diff --git a/docs/cli_commands.md b/docs/cli_commands.md
index 9fde4d436e5..45360c31103 100644
--- a/docs/cli_commands.md
+++ b/docs/cli_commands.md
@@ -357,9 +357,10 @@ This document provides an overview of CLI commands that can be sent to MeshCore
 **Usage:**
 - `get prv.key`
 - `set prv.key <private_key>`
+- `set prv.key random`
 
 **Parameters:**
-- `private_key`: Private key in hex format (64 hex characters)
+- `private_key`: Private key in hex format (64 hex characters), or `random` to generate a new random key
 
 **Serial Only:**
 - `get prv.key`: Yes
diff --git a/docs/faq.md b/docs/faq.md
index ade59bf0090..3880f43d5ce 100644
--- a/docs/faq.md
+++ b/docs/faq.md
@@ -266,6 +266,7 @@ You can get the latitude and longitude from Google Maps by right-clicking the lo
 
 `get prv.key` to print a repeater's private key on the serial console
 `set prv.key <hex>` to set a repeater's private key on the serial console
+`set prv.key random` to generate a new random private key
 
 Reboot the repeater after `set prv.key <hex>` command for the new private key to take effect.
 
diff --git a/examples/simple_repeater/MyMesh.h b/examples/simple_repeater/MyMesh.h
index dc89325861c..4b1e202ad6d 100644
--- a/examples/simple_repeater/MyMesh.h
+++ b/examples/simple_repeater/MyMesh.h
@@ -224,6 +224,7 @@ class MyMesh : public mesh::Mesh, public CommonCLICallbacks {
   mesh::LocalIdentity& getSelfId() override { return self_id; }
 
   void saveIdentity(const mesh::LocalIdentity& new_id) override;
+  mesh::LocalIdentity generateIdentity() override { return radio_new_identity(); }
   void clearStats() override;
 
   void handleCommand(uint32_t sender_timestamp, char* command, char* reply);
diff --git a/examples/simple_room_server/MyMesh.h b/examples/simple_room_server/MyMesh.h
index 4dee8bdbf40..dccadedd98a 100644
--- a/examples/simple_room_server/MyMesh.h
+++ b/examples/simple_room_server/MyMesh.h
@@ -226,6 +226,7 @@ class MyMesh : public mesh::Mesh, public CommonCLICallbacks {
   static bool saveFilter(ClientInfo* client);
 
   void saveIdentity(const mesh::LocalIdentity& new_id) override;
+  mesh::LocalIdentity generateIdentity() override { return radio_new_identity(); }
   void clearStats() override;
   void handleCommand(uint32_t sender_timestamp, char* command, char* reply);
   void loop();
diff --git a/examples/simple_sensor/SensorMesh.h b/examples/simple_sensor/SensorMesh.h
index 590ca0c7657..aa6e591aa0f 100644
--- a/examples/simple_sensor/SensorMesh.h
+++ b/examples/simple_sensor/SensorMesh.h
@@ -76,6 +76,7 @@ class SensorMesh : public mesh::Mesh, public CommonCLICallbacks {
   void formatPacketStatsReply(char *reply) override;
   mesh::LocalIdentity& getSelfId() override { return self_id; }
   void saveIdentity(const mesh::LocalIdentity& new_id) override;
+  mesh::LocalIdentity generateIdentity() override { return radio_new_identity(); }
   void clearStats() override { }
   void applyTempRadioParams(float freq, float bw, uint8_t sf, uint8_t cr, int timeout_mins) override;
   void startRegionsLoad() override;
diff --git a/src/helpers/CommonCLI.cpp b/src/helpers/CommonCLI.cpp
index 04199e24d1d..e216a66d403 100644
--- a/src/helpers/CommonCLI.cpp
+++ b/src/helpers/CommonCLI.cpp
@@ -516,11 +516,21 @@ void CommonCLI::handleSetCmd(uint32_t sender_timestamp, char* command, char* rep
     strcpy(reply, "OK");
   } else if (memcmp(config, "prv.key ", 8) == 0) {
     uint8_t prv_key[PRV_KEY_SIZE];
-    bool success = mesh::Utils::fromHex(prv_key, PRV_KEY_SIZE, &config[8]);
-    // only allow rekey if key is valid
-    if (success && mesh::LocalIdentity::validatePrivateKey(prv_key)) {
-      mesh::LocalIdentity new_id;
-      new_id.readFrom(prv_key, PRV_KEY_SIZE);
+    bool success = true;
+    mesh::LocalIdentity new_id;
+    if (strcmp(&config[8], "random") == 0) {
+      new_id = _callbacks->generateIdentity();
+      int count = 0;
+      while (count < 10 && (new_id.pub_key[0] == 0x00 || new_id.pub_key[0] == 0xFF)) {  // reserved id hashes
+        new_id = _callbacks->generateIdentity(); count++;
+      }
+    } else {
+      success = mesh::Utils::fromHex(prv_key, PRV_KEY_SIZE, &config[8]);
+      // only allow rekey if key is valid
+      success = success && mesh::LocalIdentity::validatePrivateKey(prv_key);
+      if (success) new_id.readFrom(prv_key, PRV_KEY_SIZE);
+    }
+    if (success) {
       _callbacks->saveIdentity(new_id);
       strcpy(reply, "OK, reboot to apply! New pubkey: ");
       mesh::Utils::toHex(&reply[33], new_id.pub_key, PUB_KEY_SIZE);
diff --git a/src/helpers/CommonCLI.h b/src/helpers/CommonCLI.h
index 2759b0c4f0e..38a51960e14 100644
--- a/src/helpers/CommonCLI.h
+++ b/src/helpers/CommonCLI.h
@@ -263,6 +263,7 @@ class CommonCLICallbacks {
   virtual void formatPacketStatsReply(char *reply) = 0;
   virtual mesh::LocalIdentity& getSelfId() = 0;
   virtual void saveIdentity(const mesh::LocalIdentity& new_id) = 0;
+  virtual mesh::LocalIdentity generateIdentity() = 0;
   virtual void clearStats() = 0;
   virtual void applyTempRadioParams(float freq, float bw, uint8_t sf, uint8_t cr, int timeout_mins) = 0;