means nine in the morning and 21 means nine in the evening. Midnight is 0, not 24. The day-of-week field is also a common trap. In most cron implementations, Sunday is 0, Monday is 1, and Saturday is 6. Some systems also accept 7 for Sunday. If you are unsure which convention your scheduler uses, check its documentation before deploying a schedule that depends on Sunday.

Worked Example: 0 9 * * 1-5

Let us decode the example from the start of this guide, field by field.

The expression is: 0 9 * * 1-5.

The first field is 0, the minute. That means at minute zero, which is the top of the hour. The second field is 9, the hour. That means nine in the morning on a 24-hour clock. The third field is a star, the day of month, which means every day of the month. The fourth field is a star, the month, which means every month. The fifth field is 1-5, the day of week, which means Monday through Friday.

Put it together and the expression reads: at 9:00 in the morning, on every Monday, Tuesday, Wednesday, Thursday, and Friday, in every month. In short, weekdays at 9am. That is a natural schedule for a morning report, a daily stand-up reminder, or a job that prepares data before the working day starts.

Notice what the stars do in this example. The star in the day-of-month field does not cancel out the weekday restriction. The job runs on every day of the month that is also a weekday. A Saturday is a day of the month, but it is not in the weekday range, so the job does not run. The two day fields work together as a combined condition, not as separate schedules.

More Examples to Practise On

Reading a few more expressions will build your confidence. Try decoding each one before reading the explanation.

The expression 30 2 * * * means at 2:30 in the morning, every day. The minute is 30, the hour is 2, and every other field is a star, so there is no restriction on day, month, or weekday. This is a typical time for a nightly backup, when few people are using the system.

The expression 0 0 1 * * means at midnight on the first day of every month. The minute is 0, the hour is 0, the day of month is 1, and month and weekday are unrestricted. That pattern suits a monthly report or a monthly cleanup.

The expression 0 8 * * 0 means at 8:00 in the morning every Sunday. The weekday field is 0, which is Sunday, and the other fields restrict the time to eight in the morning. The day-of-month and month fields are stars, so the schedule applies to every Sunday of every month.

The expression */15 * * * * means every fifteen minutes, all day, every day. The minute field uses a step value, and every other field is a star. This is a common pattern for polling, health checks, and frequent small sync jobs, but it should be used with care, because a job that runs every fifteen minutes runs nearly a hundred times a day.

The expression 0 9-17 * * * means at the top of every hour from nine in the morning to five in the afternoon, every day. The hour field uses a range. This pattern fits a job that only needs to run during working hours.

No Seconds in Classic Cron

One of the most common mistakes beginners make is adding a sixth field for seconds. Classic cron expressions have no seconds field. The smallest unit is the minute. If you write 0 0 9 * * 1-5, thinking the first zero is seconds, the scheduler will either reject the expression or read it as something different from what you intended.

Some scheduling systems do use six or seven fields, with seconds at the front, and some add a year field at the end. These are extensions, not classic cron. If your tool’s documentation shows a seconds field, follow that tool’s format. But when you see a five-field expression, assume there are no seconds, and do not add any. Knowing which dialect you are working with is part of reading the expression correctly.

Common Mistakes to Avoid

The first mistake is mixing up the minute and hour fields. Writing 9 0 * * * when you meant nine in the morning gives you a job at twelve minutes past nine at night, because the first field is the minute and the second is the hour. Always check the order before saving.

The second mistake is assuming that the day-of-month and day-of-week fields narrow each other in the way you expect. In classic cron, when both fields are restricted, the job runs when either condition matches, not only when both match, in many implementations. For example, 0 9 1 * 1 could run on the first of the month and on Mondays, rather than only on Mondays that are also the first of the month. The behaviour depends on the implementation, which is one more reason to test.

The third mistake is forgetting time zones. A schedule that says 9am runs at 9am in the scheduler’s time zone, which may not be your time zone. Servers often run on UTC, so a job set for 9am UTC may run at a different local time. Check which time zone your scheduler uses, and confirm it with a test run.

The fourth mistake is scheduling heavy jobs at the same time as everyone else. Midnight and the top of the hour are popular choices, which means many systems run their jobs at exactly those moments. If your job can run a few minutes later, a slightly offset time such as 7 or 23 minutes past the hour can reduce contention and avoid slowdowns.

Test Before Deploying

Never deploy a cron schedule you have not tested. The cost of a mistake can be high: a job that runs every minute instead of once a day can flood inboxes, overload a server, or fill a disk. Testing is cheap insurance.

Start by reading the expression out loud in plain language, field by field, as in the worked example above. Then check it with a cron expression explainer or validator tool if one is available. These tools translate an expression into a sentence and show the next few run times, which makes errors much easier to spot.

Next, run the job in a safe environment first, or schedule it to run once in the near future and confirm that it behaves as expected. Check the logs to see when it actually ran. If the job sends email or changes data, point it at test recipients or test data during the trial. Only after the test run matches your expectation should you switch the schedule to its real target.

Finally, keep a note of what each scheduled job does and why. A schedule that is obvious today can look mysterious in six months. A short comment or a line in your documentation that says what the job is for, and why it runs at that time, will save future you a lot of puzzling.

Limitations

Cron is a simple scheduler, not a full workflow engine. It runs a job when the time matches, but it does not know whether the previous run finished, whether the job succeeded, or whether the system was down at the scheduled time. If a server is off at 9am, the 9am job may simply not run, and cron will not run it later to catch up. For jobs that must run exactly once, or that depend on each other, a more capable scheduler or queue system may be a better fit.

Cron expressions are also limited in what they can express. They describe regular repeating patterns, not one-off dates or complex rules such as the last Friday of the month or the third Tuesday after a holiday. If your schedule needs that kind of rule, you may need extra logic in the job itself, or a scheduler with richer features.

Finally, cron expressions vary between systems. The five-field format is standard, but details such as whether 7 means Sunday, how the two day fields interact, and whether extensions like seconds are supported can differ. Treat any expression as tied to the system that will run it, and check that system’s documentation.

Frequently Asked Questions

What does the star mean in a cron expression?

A star means every possible value for that field. A star in the minute field means every minute. A star in the month field means every month. An expression made entirely of stars, * * * * *, would run every minute.

What does 0 9 * * 1-5 mean?

It means weekdays at 9am. The minute is 0, the hour is 9, the day of month and month are unrestricted, and the weekday field is Monday through Friday. The job runs at nine in the morning on every weekday.

Why is there no seconds field?

Classic cron was designed with the minute as its smallest unit. The five fields are minute, hour, day of month, month, and weekday. Some other schedulers add seconds as an extension, but a classic five-field expression never includes them.

How do I check a cron expression before using it?

Read it field by field in plain language, then use a validator or explainer tool to confirm the next run times. Test the job in a safe environment with test data, check the logs to confirm when it ran, and only then deploy the real schedule.

Conclusion

A cron expression is simply five fields read left to right: minute, hour, day of month, month, and weekday. Once you know that order, plus the meaning of the star, lists, ranges, and steps, expressions like 0 9 * * 1-5 stop looking like code and start reading like a sentence: weekdays at 9am. Remember that classic cron has no seconds, watch out for time zones and the two day fields, and always test before deploying. With those habits, you can read any cron expression with confidence.