diff --git a/doc/bash-completion.sh b/doc/bash-completion.sh
index fd3b6565e..11806685f 100644
--- a/doc/bash-completion.sh
+++ b/doc/bash-completion.sh
@@ -275,6 +275,7 @@ _restic_backup()
     flags+=("-h")
     local_nonpersistent_flags+=("--help")
     flags+=("--host=")
+    two_word_flags+=("-H")
     local_nonpersistent_flags+=("--host=")
     flags+=("--one-file-system")
     flags+=("-x")
@@ -295,12 +296,14 @@ _restic_backup()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -343,12 +346,14 @@ _restic_cache()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -385,12 +390,14 @@ _restic_cat()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -435,12 +442,14 @@ _restic_check()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -479,12 +488,14 @@ _restic_diff()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -528,12 +539,14 @@ _restic_dump()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -600,12 +613,14 @@ _restic_find()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -681,12 +696,14 @@ _restic_forget()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -729,12 +746,14 @@ _restic_generate()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -771,12 +790,14 @@ _restic_init()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -815,12 +836,14 @@ _restic_key()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -857,12 +880,14 @@ _restic_list()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -911,12 +936,14 @@ _restic_ls()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -956,12 +983,14 @@ _restic_migrate()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1001,6 +1030,8 @@ _restic_mount()
     flags+=("--host=")
     two_word_flags+=("-H")
     local_nonpersistent_flags+=("--host=")
+    flags+=("--no-default-permissions")
+    local_nonpersistent_flags+=("--no-default-permissions")
     flags+=("--owner-root")
     local_nonpersistent_flags+=("--owner-root")
     flags+=("--path=")
@@ -1013,12 +1044,14 @@ _restic_mount()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1055,12 +1088,14 @@ _restic_prune()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1097,12 +1132,58 @@ _restic_rebuild-index()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
+    flags+=("--password-file=")
+    two_word_flags+=("-p")
+    flags+=("--quiet")
+    flags+=("-q")
+    flags+=("--repo=")
+    two_word_flags+=("-r")
+    flags+=("--tls-client-cert=")
+    flags+=("--verbose")
+    flags+=("-v")
+
+    must_have_one_flag=()
+    must_have_one_noun=()
+    noun_aliases=()
+}
+
+_restic_recover()
+{
+    last_command="restic_recover"
+
+    command_aliases=()
+
+    commands=()
+
+    flags=()
+    two_word_flags=()
+    local_nonpersistent_flags=()
+    flags_with_completion=()
+    flags_completion=()
+
+    flags+=("--help")
+    flags+=("-h")
+    local_nonpersistent_flags+=("--help")
+    flags+=("--cacert=")
+    flags+=("--cache-dir=")
+    flags+=("--cleanup-cache")
+    flags+=("--json")
+    flags+=("--key-hint=")
+    flags+=("--limit-download=")
+    flags+=("--limit-upload=")
+    flags+=("--no-cache")
+    flags+=("--no-lock")
+    flags+=("--option=")
+    two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1157,12 +1238,14 @@ _restic_restore()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1201,12 +1284,14 @@ _restic_self-update()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1255,12 +1340,14 @@ _restic_snapshots()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1294,6 +1381,7 @@ _restic_stats()
     flags+=("-h")
     local_nonpersistent_flags+=("--help")
     flags+=("--host=")
+    two_word_flags+=("-H")
     local_nonpersistent_flags+=("--host=")
     flags+=("--mode=")
     local_nonpersistent_flags+=("--mode=")
@@ -1301,12 +1389,14 @@ _restic_stats()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1356,12 +1446,14 @@ _restic_tag()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1400,12 +1492,14 @@ _restic_unlock()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1442,12 +1536,14 @@ _restic_version()
     flags+=("--cache-dir=")
     flags+=("--cleanup-cache")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
@@ -1487,6 +1583,7 @@ _restic_root_command()
     commands+=("mount")
     commands+=("prune")
     commands+=("rebuild-index")
+    commands+=("recover")
     commands+=("restore")
     commands+=("self-update")
     commands+=("snapshots")
@@ -1508,12 +1605,14 @@ _restic_root_command()
     flags+=("-h")
     local_nonpersistent_flags+=("--help")
     flags+=("--json")
+    flags+=("--key-hint=")
     flags+=("--limit-download=")
     flags+=("--limit-upload=")
     flags+=("--no-cache")
     flags+=("--no-lock")
     flags+=("--option=")
     two_word_flags+=("-o")
+    flags+=("--password-command=")
     flags+=("--password-file=")
     two_word_flags+=("-p")
     flags+=("--quiet")
diff --git a/doc/man/restic-backup.1 b/doc/man/restic-backup.1
index 5d052e066..7feae2a20 100644
--- a/doc/man/restic-backup.1
+++ b/doc/man/restic-backup.1
@@ -37,8 +37,8 @@ given as the arguments.
     takes filename[:header], exclude contents of directories containing filename (except filename itself) if header of that file is as provided (can be specified multiple times)
 
