diff --git a/weed/command/filer.go b/weed/command/filer.go
index 0c1950f96..f5fa6d50f 100644
--- a/weed/command/filer.go
+++ b/weed/command/filer.go
@@ -70,7 +70,7 @@ var cmdFiler = &Command{
 
 	The configuration file "filer.toml" is read from ".", "$HOME/.seaweedfs/", or "/etc/seaweedfs/", in that order.
 
-	The example filer.toml configuration file can be generated by "weed scaffold filer"
+	The example filer.toml configuration file can be generated by "weed scaffold -config=filer"
 
 `,
 }
diff --git a/weed/command/filer_replication.go b/weed/command/filer_replication.go
index 3384e4023..c24f63bf0 100644
--- a/weed/command/filer_replication.go
+++ b/weed/command/filer_replication.go
@@ -28,7 +28,7 @@ var cmdFilerReplicate = &Command{
 	filer.replicate listens on filer notifications. If any file is updated, it will fetch the updated content,
 	and write to the other destination.
 
-	Run "weed scaffold -config replication" to generate a replication.toml file and customize the parameters.
+	Run "weed scaffold -config=replication" to generate a replication.toml file and customize the parameters.
 
   `,
 }
diff --git a/weed/command/master.go b/weed/command/master.go
index bd2267b9e..53c72852c 100644
--- a/weed/command/master.go
+++ b/weed/command/master.go
@@ -23,8 +23,11 @@ func init() {
 var cmdMaster = &Command{
 	UsageLine: "master -port=9333",
 	Short:     "start a master server",
-	Long: `start a master server to provide volume=>location mapping service
-  and sequence number of file ids
+	Long: `start a master server to provide volume=>location mapping service and sequence number of file ids
+
+	The configuration file "security.toml" is read from ".", "$HOME/.seaweedfs/", or "/etc/seaweedfs/", in that order.
+
+	The example security.toml configuration file can be generated by "weed scaffold -config=security"
 
   `,
 }
diff --git a/weed/command/scaffold.go b/weed/command/scaffold.go
index ec0723859..40e7437d2 100644
--- a/weed/command/scaffold.go
+++ b/weed/command/scaffold.go
@@ -19,7 +19,7 @@ var cmdScaffold = &Command{
 
 var (
 	outputPath = cmdScaffold.Flag.String("output", "", "if not empty, save the configuration file to this directory")
-	config     = cmdScaffold.Flag.String("config", "filer", "[filer|notification|replication] the configuration file to generate")
+	config     = cmdScaffold.Flag.String("config", "filer", "[filer|notification|replication|security] the configuration file to generate")
 )
 
 func runScaffold(cmd *Command, args []string) bool {
@@ -32,6 +32,8 @@ func runScaffold(cmd *Command, args []string) bool {
 		content = NOTIFICATION_TOML_EXAMPLE
 	case "replication":
 		content = REPLICATION_TOML_EXAMPLE
+	case "security":
+		content = SECURITY_TOML_EXAMPLE
 	}
 	if content == "" {
 		println("need a valid -config option")
@@ -239,5 +241,13 @@ b2_master_application_key  = ""
 bucket = "mybucket"            # an existing bucket
 directory = "/"                # destination directory
 
+`
+
+	SECURITY_TOML_EXAMPLE = `
+# this file is read by master, volume server, and filer
+
+[jwt]
+signing_key = ""
+
 `
 )