/usr/bin/systemd-creds

> systemd-creds [OPTION…] COMMAND …

Display and process credentials.

Commands:
  [list]                                Show list of passed credentials
  cat CREDENTIAL...                     Show contents of specified credentials
  encrypt INPUT OUTPUT                  Encrypt plaintext credential file and write to ciphertext
                                        credential file
  decrypt INPUT [OUTPUT]                Decrypt ciphertext credential file and write to plaintext
                                        credential file
  setup                                 Generate credentials host key, if not existing yet
  help                                  Show this help

Options:
  -h --help                             Show this help
     --version                          Show package version
     --no-pager                         Do not start a pager
     --no-legend                        Do not show headers and footers
     --json=FORMAT                      Generate JSON output (pretty, short, or off)
     --system                           Show credentials passed to system
     --transcode=METHOD                 Transcode credential data (base64, unbase64, hex, unhex)
     --newline=auto|yes|no              Suffix output with newline
  -p --pretty                           Output as SetCredentialEncrypted= line
     --name=NAME                        Override filename included in encrypted credential
     --timestamp=TIME                   Include specified timestamp in encrypted credential
     --not-after=TIME                   Include specified invalidation time in encrypted credential
     --with-key=KEY                     Which keys to encrypt with (host, tpm2, host+tpm2, null,
                                        auto, auto-initrd)
  -H                                    Shortcut for --with-key=host
  -T                                    Shortcut for --with-key=tpm2
     --tpm2-device=PATH                 Pick TPM2 device
     --tpm2-pcrs=PCR1+PCR2+PCR3+…       Specify TPM2 PCRs to seal against (fixed hash)
     --tpm2-public-key=PATH             Specify PEM certificate to seal against
     --tpm2-public-key-pcrs=PCR1+PCR2+… Specify TPM2 PCRs to seal against (public key)
     --tpm2-signature=PATH              Specify signature for public key PCR policy
     --user                             Select user-scoped credential encryption
     --uid=UID                          Select user for scoped credentials
     --allow-null                       Allow decrypting credentials with null key
     --refuse-null                      Refuse decrypting credentials with null key
     --no-ask-password                  Do not prompt for password
  -q --quiet                            Suppress informational messages

See the systemd-creds(1) man page for details.