 .PP
-\fB\-\-files\-from\fP=""
-    read the files to backup from file (can be combined with file args)
+\fB\-\-files\-from\fP=[]
+    read the files to backup from file (can be combined with file args/can be specified multiple times)
 
 .PP
 \fB\-f\fP, \fB\-\-force\fP[=false]
@@ -49,7 +49,7 @@ given as the arguments.
     help for backup
 
 .PP
-\fB\-\-host\fP="H"
+\fB\-H\fP, \fB\-\-host\fP=""
     set the \fB\fChostname\fR for the snapshot manually. To prevent an expensive rescan use the "parent" flag
 
 .PP
@@ -98,6 +98,10 @@ given as the arguments.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -118,6 +122,10 @@ given as the arguments.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-cache.1 b/doc/man/restic-cache.1
index 2777c9e04..007e88eb6 100644
--- a/doc/man/restic-cache.1
+++ b/doc/man/restic-cache.1
@@ -53,6 +53,10 @@ The "cache" command allows listing and cleaning local cache directories.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -73,6 +77,10 @@ The "cache" command allows listing and cleaning local cache directories.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-cat.1 b/doc/man/restic-cat.1
index 7bbe6408b..7f586cb9a 100644
--- a/doc/man/restic-cat.1
+++ b/doc/man/restic-cat.1
@@ -41,6 +41,10 @@ The "cat" command is used to print internal objects to stdout.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -61,6 +65,10 @@ The "cat" command is used to print internal objects to stdout.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-check.1 b/doc/man/restic-check.1
index 4d875a03a..d5047306a 100644
--- a/doc/man/restic-check.1
+++ b/doc/man/restic-check.1
@@ -62,6 +62,10 @@ repository and not use a local cache.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -82,6 +86,10 @@ repository and not use a local cache.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-diff.1 b/doc/man/restic-diff.1
index 0e134fb93..9bd147412 100644
--- a/doc/man/restic-diff.1
+++ b/doc/man/restic-diff.1
@@ -61,6 +61,10 @@ T  The type was changed, e.g. a file was made a symlink
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -81,6 +85,10 @@ T  The type was changed, e.g. a file was made a symlink
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-dump.1 b/doc/man/restic-dump.1
index fbec30314..fac6a06fc 100644
--- a/doc/man/restic-dump.1
+++ b/doc/man/restic-dump.1
@@ -58,6 +58,10 @@ repository.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -78,6 +82,10 @@ repository.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-find.1 b/doc/man/restic-find.1
index 9bdcfb5dc..dd4f6bf0f 100644
--- a/doc/man/restic-find.1
+++ b/doc/man/restic-find.1
@@ -91,6 +91,10 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -111,6 +115,10 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-forget.1 b/doc/man/restic-forget.1
index 9cde3cdc1..17e79f336 100644
--- a/doc/man/restic-forget.1
+++ b/doc/man/restic-forget.1
@@ -48,7 +48,7 @@ data after 'forget' was run successfully, see the 'prune' command.
 
 .PP
 \fB\-\-keep\-within\fP=
-    keep snapshots that are older than \fB\fCduration\fR (eg. 1y5m7d) relative to the latest snapshot
+    keep snapshots that are newer than \fB\fCduration\fR (eg. 1y5m7d2h) relative to the latest snapshot
 
