Cron Syntax Cheat Sheet: The 5 Fields, Fast
August 6, 2026
Cron Syntax in Ten Seconds
Cron syntax is five space-separated fields — minute, hour, day of month, month, day of week — followed by the command to run. Each field accepts a number, a range, a list, a step value, or an asterisk meaning "any." That's the entire format; everything else is just combinations of those rules.
If you typed "cron syntax" into a search box and need the answer now, skim the table, grab the examples, move on. For deep-dive edge cases (non-standard fields, timezone quirks, vendor-specific extensions), our complete cron schedule syntax reference covers those in full — this page stays focused on the core format.
The Five Fields, In Order
Every standard cron expression follows this positional layout:
| Field | Allowed Values | Special Characters |
|---|---|---|
| Minute | 0–59 | * , - / |
| Hour | 0–23 | * , - / |
| Day of month | 1–31 | * , - / ? |
| Month | 1–12 (or JAN–DEC) | * , - / |
| Day of week | 0–6 (0 = Sunday, or SUN–SAT) | * , - / ? |
Position matters more than anything else in cron syntax. Miss a field, or put a value in the wrong slot, and you'll either get a scheduling error or — worse — a job that silently runs at the wrong time. Read left to right: minute, hour, day-of-month, month, day-of-week, then the command.
Special Characters, Decoded
The characters inside each field carry specific meaning, and they're the same characters mixed and matched across all five positions.
*(asterisk) — "every" value in that field.* * * * *runs every minute.,(comma) — a list of specific values.0,30 * * * *fires at the top and bottom of every hour.-(hyphen) — a range.9-17in the hour field means 9 AM through 5 PM inclusive./(slash) — a step value.*/15in the minute field means every 15 minutes;2-10/2steps by 2 within a range.?(question mark) — used in some cron implementations (notably Quartz) in the day-of-month or day-of-week field to mean "no specific value," avoiding conflicts when both fields are set.
These combine freely. 0 9-17/2 * * MON-FRI reads as: minute 0, every 2 hours between 9 AM and 5 PM, any day of month, any month, Monday through Friday. Once you can parse that sentence, you can parse almost any cron line.
Common Cron Schedule Syntax Patterns
These are the expressions developers write most often, ready to copy into a crontab or scheduler config.
| Expression | Runs |
|---|---|
* * * * * |
Every minute |
*/5 * * * * |
Every 5 minutes |
0 * * * * |
Every hour, on the hour |
0 0 * * * |
Every day at midnight |
0 9 * * MON-FRI |
9 AM, weekdays only |
0 0 1 * * |
Midnight on the 1st of every month |
0 0 * * 0 |
Midnight every Sunday |
30 3 * * 6 |
3:30 AM every Saturday |
0 0 1 1 * |
Midnight, January 1st (annually) |
Notice how much of this is just the special characters from the previous section, applied consistently. There's no memorization trick beyond knowing what each of the five slots represents and what each symbol does inside it.
Where This Cron Syntax Trips People Up
A handful of mistakes account for most broken schedules.
Day-of-month and day-of-week are ANDed by default — wrongly assumed. In standard (non-Quartz) cron, if both fields are restricted — say, day-of-month is 15 and day-of-week is MON — the job runs when either condition is true, not both, in most implementations. This inverts what people expect and causes jobs to fire on unintended days.
Timezone assumptions. Cron syntax itself has no concept of timezone — it runs against whatever clock the host or scheduler uses. A 0 9 * * * job assumed to mean 9 AM Eastern will run at 9 AM UTC if the server (or serverless platform) is set to UTC, which is the default in most cloud environments.
Off-by-one on day-of-week. Some systems index Sunday as 0, others as 7, and a few require 1–7 with Monday first. Always check the specific parser's documentation before assuming 0 and 7 are interchangeable — most treat them as equivalent, but not all.
Six-field variants. Some schedulers (Quartz, several cloud cron services) prepend a seconds field, making it six fields total: seconds, minute, hour, day-of-month, month, day-of-week. Pasting a five-field expression into a six-field parser shifts everything by one column.
Cron Syntax Across Different Platforms
The five-field core is close to universal, but implementations diverge at the edges:
- Unix/Linux cron and crontab — the canonical five-field format described above.
- Quartz Scheduler (Java) — adds a seconds field and supports
?for "no value" in day fields. - AWS EventBridge / CloudWatch Events — uses a six-field format with seconds omitted but requires
?in either day-of-month or day-of-week (never both wildcards). - GitHub Actions (
schedule:in workflow YAML) — standard five-field cron syntax, evaluated in UTC. - Kubernetes CronJob — standard five-field syntax, with scheduling subject to the controller's own timezone and drift tolerance settings.
If you're scheduling HTTP-triggered jobs across more than one of these — a GitHub Action that pings an endpoint, plus a Kubernetes CronJob doing the same — it's worth normalizing your expressions and documenting which timezone each platform assumes. That single habit prevents a large share of "why didn't this run" incidents.
Why Correct Syntax Isn't the Whole Story
Getting the expression right means the job fires on schedule — it doesn't mean the job succeeds. A cron line with flawless syntax will happily keep triggering an endpoint that's timing out, returning a 500, or has silently stopped running altogether, and cron itself won't tell you. That's a monitoring gap, not a syntax gap.
That gap is what Cronevra is built for: tracking execution history for your scheduled HTTP jobs, flagging failures, and alerting you when a run doesn't happen the way it should — so a correct crontab line actually translates into a job you can trust.
Frequently Asked Questions
What is cron syntax?
Cron syntax is a five-field time pattern — minute, hour, day of month, month, and day of week — used to define when a scheduled job should run. Each field accepts numbers, ranges, lists, steps, or a wildcard, and the fields are read left to right followed by the command to execute.
What does the asterisk mean in cron?
The asterisk (*) means "every" value is valid for that field. Placed in the minute field it means every minute; placed in the month field it means every month, with no restriction.
How do I schedule a job to run every 5 minutes?
Use */5 * * * *, where the slash after the asterisk defines a step value in the minute field. This tells cron to trigger the job at minute 0, 5, 10, 15, and so on through the hour.
Does cron syntax include seconds?
Standard Unix cron does not include a seconds field — it has five fields starting at minutes. Some platforms, including Quartz Scheduler and AWS EventBridge, use a six-field format with seconds added at the front, so always confirm which format your scheduler expects.
Why did my cron job run on the wrong day?
The most common cause is that day-of-month and day-of-week are both restricted, and standard cron treats them as an OR condition rather than AND, so the job fires if either matches. Timezone mismatches between your assumption and the host's clock are the second most common cause.
Is cron syntax the same on every platform?
The core five-field format is nearly universal across Unix cron, GitHub Actions, and Kubernetes CronJob, but details vary. Quartz Scheduler and AWS EventBridge add a seconds field and support the ? wildcard, so an expression that works in one system may need adjustment in another.