diff --git a/cmd/system-cli/main.go b/cmd/system-cli/main.go
index f4fd5ce03..7399e17d5 100644
--- a/cmd/system-cli/main.go
+++ b/cmd/system-cli/main.go
@@ -23,5 +23,5 @@ func main() {
 		log.Fatalf("Error initializing system: %+v", err)
 	}
 
-	cli.Run(ctx)
+	cli.StartCLI(ctx)
 }
diff --git a/system/cli/cli.go b/system/cli/cli.go
index 5a691a13f..ced1e8f2d 100644
--- a/system/cli/cli.go
+++ b/system/cli/cli.go
@@ -11,7 +11,7 @@ import (
 	"github.com/crusttech/crust/system/internal/repository"
 )
 
-func Run(ctx context.Context) {
+func StartCLI(ctx context.Context) {
 	var (
 		db              = repository.DB(ctx)
 		settingsService = settings.NewService(settings.NewRepository(db, "sys_settings"))
diff --git a/system/cli/users.go b/system/cli/users.go
index 3609dd6eb..cc8fe90bc 100644
--- a/system/cli/users.go
+++ b/system/cli/users.go
@@ -3,12 +3,14 @@ package cli
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"syscall"
 
 	"github.com/spf13/cobra"
 	"github.com/titpetric/factory"
 	"golang.org/x/crypto/ssh/terminal"
 
+	"github.com/crusttech/crust/internal/auth"
 	"github.com/crusttech/crust/system/internal/repository"
 	"github.com/crusttech/crust/system/internal/service"
 	"github.com/crusttech/crust/system/types"
@@ -127,10 +129,41 @@ func usersCmd(ctx context.Context, db *factory.DB) *cobra.Command {
 		},
 	}
 
+	jwtCmd := &cobra.Command{
+		Use:   "jwt [email-or-id]",
+		Short: "Generates new JWT for a user",
+		Args:  cobra.MinimumNArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			var (
+				userRepo = repository.User(ctx, db)
+				// authSvc  = service.Auth(ctx)
+
+				user *types.User
+				err  error
+				ID   uint64
+
+				userStr = args[0]
+			)
+
+			if user, err = userRepo.FindByEmail(userStr); err != nil && err != repository.ErrUserNotFound {
+				exit(cmd, err)
+			} else if user == nil || user.ID == 0 {
+				if ID, err = strconv.ParseUint(userStr, 10, 64); err != nil {
+					exit(cmd, err)
+				} else if user, err = userRepo.FindByID(ID); err != nil {
+					exit(cmd, err)
+				}
+			}
+
+			cmd.Println(auth.DefaultJwtHandler.Encode(user))
+		},
+	}
+
 	cmd.AddCommand(
 		listCmd,
 		addCmd,
 		pwdCmd,
+		jwtCmd,
 	)
 
 	return cmd