 .PP
 \fB\-\-keep\-tag\fP=[]
@@ -104,6 +104,10 @@ data after 'forget' was run successfully, see the 'prune' command.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -124,6 +128,10 @@ data after 'forget' was run successfully, see the 'prune' command.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-generate.1 b/doc/man/restic-generate.1
index 59205d6be..91c963152 100644
--- a/doc/man/restic-generate.1
+++ b/doc/man/restic-generate.1
@@ -54,6 +54,10 @@ and the auto\-completion files for bash and zsh).
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -74,6 +78,10 @@ and the auto\-completion files for bash and zsh).
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-init.1 b/doc/man/restic-init.1
index d39b9c637..f459ce0a0 100644
--- a/doc/man/restic-init.1
+++ b/doc/man/restic-init.1
@@ -41,6 +41,10 @@ The "init" command initializes a new repository.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -61,6 +65,10 @@ The "init" command initializes a new repository.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-key.1 b/doc/man/restic-key.1
index d1d3e280d..950683c18 100644
--- a/doc/man/restic-key.1
+++ b/doc/man/restic-key.1
@@ -45,6 +45,10 @@ The "key" command manages keys (passwords) for accessing the repository.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -65,6 +69,10 @@ The "key" command manages keys (passwords) for accessing the repository.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-list.1 b/doc/man/restic-list.1
index c2decd32a..4f50db46e 100644
--- a/doc/man/restic-list.1
+++ b/doc/man/restic-list.1
@@ -41,6 +41,10 @@ The "list" command allows listing objects in the repository based on type.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -61,6 +65,10 @@ The "list" command allows listing objects in the repository based on type.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-ls.1 b/doc/man/restic-ls.1
index 8ff744f82..e838ca1ac 100644
--- a/doc/man/restic-ls.1
+++ b/doc/man/restic-ls.1
@@ -76,6 +76,10 @@ a path separator); paths use the forward slash '/' as separator.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -96,6 +100,10 @@ a path separator); paths use the forward slash '/' as separator.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-migrate.1 b/doc/man/restic-migrate.1
index f52600f03..24b577b9e 100644
--- a/doc/man/restic-migrate.1
+++ b/doc/man/restic-migrate.1
@@ -46,6 +46,10 @@ name is explicitly given, a list of migrations that can be applied is printed.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -66,6 +70,10 @@ name is explicitly given, a list of migrations that can be applied is printed.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-mount.1 b/doc/man/restic-mount.1
index dd58c7044..58e3bc7b3 100644
--- a/doc/man/restic-mount.1
+++ b/doc/man/restic-mount.1
@@ -68,6 +68,10 @@ For details please see the documentation for time.Format() at:
 \fB\-H\fP, \fB\-\-host\fP=""
     only consider snapshots for this host
 
+.PP
+\fB\-\-no\-default\-permissions\fP[=false]
+    for 'allow\-other', ignore Unix permissions and allow users to read all snapshot files
+
 .PP
 \fB\-\-owner\-root\fP[=false]
     use 'root' as the owner of files and dirs
@@ -102,6 +106,10 @@ For details please see the documentation for time.Format() at:
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -122,6 +130,10 @@ For details please see the documentation for time.Format() at:
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-prune.1 b/doc/man/restic-prune.1
index be884d698..2089fddc8 100644
--- a/doc/man/restic-prune.1
+++ b/doc/man/restic-prune.1
@@ -42,6 +42,10 @@ referenced and therefore not needed any more.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -62,6 +66,10 @@ referenced and therefore not needed any more.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-rebuild-index.1 b/doc/man/restic-rebuild-index.1
index edf475169..d82e70f2c 100644
--- a/doc/man/restic-rebuild-index.1
+++ b/doc/man/restic-rebuild-index.1
@@ -42,6 +42,10 @@ repository.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -62,6 +66,10 @@ repository.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-recover.1 b/doc/man/restic-recover.1
new file mode 100644
index 000000000..6d25566b6
--- /dev/null
+++ b/doc/man/restic-recover.1
@@ -0,0 +1,97 @@
+.TH "restic backup" "1" "Jan 2017" "generated by `restic generate`" "" 
+.nh
+.ad l
+
+
+.SH NAME
+.PP
+restic\-recover \- Recover data from the repository
+
+
+.SH SYNOPSIS
+.PP
+\fBrestic recover [flags]\fP
+
+
+.SH DESCRIPTION
+.PP
+The "recover" command build a new snapshot from all directories it can find in
+the raw data of the repository. It can be used if, for example, a snapshot has
+been removed by accident with "forget".
+
+
+.SH OPTIONS
+.PP
+\fB\-h\fP, \fB\-\-help\fP[=false]
+    help for recover
+
+
+.SH OPTIONS INHERITED FROM PARENT COMMANDS
+.PP
+\fB\-\-cacert\fP=[]
+    \fB\fCfile\fR to load root certificates from (default: use system certificates)
+
+.PP
+\fB\-\-cache\-dir\fP=""
+    set the cache directory. (default: use system default cache directory)
+
+.PP
+\fB\-\-cleanup\-cache\fP[=false]
+    auto remove old cache directories
+
+.PP
+\fB\-\-json\fP[=false]
+    set output mode to JSON for commands that support it
+
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
+.PP
+\fB\-\-limit\-download\fP=0
+    limits downloads to a maximum rate in KiB/s. (default: unlimited)
+
+.PP
+\fB\-\-limit\-upload\fP=0
+    limits uploads to a maximum rate in KiB/s. (default: unlimited)
+
+.PP
+\fB\-\-no\-cache\fP[=false]
+    do not use a local cache
+
+.PP
+\fB\-\-no\-lock\fP[=false]
+    do not lock the repo, this allows some operations on read\-only repos
+
+.PP
+\fB\-o\fP, \fB\-\-option\fP=[]
+    set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
+.PP
+\fB\-p\fP, \fB\-\-password\-file\fP=""
+    read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
+
+.PP
+\fB\-q\fP, \fB\-\-quiet\fP[=false]
+    do not output comprehensive progress report
+
+.PP
+\fB\-r\fP, \fB\-\-repo\fP=""
+    repository to backup to or restore from (default: $RESTIC\_REPOSITORY)
+
+.PP
+\fB\-\-tls\-client\-cert\fP=""
+    path to a file containing PEM encoded TLS client certificate and private key
+
+.PP
+\fB\-v\fP, \fB\-\-verbose\fP[=0]
+    be verbose (specify \-\-verbose multiple times or level \fB\fCn\fR)
+
+
+.SH SEE ALSO
+.PP
+\fBrestic(1)\fP
diff --git a/doc/man/restic-restore.1 b/doc/man/restic-restore.1
index 54b8acd8c..8ea55a5fb 100644
--- a/doc/man/restic-restore.1
+++ b/doc/man/restic-restore.1
@@ -74,6 +74,10 @@ repository.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -94,6 +98,10 @@ repository.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-self-update.1 b/doc/man/restic-self-update.1
index caa58208b..1c221cd70 100644
--- a/doc/man/restic-self-update.1
+++ b/doc/man/restic-self-update.1
@@ -15,7 +15,7 @@ restic\-self\-update \- Update the restic binary
 
