diff --git a/TODO.md b/TODO.md
index 4232e120..dc0f0297 100644
--- a/TODO.md
+++ b/TODO.md
@@ -26,8 +26,8 @@
     - [x] `rm`
     - [x] `run`
     - [ ] `rollback`
-    - [ ] `secret` (WIP: decentral1se)
-      - [ ] `generate` (WIP: decentral1se)
+    - [x] `secret`
+      - [x] `generate`
       - [x] `insert`
       - [x] `rm`
       - [x] `ls`
diff --git a/cli/app/secret.go b/cli/app/secret.go
index a4722f1a..3708fa34 100644
--- a/cli/app/secret.go
+++ b/cli/app/secret.go
@@ -26,9 +26,59 @@ var allSecretsFlag = &cli.BoolFlag{
 }
 
 var appSecretGenerateCommand = &cli.Command{
-	Name:  "generate",
-	Usage: "Generate secrets",
+	Name:      "generate",
+	Usage:     "Generate secrets",
+	ArgsUsage: "<secret> <version>",
+	Flags:     []cli.Flag{allSecretsFlag, internal.PassFlag},
 	Action: func(c *cli.Context) error {
+		appName := c.Args().First()
+		if appName == "" {
+			internal.ShowSubcommandHelpAndError(c, errors.New("no app name provided"))
+		}
+
+		if c.Args().Get(1) != "" && allSecrets {
+			internal.ShowSubcommandHelpAndError(c, errors.New("cannot use '<secret> <version>' and '--all' together"))
+		}
+
+		appFiles, err := config.LoadAppFiles("")
+		if err != nil {
+			logrus.Fatal(err)
+		}
+
+		appEnv, err := config.GetApp(appFiles, appName)
+		if err != nil {
+			logrus.Fatal(err)
+		}
+
+		secretsToCreate := make(map[string]string)
+		host := appFiles[appName].Server
+		secretEnvVars := secret.ReadSecretEnvVars(appEnv.Env)
+		if allSecrets {
+			secretsToCreate = secretEnvVars
+		} else {
+			secretName := c.Args().Get(1)
+			secretVersion := c.Args().Get(2)
+			for sec, _ := range secretEnvVars {
+				parsed := secret.ParseSecretEnvVarName(sec)
+				if secretName == parsed {
+					secretsToCreate[sec] = secretVersion
+				}
+			}
+		}
+
+		secretVals, err := secret.GenerateSecrets(secretsToCreate, appEnv.StackName(), host)
+		if err != nil {
+			logrus.Fatal(err)
+		}
+
+		if internal.Pass {
+			for name, data := range secretVals {
+				if err := secret.PassInsertSecret(data, name, appEnv.StackName(), host); err != nil {
+					logrus.Fatal(err)
+				}
+			}
+		}
+
 		return nil
 	},
 }