[hsvabek@localhost bin]$ ./elytron-tool.sh  --help
Missing arguments. Printing general help message:
usage: java -jar wildfly-elytron-tool.jar credential-store [-a <alias> | -e <alias> | -r <alias> | -v] [-c]  [-f] [-h] [-i <arg>] [-l <loc>] [-n <type>] [-o <providers>] [-p <pwd>]  [-s <arg>] [-t <type>] [-u <arg>]  [-x <secret to store>]
"credential-store" command is used to perform various operations on credential store.
 -a,--add <alias>                   Add new alias to the credential store
 -c,--create                        Create credential store
 -e,--exists <alias>                Check if alias exists within the credential store
 -f,--summary                       Print summary, especially command how to create this credential store
 -h,--help                          Get help with usage of this command
 -i,--iteration <arg>               Iteration count for final masked password of the credential store
 -l,--location <loc>                Location of credential store storage file
 -n,--entry-type <type>             Type of entry in credential store
 -o,--other-providers <providers>   Comma separated list of JCA provider names. Providers will be supplied to the credential store instance.
                                    Each provider must be installed through java.security file.
 -p,--password <pwd>                Password for credential store
 -r,--remove <alias>                Remove alias from the credential store
 -s,--salt <arg>                    Salt to apply for final masked password of the credential store
 -t,--type <type>                   Credential store type
 -u,--properties <arg>              Implementation properties for credential store type in form of "prop1=value1; ... ;propN=valueN" .
                                    Supported properties are dependent on credential store type
                                    KeyStoreCredentialStore (default implementation) supports following additional properties (all are optional):
                                    keyStoreType - specifies the key store type to use (defaults to "JCEKS")
                                    keyAlias - specifies the secret key alias within the key store to use for encrypt/decrypt of data in external storage (defaults to "cs_key")
                                    external - specifies whether to store data to external storage and encrypted by keyAlias key (defaults to "false")
                                    cryptoAlg - cryptographic algorithm name to be used to encrypt/decrypt entries at external storage "external" has to be set to "true"
 -v,--aliases                       Display all aliases
 -x,--secret <secret to store>      Password credential value

usage: java -jar wildfly-elytron-tool.jar vault [-b <description file>] [-e <dir>] [-f] [-h] [-i <arg>] [-k <keystore>] [-l <loc>] [-p <pwd>] [-s <salt>] [-u <arg>] [-v <arg>]
"vault" command is used convert PicketBox Security Vault to credential store using default implementation (KeyStoreCredentialStore).
 -b,--bulk-convert <description file>   Bulk conversion with options listed in description file. All options have no default value and should be set in the file.
                                        All options are required with two exceptions:
                                        - "properties" option
                                        - "salt" and "iteration" options can be omitted when plain-text password is used
                                        Each set of options must start with the "keystore" option in the following format:
                                        keystore:<value>
                                        keystore-password:<value>
                                        enc-dir:<value>
                                        salt:<value>
                                        iteration:<value>
                                        location:<value>
                                        alias:<value>
                                        properties:<parameter1>=<value1>; ... ;<parameterN>=<valueN>
 -e,--enc-dir <dir>                     Vault directory containing encrypted files
 -f,--summary                           Print summary of conversion
 -h,--help                              Get help with usage of this command
 -i,--iteration <arg>                   Iteration count
 -k,--keystore <keystore>               Vault keystore URL
 -l,--location <loc>                    Location of credential store storage file
 -p,--keystore-password <pwd>           Vault keystore password:
                                        - used to open original vault key store
                                        - used as password for new converted credential store
 -s,--salt <salt>                       8 character salt
 -u,--properties <arg>                  Configuration parameters for credential store in form of: "parameter1=value1; ... ;parameterN=valueN"
                                        Supported parameters are dependent on credential store type
                                        Generally supported parameters for default credential store implementation (all are optional):
                                        create - automatically creates credential store file (true/false)
                                        modifiable - is the credential modifiable (true/false)
                                        location - file location of credential store
                                        keyStoreType - specify the key store type to use
 -v,--alias <arg>                       Vault master key alias within key store

usage: java -jar wildfly-elytron-tool.jar mask [-h] [-i <arg>] [-s <arg>] [-x <to encrypt>]
"mask" command is used to get MASK- string encrypted using PBEWithMD5AndDES in PicketBox compatible way.
 -h,--help                  Get help with usage of this command
 -i,--iteration <arg>       Iteration count for masked string
 -s,--salt <arg>            Salt to apply to masked string
 -x,--secret <to encrypt>   Secret to be encrypted

[hsvabek@localhost bin]$