 .SH DESCRIPTION
 .PP
-The command "update\-restic" downloads the latest stable release of restic from
+The command "self\-update" downloads the latest stable release of restic from
 GitHub and replaces the currently running binary. After download, the
 authenticity of the binary is verified using the GPG signature on the release
 files.
@@ -27,8 +27,8 @@ files.
     help for self\-update
 
 .PP
-\fB\-\-output\fP="./restic\-generate.temp"
-    Save the downloaded file as \fB\fCfilename\fR
+\fB\-\-output\fP=""
+    Save the downloaded file as \fB\fCfilename\fR (default: running binary itself)
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
@@ -48,6 +48,10 @@ files.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -68,6 +72,10 @@ files.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-snapshots.1 b/doc/man/restic-snapshots.1
index c69c6d059..b43c6eb3b 100644
--- a/doc/man/restic-snapshots.1
+++ b/doc/man/restic-snapshots.1
@@ -61,6 +61,10 @@ The "snapshots" command lists all snapshots stored in the repository.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -81,6 +85,10 @@ The "snapshots" command lists all snapshots stored in the repository.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-stats.1 b/doc/man/restic-stats.1
index fcbfaae75..f9578c38b 100644
--- a/doc/man/restic-stats.1
+++ b/doc/man/restic-stats.1
@@ -52,7 +52,7 @@ Refer to the online manual for more details about each mode.
     help for stats
 
 .PP
-\fB\-\-host\fP="H"
+\fB\-H\fP, \fB\-\-host\fP=""
     filter latest snapshot by this hostname
 
 .PP
@@ -77,6 +77,10 @@ Refer to the online manual for more details about each mode.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -97,6 +101,10 @@ Refer to the online manual for more details about each mode.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-tag.1 b/doc/man/restic-tag.1
index 1cd78d04f..c7e8ddbf1 100644
--- a/doc/man/restic-tag.1
+++ b/doc/man/restic-tag.1
@@ -72,6 +72,10 @@ When no snapshot\-ID is given, all snapshots matching the host, tag and path fil
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -92,6 +96,10 @@ When no snapshot\-ID is given, all snapshots matching the host, tag and path fil
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-unlock.1 b/doc/man/restic-unlock.1
index 5116587d8..10e3b51ff 100644
--- a/doc/man/restic-unlock.1
+++ b/doc/man/restic-unlock.1
@@ -45,6 +45,10 @@ The "unlock" command removes stale locks that have been created by other restic
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -65,6 +69,10 @@ The "unlock" command removes stale locks that have been created by other restic
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic-version.1 b/doc/man/restic-version.1
index ba764c992..d107cf618 100644
--- a/doc/man/restic-version.1
+++ b/doc/man/restic-version.1
@@ -42,6 +42,10 @@ and the version of this software.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -62,6 +66,10 @@ and the version of this software.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
diff --git a/doc/man/restic.1 b/doc/man/restic.1
index 004ad78d1..8a483df4f 100644
--- a/doc/man/restic.1
+++ b/doc/man/restic.1
@@ -40,6 +40,10 @@ directories in an encrypted repository stored on different backends.
 \fB\-\-json\fP[=false]
     set output mode to JSON for commands that support it
 
