diff --git a/mvt/ios/cli.py b/mvt/ios/cli.py
index 47a45cb..bd939c6 100644
--- a/mvt/ios/cli.py
+++ b/mvt/ios/cli.py
@@ -15,6 +15,7 @@ from mvt.common.options import MutuallyExclusiveOption
 from mvt.common.indicators import Indicators
 
 from .decrypt import DecryptBackup
+from .keyutils import KeyUtils
 from .modules.fs import BACKUP_MODULES, FS_MODULES
 
 # Setup logging using Rich.
@@ -60,6 +61,26 @@ def decrypt_backup(destination, password, key_file, backup_path):
         raise click.ClickException("Missing required option. Specify either "
                                    "--password or --key-file.")
 
+#==============================================================================
+# Command: extract-key
+#==============================================================================
+@cli.command("extract-key", help="Extract decryption key from an iTunes backup")
+@click.option("--password", "-p",
+              help="Password to use to decrypt the backup",
+              prompt="Backup password", 
+              hide_input=True, prompt_required=False, required=True)
+@click.option("--key-file", "-k",
+              help="Key file to be written (if unset, will print to STDOUT)",
+              required=False,
+              type=click.Path(exists=False, file_okay=True, dir_okay=False, writable=True))
+@click.argument("BACKUP_PATH", type=click.Path(exists=True))
+def extract_key(password, backup_path, key_file):
+    key_utils = KeyUtils(password, backup_path)
+    if key_file:
+        key_utils.write_key(key_file)
+    else:
+        key_utils.print_key()
+
 
 #==============================================================================
 # Command: check-backup