diff --git a/Makefile b/Makefile
index 59cbbccfc..678c64554 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ FEATURES := -DHAS_CSV=1 -DALPHA_TXSTYLE=1 -DUSE_SCHNORR=1
 # Bitcoin uses DER for signatures
 #FEATURES := -DSCRIPTS_USE_DER
 
-PROGRAMS := test-cli/open-channel test-cli/open-commit-sig test-cli/check-commit-sig test-cli/get-anchor-depth test-cli/create-steal-tx test-cli/create-commit-spend-tx test-cli/close-channel test-cli/create-close-tx test-cli/update-channel test-cli/update-channel-accept test-cli/update-channel-signature test-cli/update-channel-complete test-cli/create-commit-tx test-cli/txid-of test-cli/create-anchor-tx test-cli/open-anchor-id test-cli/open-complete test-cli/check-open-complete test-cli/open-escape-sigs test-cli/create-escape-tx test-cli/get-revocation-secret
+PROGRAMS := test-cli/open-channel test-cli/open-commit-sig test-cli/check-commit-sig test-cli/get-anchor-depth test-cli/create-steal-tx test-cli/create-commit-spend-tx test-cli/close-channel test-cli/create-close-tx test-cli/update-channel test-cli/update-channel-accept test-cli/update-channel-signature test-cli/update-channel-complete test-cli/create-commit-tx test-cli/txid-of test-cli/create-anchor-tx test-cli/open-anchor-id test-cli/open-complete test-cli/check-open-complete test-cli/open-escape-sigs test-cli/create-escape-tx test-cli/get-revocation-secret test-cli/extract-revocation-preimage
 
 BITCOIN_OBJS := bitcoin/address.o bitcoin/base58.o bitcoin/pubkey.o bitcoin/script.o bitcoin/shadouble.o bitcoin/signature.o bitcoin/tx.o
 
diff --git a/test-cli/extract-revocation-preimage.c b/test-cli/extract-revocation-preimage.c
new file mode 100644
index 000000000..615f917a2
--- /dev/null
+++ b/test-cli/extract-revocation-preimage.c
@@ -0,0 +1,57 @@
+#include <ccan/crypto/shachain/shachain.h>
+#include <ccan/short_types/short_types.h>
+#include <ccan/tal/tal.h>
+#include <ccan/opt/opt.h>
+#include <ccan/str/hex/hex.h>
+#include <ccan/err/err.h>
+#include <ccan/read_write_all/read_write_all.h>
+#include "lightning.pb-c.h"
+#include "protobuf_convert.h"
+#include "pkt.h"
+#include <unistd.h>
+
+int main(int argc, char *argv[])
+{
+	const tal_t *ctx = tal_arr(NULL, char, 0);
+	struct sha256 secret;
+	Pkt *pkt;
+	Sha256Hash *preimage;
+	char hexstr[hex_str_size(sizeof(secret))];
+	
+	err_set_progname(argv[0]);
+
+	opt_register_noarg("--help|-h", opt_usage_and_exit,
+			   "<update-sig-or-update-complete>\n"
+			   "Extract revocation preimage from message",
+			   "Print this message.");
+
+ 	opt_parse(&argc, argv, opt_log_stderr_exit);
+
+	if (argc != 2)
+		opt_usage_exit_fail("Expected 1 argument");
+
+	pkt = any_pkt_from_file(argv[1]);
+
+	switch (pkt->pkt_case) {
+	case PKT__PKT_UPDATE_SIGNATURE:
+		preimage = pkt->update_signature->revocation_preimage;
+		break;
+	case PKT__PKT_UPDATE_COMPLETE:
+		preimage = pkt->update_complete->revocation_preimage;
+		break;
+	default:
+		errx(1, "Unexpected packet type %u in %s",
+		     pkt->pkt_case, argv[1]);
+	}
+	proto_to_sha256(preimage, &secret);
+
+	if (!hex_encode(&secret, sizeof(secret), hexstr, sizeof(hexstr)))
+		abort();
+
+	if (!write_all(STDOUT_FILENO, hexstr, strlen(hexstr)))
+		err(1, "Writing out hexstr");
+
+	tal_free(ctx);
+	return 0;
+}
+