diff --git a/docs/CLI.md b/docs/CLI.md
index cc2ceb38..7a9cbe8b 100644
--- a/docs/CLI.md
+++ b/docs/CLI.md
@@ -22,6 +22,13 @@ $ repo.py --init repo/
 
 
 
+By default, `pw` is used to encrypt the top-level key files.  Instead, the user
+can be prompted for a password.
+```Bash
+$ repo.py --init --pw
+```
+
+
 Create a TUF repository in the current working directory.  A cryptographic key
 is *not* created nor set for each top-level role.
 ```Bash