Cron Expression Explainer

What is a Cron Expression?

A cron expression is a compact string that describes a recurring schedule. Originally used in Unix-like operating systems to automate tasks via the cron daemon, cron expressions are now used everywhere — from CI/CD pipelines and cloud functions to Kubernetes jobs and monitoring systems.

A standard cron expression has five fields separated by spaces: minute, hour, day of month, month, and day of week. Some systems add a sixth seconds field at the beginning. Each field accepts specific values, wildcards, ranges, and intervals.

Cron Syntax Reference

Field	Allowed Values	Special Characters
Minute	0–59	* , - /
Hour	0–23	* , - /
Day of Month	1–31	* , - /
Month	1–12 or JAN–DEC	* , - /
Day of Week	0–7 or SUN–SAT (0 and 7 = Sunday)	* , - /

Special Characters

• * — matches every possible value ("any")
• , — list separator: 1,3,5 means values 1, 3, and 5
• - — range: 1-5 means values 1 through 5
• / — step: */5 means every 5th value; 10-30/5 means every 5th value from 10 to 30

How to Read a Cron Expression

Read a cron expression from left to right, one field at a time:

1. Minute — what minute of the hour does it run?
2. Hour — what hour of the day?
3. Day of Month — which day(s) of the month?
4. Month — which month(s)?
5. Day of Week — which day(s) of the week?

For example, 30 9 * * 1-5 reads as: "At minute 30, at 9 AM, every day of month, every month, Monday through Friday" — or simply "weekdays at 9:30 AM".

Common Cron Expression Examples

• * * * * * — every minute
• 0 * * * * — at the start of every hour
• 0 0 * * * — every day at midnight
• 0 9 * * 1-5 — weekdays at 9:00 AM
• */5 * * * * — every 5 minutes
• */15 * * * * — every 15 minutes
• 0 0 * * 0 — every Sunday at midnight
• 0 0 1 * * — first day of every month at midnight
• 0 0 1 1 * — every January 1st at midnight (yearly)
• 0 */6 * * * — every 6 hours
• 0 8,17 * * 1-5 — weekdays at 8 AM and 5 PM

What's the Difference Between 5-Field and 6-Field Cron?

The standard cron format has 5 fields: minute, hour, day of month, month, day of week. This is what you'll find in Linux crontab, GitHub Actions, and most scheduling tools.

Some systems (Spring, Quartz, and certain cloud platforms) use a 6-field format that adds a seconds field at the beginning: seconds, minute, hour, day of month, month, day of week.

This tool auto-detects which format you're using based on the number of fields. If your expression has 6 space-separated parts, it's treated as a 6-field expression with seconds.

GitHub Actions Cron Examples

GitHub Actions uses standard 5-field cron syntax in the schedule trigger. Scheduled workflows run in UTC and cannot be configured for other timezones. The minimum supported interval is every 5 minutes; more frequent schedules are silently throttled. Note that GitHub may delay scheduled runs during periods of high load on GitHub infrastructure — your workflow is not guaranteed to start at the exact scheduled time.

Basic GitHub Actions schedule syntax:

on:
  schedule:
    - cron: '0 9 * * 1-5'

Common GitHub Actions cron schedules:

• 0 0 * * * — Nightly build at midnight UTC
• 0 10 * * 1 — Weekly release every Monday at 10:00 AM UTC
• 0 * * * * — Hourly check (e.g., dependency scanning, status monitoring)
• 0 9 1 * * — Monthly report on the 1st of each month at 9:00 AM UTC

Kubernetes CronJob Examples

Kubernetes CronJobs use the standard 5-field cron format to schedule recurring workloads in a cluster. Starting with Kubernetes v1.27, you can specify a timezone via .spec.timeZone. Be aware of the concurrencyPolicy setting — if a job runs longer than the interval between runs, the next execution may be skipped or run concurrently depending on your configuration.

Basic Kubernetes CronJob manifest:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: daily-backup
spec:
  schedule: "0 2 * * *"

Common Kubernetes CronJob use cases:

• Database backup: 0 2 * * * — Run a full database dump every night at 2 AM.
• Log rotation: 0 0 * * 0 — Compress and archive old logs every Sunday at midnight.
• Health check: */10 * * * * — Run a diagnostic pod every 10 minutes to verify cluster services are responding.

Linux Crontab Quick Reference

On Linux systems, the cron daemon reads schedule definitions from crontab files. Each user can have their own crontab, editable with crontab -e. The system-wide crontab lives at /etc/crontab and includes a username field between the schedule and the command. Per-user crontabs are stored in /var/spool/cron/ (Red Hat / CentOS) or /var/spool/cron/crontabs/ (Debian / Ubuntu).

Environment variables can be set at the top of a crontab file before any schedule lines. The most useful are PATH (to ensure commands are found) and MAILTO (to control where cron sends output emails). Set MAILTO="" to suppress email entirely. By default, any output from a cron job is mailed to the crontab owner, so redirect output with > /dev/null 2>&1 if you do not need it. To redirect output to a log file instead, use >> /var/log/myjob.log 2>&1.

To check whether your cron jobs are running, look at the system log: grep CRON /var/log/syslog on Debian/Ubuntu or grep CRON /var/log/cron on Red Hat/CentOS. This will show timestamps and the command that was executed. If a job is not appearing in the logs, verify that the cron daemon is running (systemctl status cron) and that your crontab syntax is valid.

Quartz / Spring 6-Field Cron

Quartz Scheduler and Spring's @Scheduled annotation use a 6-field cron format that adds a seconds field at the beginning: seconds minute hour day-of-month month day-of-week. For example, 0 0 9 * * MON-FRI means "every weekday at 9:00:00 AM" — the leading 0 is the seconds field.

The ToolRack Cron Explainer uses standard 5-field cron (no seconds field), which is the format used by Linux crontab, GitHub Actions, Kubernetes, and most scheduling systems. If you are working with Quartz or Spring, remember to add the seconds field when transferring an expression from this tool to your application configuration. Quartz also supports special characters not found in standard cron, including L (last), W (nearest weekday), and # (nth occurrence of a day in a month).

For Quartz-specific syntax, consult the Quartz documentation.