diff --git a/bin/hkdf b/bin/hkdf
new file mode 100755
index 00000000..6d9ff424
--- /dev/null
+++ b/bin/hkdf
@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+
+'use strict'
+
+const HKDF = require('node-hkdf-sync')
+
+const label = process.argv[2]
+const masterSeedHex = process.argv[3].trim()
+
+if (process.argv.length !== 4) {
+  console.log('hdkf <label> <masterKey>')
+  console.log('masterKey should be in hex encoding.')
+  process.exit(3)
+}
+
+const masterSeed = new Buffer(masterSeedHex, 'hex')
+const hkdf = new HKDF('sha256', 'lamassu-server-salt', masterSeed)
+console.log(hkdf.derive(label, 32).toString('hex'))
diff --git a/lib/plugins.js b/lib/plugins.js
index afcaa8b9..d191c3fa 100644
--- a/lib/plugins.js
+++ b/lib/plugins.js
@@ -60,7 +60,7 @@ let alertFingerprint = null
 let lastAlertTime = null
 
 exports.init = function init (connectionString) {
-  const masterSeed = fs.readFileSync('seeds/seed.txt', 'utf8').trim()
+  const masterSeed = new Buffer(fs.readFileSync('seeds/seed.txt', 'utf8').trim(), 'hex')
   hkdf = new HKDF('sha256', 'lamassu-server-salt', masterSeed)
 
   db.init(connectionString)
diff --git a/package.json b/package.json
index e8cf8ac4..36ebea14 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,8 @@
   "bin": {
     "lamassu-server": "./bin/lamassu-server",
     "ssu-raqia": "./bin/ssu-raqia",
-    "ssu": "./bin/ssu"
+    "ssu": "./bin/ssu",
+    "hkdf": "./bin/hkdf"
   },
   "scripts": {
     "test": "mocha --recursive test"