--help Show context-sensitive help (also try --help-long and --help-man).
--key=KEY
Path to key file (if applicable, PEM, DER or JWK format)
--in=IN
Path to input file (if applicable, stdin if missing)
--out=OUT
Path to output file (if applicable, stdout if missing)
--version
Show application version.
encrypt--alg=ALG --enc=ENC [<flags>] Encrypt a plaintext, output ciphertext
--alg=ALG
Key management algorithm (e.g. RSA-OAEP)
--enc=ENC
Content encryption algorithm (e.g. A128GCM)
--full Use JSON Serialization format (instead of compact)
decrypt
Decrypt a ciphertext, output plaintext
sign--alg=ALG [<flags>] Sign a payload, output signed message
--alg=ALG
Key management algorithm (e.g. RSA-OAEP)
--full Use JSON Serialization format (instead of compact)
verify Verify a signed message, output payload
expand [<flags>] Expand JOSE object to JSON Serialization format
--format=FORMAT
Type of message to expand (JWS or JWE, defaults to JWE)
b64decode
Decode a base64-encoded payload (auto-selects standard/url-safe) generate-key --use=USE --alg=ALG
[<flags>] Generate a public/private key pair in JWK format
--use=USE
Desired public key usage (use header), one of [enc sig]
--alg=ALG
Desired key pair algorithm (alg header)
--size=SIZE
Key size in bits (e.g. 2048 if generating an RSA key)
--kid=KID
Optional Key ID (kid header, generate random kid if not set)