What Is a Cron Expression?

If you've set up a scheduled backup, a nightly report, or a Kubernetes job that runs every hour, you've run into a string like 0 9 * * 1-5 and had to figure out what it actually means. Here's the short answer, where the format comes from, and where you'll run into it.

The short definition

A cron expression is a compact, five-field string that describes a recurring schedule — which minutes, hours, days, months, and weekdays a job should run on. It's the configuration format read by cron, the job scheduler built into Unix and Unix-like operating systems (Linux, macOS, BSD). The name comes from the Greek word chronos, meaning time — an etymology confirmed by Ken Thompson, who wrote the original cron while at Bell Labs; it shipped as part of Unix in 1977.

Practically, a cron expression is the answer to "when should this run?" for anything that needs to happen on a repeating schedule without a human kicking it off — backups, cache warmups, report emails, cleanup jobs, health checks.

The five fields, at a glance

Every standard cron expression has exactly five space-separated fields, always in this order:

minute   hour   day-of-month   month   day-of-week
0-59     0-23   1-31           1-12    0-6 (0 = Sunday)

Take 0 9 * * 1-5: minute 0, hour 9, any day of the month, any month, weekdays 1 through 5 (Monday–Friday). Put in plain English: every weekday at 9:00am. A bare * in a field just means "no restriction, any value."

That's enough to read the basics, but there's more to the syntax — ranges, lists, step values, the day-of-month/day-of-week trap that catches almost everyone once, and the @daily-style shorthands. Understanding Cron Expressions covers all of it in depth.

Cron expression vs. crontab

These two terms get used interchangeably but mean different things. A cron expression is a single schedule string, like 0 9 * * 1-5. A crontab ("cron table") is the file that holds one or more scheduled jobs, where each line pairs a cron expression with the command to run:

0 9 * * 1-5  /usr/local/bin/send-report.sh

Every user on a Unix system can have their own crontab, edited with crontab -e, plus there's typically a system-wide one for jobs that need to run as root.

Where you'll run into cron expressions

The five-field format outlived the original Unix daemon by decades — plenty of modern tools schedule work the exact same way rather than inventing a new syntax:

• Unix/Linux crontab — the original use case, still how most servers schedule recurring shell commands.
• Kubernetes CronJob — the spec.schedule field takes a standard five-field cron expression to run a job on a schedule inside a cluster.
• GitHub Actions — a workflow's on.schedule trigger uses the same five-field POSIX syntax (evaluated in UTC), though it doesn't support the @daily-style shorthands, and the shortest interval it accepts is every 5 minutes.

Learning the format once means you can read a schedule in any of these places without looking up tool-specific documentation.

Try it yourself

Turn a schedule you have in mind into an expression with Cron Builder, or go the other way and translate an expression you found into plain English with Cron Parser. Already have a full crontab file? Cron Validator checks it for malformed fields and other structural mistakes. All three run entirely in your browser.