diff --git a/Makefile b/Makefile
index 5f46821f0..15118829b 100644
--- a/Makefile
+++ b/Makefile
@@ -184,6 +184,10 @@ chat2: | build deps librln
 	echo -e $(BUILD_MSG) "build/$@" && \
 		$(ENV_SCRIPT) nim chat2 $(NIM_PARAMS) $(EXPERIMENTAL_PARAMS) waku.nims
 
+rln_keystore_generator: | build deps librln
+	echo -e $(BUILD_MSG) "build/$@" && \
+		$(ENV_SCRIPT) nim rlnkeystoregenerator $(NIM_PARAMS) $(EXPERIMENTAL_PARAMS) waku.nims
+
 chat2bridge: | build deps
 	echo -e $(BUILD_MSG) "build/$@" && \
 		$(ENV_SCRIPT) nim chat2bridge $(NIM_PARAMS) waku.nims
diff --git a/tools/rln_keystore_generator/README.md b/tools/rln_keystore_generator/README.md
new file mode 100644
index 000000000..d982abf2b
--- /dev/null
+++ b/tools/rln_keystore_generator/README.md
@@ -0,0 +1,3 @@
+# rln_keystore_generator
+
+TODO!
\ No newline at end of file
diff --git a/tools/rln_keystore_generator/external_config.nim b/tools/rln_keystore_generator/external_config.nim
new file mode 100644
index 000000000..1373c38d7
--- /dev/null
+++ b/tools/rln_keystore_generator/external_config.nim
@@ -0,0 +1,66 @@
+when (NimMajor, NimMinor) < (1, 4):
+  {.push raises: [Defect].}
+else:
+  {.push raises: [].}
+
+import
+  stew/results,
+  chronos,
+  confutils,
+  confutils/defs,
+  confutils/toml/defs as confTomlDefs,
+  confutils/toml/std/net as confTomlNet,
+  libp2p/crypto/crypto,
+  libp2p/crypto/secp,
+  libp2p/multiaddress,
+  secp256k1
+import
+  ../../waku/common/confutils/envvar/defs as confEnvvarDefs,
+  ../../waku/common/confutils/envvar/std/net as confEnvvarNet
+
+export
+  confTomlDefs,
+  confTomlNet,
+  confEnvvarDefs,
+  confEnvvarNet
+
+type
+  RlnKeystoreGeneratorConf* = object
+    configFile* {.
+      desc: "Loads configuration from a TOML file (cmd-line parameters take precedence)",
+      name: "config-file" }: Option[InputFile]
+
+    execute* {.
+      desc: "Runs the registration function on-chain. By default, a dry-run will occur",
+      defaultValue: false,
+      name: "execute" .}: bool
+
+    ## General node config
+    rlnRelayCredPath* {.
+      desc: "The path for peristing rln-relay credential",
+      defaultValue: "",
+      name: "rln-relay-cred-path" }: string
+
+    rlnRelayEthClientAddress* {.
+      desc: "WebSocket address of an Ethereum testnet client e.g., ws://localhost:8540/",
+      defaultValue: "ws://localhost:8540/",
+      name: "rln-relay-eth-client-address" }: string
+
+    rlnRelayEthContractAddress* {.
+      desc: "Address of membership contract on an Ethereum testnet",
+      defaultValue: "",
+      name: "rln-relay-eth-contract-address" }: string
+
+    rlnRelayCredentialsPassword* {.
+      desc: "Password for encrypting RLN credentials",
+      defaultValue: "",
+      name: "rln-relay-cred-password" }: string
+
+proc loadConfig*(T: type RlnKeystoreGeneratorConf): Result[T, string] =
+  try:
+    let conf = RlnKeystoreGeneratorConf.load()
+    ok(conf)
+  except CatchableError:
+    err(getCurrentExceptionMsg())
+  except Exception:
+    err(getCurrentExceptionMsg())
diff --git a/tools/rln_keystore_generator/nim.cfg b/tools/rln_keystore_generator/nim.cfg
new file mode 100644
index 000000000..f3bae1590
--- /dev/null
+++ b/tools/rln_keystore_generator/nim.cfg
@@ -0,0 +1,3 @@
+-d:chronicles_line_numbers
+-d:chronicles_runtime_filtering=on
+#-d:"chronicles_enabled_topics=GossipSub:TRACE,WakuRelay:TRACE"
diff --git a/tools/rln_keystore_generator/rln_keystore_generator.nim b/tools/rln_keystore_generator/rln_keystore_generator.nim
new file mode 100644
index 000000000..3a6e2a98a
--- /dev/null
+++ b/tools/rln_keystore_generator/rln_keystore_generator.nim
@@ -0,0 +1,30 @@
+when (NimMajor, NimMinor) < (1, 4):
+  {.push raises: [Defect].}
+else:
+  {.push raises: [].}
+
+import
+  chronicles,
+  stew/[results]
+
+import
+    ./external_config
+
+logScope:
+  topics = "rln_keystore_generator"
+
+when isMainModule:
+  {.pop.}
+  let confRes = RlnKeystoreGeneratorConf.loadConfig()
+  if confRes.isErr():
+    error "failure while loading the configuration", error=confRes.error()
+    quit(1)
+
+  let conf = confRes.get()
+  
+  debug "configuration", conf = $conf
+
+  # initialize keystore
+  
+
+
diff --git a/waku.nimble b/waku.nimble
index 6f2c6e300..80e722013 100644
--- a/waku.nimble
+++ b/waku.nimble
@@ -70,6 +70,10 @@ task networkmonitor, "Build network monitor tool":
   let name = "networkmonitor"
   buildBinary name, "apps/networkmonitor/"
 
+task rln_keystore_generator, "Build the rln keystore generator":
+  let name = "rln_keystore_generator"
+  buildBinary name, "tools/rln_keystore_generator/"
+
 task test, "Build & run Waku tests":
   test "all_tests_waku"