1 files changed, 47 insertions, 4 deletions
diff --git a/README.md b/README.md
index f554d81..fc98d94 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
-# yubicrypt
-
-An easy to use public key encryption program for your YubiKey.
+# yubicrypt
+
+An easy to use command-line public key encryption program for your YubiKey.
 
 Supported YubiKey algorithms:
 
@@ -33,7 +33,50 @@ sudo systemctl enable pcscd
 Check the status to ensure it's running  
 sudo systemctl status pcscd  
 
-![yubicrypt](img/1.png)
+## CLI usage
+
+Build the CLI:
+
+```sh
+go build -o yubicrypt .
+```
+
+Commands:
+
+```sh
+./yubicrypt help
+./yubicrypt cards
+./yubicrypt encrypt --key alice.crt -i msg.txt -o msg.yc
+printf '%s\n' "$PIV_PIN" | ./yubicrypt decrypt --pin-stdin -i msg.yc -o msg.txt
+printf '%s\n' "$PIV_PIN" | ./yubicrypt sign --pin-stdin -i msg.txt -o msg.sig.txt
+./yubicrypt verify -i msg.sig.txt --public-key
+./yubicrypt pad --text "message" -o padded.txt
+./yubicrypt unpad -i padded.txt -o message.txt
+```
+
+PIN options for `decrypt` and `sign`:
+
+- `--pin-stdin`: read the PIV PIN from the first stdin line.
+- `--pin-file FILE`: read the PIV PIN from the first line of a file.
+- `--pin PIN`: pass the PIV PIN directly. This is less safe because it can leak through shell history or process listings.
+- `--card-index N`: select the YubiKey index shown by `./yubicrypt cards`. The default is `0`.
+
+Common IO options:
+
+- `-i, --input FILE`: input file, or `-` for stdin.
+- `-o, --output FILE`: output file, or `-` for stdout.
+- `--text TEXT`: use literal text instead of reading input.
+- `--quiet`: suppress status output on stderr.
+
+## GUI build
+
+The old Fyne GUI is still available as an explicit build target:
+
+```sh
+go build -tags gui -o yubicrypt-gui .
+```
+
+![yubicrypt](img/1.png)
 
 The copy signature component is intended for usage of my [identicons](https://github.com/Ch1ffr3punk/identicons) program,    
 so that you can create your yubicrypt identicon for websites etc.