diff --git a/CHANGELOG.md b/CHANGELOG.md
index d17a25d..0fb268c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## 0.1.1 (UNRELEASED)
 
 * Add masking support [#1](https://github.com/fpco/amber/issues/1)
+* Add subcommand `generate` [#7](https://github.com/fpco/amber/pull/7)
 
 ## 0.1.0 (2021-08)
 
diff --git a/src/cli.rs b/src/cli.rs
index 8315c4a..b03d238 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -29,6 +29,11 @@ pub enum SubCommand {
         /// Value
         value: String,
     },
+    /// Generate a new strong secret value, and add it to the repository
+    Generate {
+        /// Key, must be all capital ASCII characters, digits, and underscores
+        key: String,
+    },
     /// Remove a secret
     Remove {
         /// Key, must be all capital ASCII characters, digits, and underscores
diff --git a/src/main.rs b/src/main.rs
index f07037a..40f1eb3 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -12,6 +12,7 @@ fn main() -> Result<()> {
     match cmd.sub {
         cli::SubCommand::Init => init(cmd.opt),
         cli::SubCommand::Encrypt { key, value } => encrypt(cmd.opt, key, value),
+        cli::SubCommand::Generate { key } => generate(cmd.opt, key),
         cli::SubCommand::Remove { key } => remove(cmd.opt, key),
         cli::SubCommand::Print => print(cmd.opt),
         cli::SubCommand::Exec { cmd: cmd_, args } => exec(cmd.opt, cmd_, args),
@@ -56,6 +57,15 @@ fn encrypt(opt: cli::Opt, key: String, value: String) -> Result<()> {
     config.save(&opt.amber_yaml)
 }
 
+fn generate(opt: cli::Opt, key: String) -> Result<()> {
+    let value = sodiumoxide::randombytes::randombytes(16);
+    let value = sodiumoxide::base64::encode(value, sodiumoxide::base64::Variant::UrlSafe);
+    let msg = format!("Your new secret value is {}: {}", key, value);
+    let res = encrypt(opt, key, value)?;
+    println!("{}", &msg);
+    Ok(res)
+}
+
 fn remove(opt: cli::Opt, key: String) -> Result<()> {
     validate_key(&key)?;
     let mut config = config::Config::load(&opt.amber_yaml)?;