diff --git a/docs/usage/self-hosted-configuration.md b/docs/usage/self-hosted-configuration.md
index b1036d487c529fbd93f031f20f220748ad05ae7a..bde2700322f2cd0cf800155929d9a333b98624e6 100644
--- a/docs/usage/self-hosted-configuration.md
+++ b/docs/usage/self-hosted-configuration.md
@@ -119,6 +119,15 @@ This option is useful for troubleshooting, particularly if using presets. e.g. r
 
 ## privateKey
 
+This private key is used to decrypt config files.
+
+The corresponding public key can be used to create encrypted values for config files. If you want a simple UI to encrypt values you can put the public key in a HTML page similar to <https://renovatebot.com/encrypt>.
+
+To create the key pair with openssl use the following commands:
+
+- `openssl genrsa -out rsa_priv.pem 4096` for generating the private key
+- `openssl rsa -pubout -in rsa_priv.pem -out rsa_pub.pem` for extracting the public key
+
 ## productLinks
 
 Override this object if you wish to change the URLs that Renovate links to, e.g. if you have an internal forum for asking for help.