diff --git a/sbin/encrypt.sh b/sbin/encrypt.sh
new file mode 100755
index 0000000..04be24f
--- /dev/null
+++ b/sbin/encrypt.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -eu -o pipefail
+
+# Usage
+# ./encrypt.sh mysecretname mysecretvalue
+
+declare name="$1"
+declare secret="$2"
+
+ansible-vault \
+  encrypt_string \
+  --vault-password-file ansible/.vault.sh \
+  --name \
+  "$name" \
+  "$secret"