# Reading a cron expression: five fields and six gotchas

> “0 9 * * 1-5” looks like noise. It means 9:00 every weekday. Once you can read the five fields left to right, you can schedule a backup, a report or a reminder in a single line.

Published 2026-10-08 by Toolcloak. 3 minute read. Original: https://toolcloak.pages.dev/articles/reading-a-cron-expression-five-fields-and-six-gotchas
Related free tool: [Cron Expression Explainer](https://toolcloak.pages.dev/tools/cron-expression-explainer)

Cron is how computers have run things on a schedule since the 1970s: backups, emails, cleanups, reports. The schedule is one line of five fields. It is compact, it is exact, and it is easy to get subtly wrong.

> **In short**
> - Five fields, in this order: **minute, hour, day of month, month, day of week**.
> - `*` means “every”, `*/15` means “every 15”, `1-5` is a range, `1,15` is a list.
> - Cron runs in the **server's time zone**, which is often not yours.
> - If you set both day-of-month and day-of-week, most crons run when **either** matches.

## The five fields

**Read it left to right**

1. **Minute.** 0 to 59
2. **Hour.** 0 to 23, in 24-hour time
3. **Day of month.** 1 to 31
4. **Month.** 1 to 12
5. **Day of week.** 0 to 6, Sunday is 0 (7 also works in many versions)

*Five spaces, five fields. Anything left as * means “every possible value”.*

## Ten lines you will actually use

| Expression | When it runs |
| --- | --- |
| `* * * * *` | Every minute |
| `*/15 * * * *` | Every 15 minutes |
| `0 * * * *` | At the top of every hour |
| `30 2 * * *` | Every day at 2:30 am |
| `0 9 * * 1-5` | At 9:00 am, Monday to Friday |
| `0 0 * * 0` | Midnight every Sunday |
| `0 0 1 * *` | Midnight on the 1st of every month |
| `0 8,20 * * *` | At 8:00 am and 8:00 pm daily |
| `0 0 1 1 *` | Midnight on 1 January |
| `*/5 9-17 * * 1-5` | Every 5 minutes between 9:00 and 17:55 on weekdays |

*Ranges are inclusive: `9-17` includes the 17:xx hour, so the last run is 17:55.*

Try it: [Cron Expression Explainer](https://toolcloak.pages.dev/tools/cron-expression-explainer). Paste a cron line and it explains it in plain English, with the next run times.

## The same job, three ways

**“Run a report”: pick the line**

| When | What |
| --- | --- |
| 0 9 * * 1-5 | Every weekday morning. Good for a daily team summary. |
| 0 9 * * 1 | Every Monday at 9. Good for a weekly digest. |
| 0 9 1 * * | The first of each month at 9. Good for billing or monthly reports. |

*Only the last three fields change. Reading cron is mostly noticing where the stars are.*

## Six gotchas

1. **Time zone.** Cron uses the server's clock. A job “at 9” on a UTC server runs at 2:30 pm in India. Check with the `date` command.
2. **Day of month plus day of week.** `0 0 13 * 5` is not “Friday the 13th”. It runs on the 13th **and** on every Friday.
3. **Every minute by accident.** Leaving the minute field as `*` while setting an hour, as in `* 9 * * *`, runs 60 times during the 9 o'clock hour.
4. **`*/n` is not “every n from now”.** `*/45` in the minutes field runs at :00 and :45 every hour, then restarts at :00.
5. **Missed runs.** If the server was off at the time, standard cron does not catch up.
6. **Different dialects.** Some systems add a seconds field or special names like `@daily`. Check yours.

> **Test before you trust it:** Run the command by hand first, then schedule it a couple of minutes ahead and watch it fire. Write output to a log file, because cron does not show you errors on screen.

## Frequently asked questions

### What do the five fields in a cron expression mean?

In order: minute (0-59), hour (0-23), day of month (1-31), month (1-12) and day of week (0-6, Sunday is 0).

### How do I run a cron job every 15 minutes?

Use */15 * * * *. It runs at minute 0, 15, 30 and 45 of every hour.

### What does 0 9 * * 1-5 mean?

At 9:00 am, Monday through Friday.

### Which time zone does cron use?

The time zone of the machine running it, which is often UTC on servers. Convert your intended time before scheduling.

### Why did my cron job run on the wrong days?

If both day-of-month and day-of-week are set, standard cron runs the job when either one matches, not only when both do.