diff --git a/generate/versioninfo.go b/generate/versioninfo.go
new file mode 100644
index 0000000..624ec5f
--- /dev/null
+++ b/generate/versioninfo.go
@@ -0,0 +1,67 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+	"text/template"
+)
+
+const Homepage = "https://github.com/yi-jiayu/secure"
+
+var tmpl = template.Must(template.New("version.go").Parse(`//go:generate go run generate/versioninfo.go
+// Code generated by versioninfo.go; DO NOT EDIT.
+
+package main
+
+const Version = "secure {{ .Version }} ({{ .GOOS }}-{{ .GOARCH }}) {{ .GoVersion }}\n{{ .Homepage }}"
+`))
+
+type VersionInfo struct {
+	Version   string
+	GOOS      string
+	GOARCH    string
+	GoVersion string
+	Homepage  string
+}
+
+func main() {
+	describeCmd := exec.Command("git", "describe", "--tags", "--always")
+	version, err := describeCmd.Output()
+	if err != nil {
+		log.Fatal(fmt.Errorf("error describing commit: %v", err))
+	}
+
+	goos := os.Getenv("GOOS")
+	if goos == "" {
+		goos = runtime.GOOS
+	}
+
+	goarch := os.Getenv("GOARCH")
+	if goarch == "" {
+		goarch = runtime.GOARCH
+	}
+
+	goVersion := runtime.Version()
+
+	vi := VersionInfo{
+		Version:   strings.TrimSpace(string(version)),
+		GOARCH:    goarch,
+		GOOS:      goos,
+		GoVersion: goVersion,
+		Homepage:  Homepage,
+	}
+
+	f, err := os.Create("version.go")
+	if err != nil {
+		log.Fatal(fmt.Errorf("error creating version.go: %v", err))
+	}
+
+	err = tmpl.Execute(f, vi)
+	if err != nil {
+		log.Fatal(fmt.Errorf("error executing template: %v", err))
+	}
+}
diff --git a/main.go b/main.go
index 383aac1..81ecf97 100644
--- a/main.go
+++ b/main.go
@@ -20,16 +20,18 @@ var (
 	keyFile  string
 	upstream string
 	addr     string
+	version  bool
 )
 
 func init() {
 	flag.StringVar(&addr, "addr", ":443", "listen address")
 	flag.StringVar(&certFile, "cert", "", "path to cert file")
 	flag.StringVar(&keyFile, "key", "", "path to key file")
+	flag.BoolVar(&version, "version", false, "print version string and exit")
 
 	flag.Usage = func() {
 		fmt.Fprintf(flag.CommandLine.Output(),
-			"usage: %s [-addr host:port] -cert certfile -key keyfile upstream\n",
+			"usage: %s [-addr host:port] -cert certfile -key keyfile [-version] upstream\n",
 			filepath.Base(os.Args[0]))
 		flag.PrintDefaults()
 		fmt.Fprintln(flag.CommandLine.Output(), "  upstream string\n    \tupstream url")
@@ -39,6 +41,11 @@ func init() {
 func _main() error {
 	flag.Parse()
 
+	if version {
+		fmt.Fprintln(flag.CommandLine.Output(), Version)
+		os.Exit(0)
+	}
+
 	if flag.NArg() == 1 {
 		upstream = flag.Arg(0)
 	} else {
diff --git a/version.go b/version.go
new file mode 100644
index 0000000..67d0a17
--- /dev/null
+++ b/version.go
@@ -0,0 +1,6 @@
+//go:generate go run generate/versioninfo.go
+// Code generated by versioninfo.go; DO NOT EDIT.
+
+package main
+
+const Version = "secure v0.1.0 (windows-amd64) go1.10\nhttps://github.com/yi-jiayu/secure"