# winch secret decrypt

print the plaintext of a secret

## Examples

```sh
# print the plaintext of the default of a variable
winch secret decrypt vars.monit_password
```

```sh
# print the plaintext of a secret in the vars of one host
winch secret decrypt hosts.db1.acme.com.vars.db_password
```

```sh
# print the plaintext of a !secret value
echo '!secret YWdl...' | winch secret decrypt
```

## Usage

```
winch secret decrypt [<path>]
```

Decrypt prints the plaintext of the !secret at the path, or of a !secret value on stdin, with or without the tag. It prints nothing else, also no newline after the plaintext. It is the only command whose output holds a secret.

A path names a place in the project, with keys joined by ".". vars.x is the default of x in winch.yaml, and recipes.mail.vars.mail\_x a default in the recipe mail. groups.all.vars.x and hosts.web1.vars.x are in the inventory at the top of winch.yaml, and inventories.prod.groups.all.vars.x is in the inventory prod. A path can go on into a map variable, such as vars.users.alice, but not into a list. A key with dots or "\[" stands in brackets and double quotes, such as vars.dkim\_keys\["acme.com"\].

A path to a map or to a value that is not a !secret is an error.

winch reads the age key from the stdout of the command in WINCH\_AGE\_IDENTITY\_CMD, which runs through sh -c. Without it, winch reads the file that WINCH\_AGE\_KEY names, or else \~/.config/winch/age.key. Both variables set is an error.

## See

- `winch doc secrets`