+.PP
+\fB\-\-key\-hint\fP=""
+    key ID of key to try decrypting first (default: $RESTIC\_KEY\_HINT)
+
 .PP
 \fB\-\-limit\-download\fP=0
     limits downloads to a maximum rate in KiB/s. (default: unlimited)
@@ -60,6 +64,10 @@ directories in an encrypted repository stored on different backends.
 \fB\-o\fP, \fB\-\-option\fP=[]
     set extended option (\fB\fCkey=value\fR, can be specified multiple times)
 
+.PP
+\fB\-\-password\-command\fP=""
+    specify a shell command to obtain a password (default: $RESTIC\_PASSWORD\_COMMAND)
+
 .PP
 \fB\-p\fP, \fB\-\-password\-file\fP=""
     read the repository password from a file (default: $RESTIC\_PASSWORD\_FILE)
@@ -83,4 +91,4 @@ directories in an encrypted repository stored on different backends.
 
 .SH SEE ALSO
 .PP
-\fBrestic\-backup(1)\fP, \fBrestic\-cache(1)\fP, \fBrestic\-cat(1)\fP, \fBrestic\-check(1)\fP, \fBrestic\-diff(1)\fP, \fBrestic\-dump(1)\fP, \fBrestic\-find(1)\fP, \fBrestic\-forget(1)\fP, \fBrestic\-generate(1)\fP, \fBrestic\-init(1)\fP, \fBrestic\-key(1)\fP, \fBrestic\-list(1)\fP, \fBrestic\-ls(1)\fP, \fBrestic\-migrate(1)\fP, \fBrestic\-mount(1)\fP, \fBrestic\-prune(1)\fP, \fBrestic\-rebuild\-index(1)\fP, \fBrestic\-restore(1)\fP, \fBrestic\-self\-update(1)\fP, \fBrestic\-snapshots(1)\fP, \fBrestic\-stats(1)\fP, \fBrestic\-tag(1)\fP, \fBrestic\-unlock(1)\fP, \fBrestic\-version(1)\fP
+\fBrestic\-backup(1)\fP, \fBrestic\-cache(1)\fP, \fBrestic\-cat(1)\fP, \fBrestic\-check(1)\fP, \fBrestic\-diff(1)\fP, \fBrestic\-dump(1)\fP, \fBrestic\-find(1)\fP, \fBrestic\-forget(1)\fP, \fBrestic\-generate(1)\fP, \fBrestic\-init(1)\fP, \fBrestic\-key(1)\fP, \fBrestic\-list(1)\fP, \fBrestic\-ls(1)\fP, \fBrestic\-migrate(1)\fP, \fBrestic\-mount(1)\fP, \fBrestic\-prune(1)\fP, \fBrestic\-rebuild\-index(1)\fP, \fBrestic\-recover(1)\fP, \fBrestic\-restore(1)\fP, \fBrestic\-self\-update(1)\fP, \fBrestic\-snapshots(1)\fP, \fBrestic\-stats(1)\fP, \fBrestic\-tag(1)\fP, \fBrestic\-unlock(1)\fP, \fBrestic\-version(1)\fP
diff --git a/doc/zsh-completion.zsh b/doc/zsh-completion.zsh
index d9cccd048..7595387d2 100644
--- a/doc/zsh-completion.zsh
+++ b/doc/zsh-completion.zsh
@@ -7,7 +7,7 @@ case $state in
   level1)
     case $words[1] in
       restic)
-        _arguments '1: :(backup cache cat check diff dump find forget generate help init key list ls migrate mount options prune rebuild-index restore self-update snapshots stats tag unlock version)'
+        _arguments '1: :(backup cache cat check diff dump find forget generate help init key list ls migrate mount options prune rebuild-index recover restore self-update snapshots stats tag unlock version)'
       ;;
       *)
         _arguments '*: :_files'