postgres/contrib/pg_tde/documentation/docs/command-line-tools/cli-tools.md

Overview of pg_tde CLI tools

The pg_tde extension introduces new command-line utilities and extends some existing PostgreSQL tools to support encrypted WAL and tables.

New tools

These tools are introduced by pg_tde to support key rotation and WAL encryption workflows:

• pg_tde_change_key_provider: change the encryption key provider for a database
• pg_tde_archive_decrypt: decrypts WAL before archiving
• pg_tde_restore_encrypt: a custom restore command for making sure the restored WAL is encrypted

Extended tools

These existing PostgreSQL tools are enhanced to support pg_tde:

• pg_checksums: verify data checksums (non-encrypted files only)
• pg_waldump: inspect and decrypt WAL files