diff --git a/src/cmd/turnkey/pkg/decrypt.go b/src/cmd/turnkey/pkg/decrypt.go
index 2ebac32..b6ef942 100644
--- a/src/cmd/turnkey/pkg/decrypt.go
+++ b/src/cmd/turnkey/pkg/decrypt.go
@@ -2,6 +2,7 @@ package pkg
 
 import (
 	"crypto/ecdsa"
+	"encoding/hex"
 
 	"github.com/rotisserie/eris"
 	"github.com/spf13/cobra"
@@ -15,12 +16,16 @@ var (
 
 	// EncryptionKeypair is the loaded Encryption Keypair.
 	EncryptionKeypair *encryptionkey.Key
+
+	// Controls whether output is UTF-8 string or hex string
+	hexOutput bool
 )
 
 func init() {
 	decryptCmd.Flags().StringVar(&exportBundlePath, "export-bundle-input", "", "filepath to read the export bundle from.")
 	decryptCmd.Flags().StringVar(&plaintextPath, "plaintext-output", "", "optional filepath to write the plaintext from that will be decrypted.")
 	decryptCmd.Flags().StringVar(&signerPublicKeyOverride, "signer-quorum-key", "", "optional override for the signer quorum key. This option should be used for testing only. Leave this value empty for production decryptions.")
+	decryptCmd.Flags().BoolVar(&hexOutput, "hex-output", false, "when true, outputs as hex-encoded string (useful for binary data like private keys); when false (default), outputs as UTF-8 text (suitable for mnemonics and text)")
 
 	rootCmd.AddCommand(decryptCmd)
 }
@@ -74,7 +79,12 @@ var decryptCmd = &cobra.Command{
 			OutputError(err)
 		}
 
-		plaintext := string(plaintextBytes)
+		var plaintext string
+		if hexOutput {
+			plaintext = hex.EncodeToString(plaintextBytes)
+		} else {
+			plaintext = string(plaintextBytes)
+		}
 
 		// output the plaintext if no filepath is passed
 		if plaintextPath == "" {