diff --git a/bash-completion/p11-kit b/bash-completion/p11-kit
index 00dd694c..94ebd0fa 100644
--- a/bash-completion/p11-kit
+++ b/bash-completion/p11-kit
@@ -10,7 +10,7 @@ _p11-kit()
         COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
         return
     elif [[ $cword -eq 1 ]]; then
-        local commands='generate-keypair export-object delete-object list-objects add-profile delete-profile list-profiles list-modules print-config extract server remote'
+        local commands='list-mechanisms generate-keypair export-object delete-object list-objects add-profile delete-profile list-profiles list-modules print-config extract server remote'
         COMPREPLY=( $(compgen -W "$commands" -- "$cur") )
     fi
 } &&
diff --git a/doc/manual/p11-kit.xml b/doc/manual/p11-kit.xml
index b323d1c3..bb27640f 100644
--- a/doc/manual/p11-kit.xml
+++ b/doc/manual/p11-kit.xml
@@ -53,6 +53,9 @@
 	<cmdsynopsis>
 		<command>p11-kit delete-profile</command> ...
 	</cmdsynopsis>
+	<cmdsynopsis>
+		<command>p11-kit list-mechanisms</command> ...
+	</cmdsynopsis>
 	<cmdsynopsis>
 		<command>p11-kit print-config</command>
 	</cmdsynopsis>
@@ -222,6 +225,19 @@ $ p11-kit delete-profile --profile profile pkcs11:token
 
 </refsect1>
 
+<refsect1 id="p11-kit-list-mechanisms">
+	<title>List Mechanisms</title>
+
+	<para>List PKCS#11 mechanisms supported by the token.</para>
+
+<programlisting>
+$ p11-kit list-mechanisms pkcs11:token
+</programlisting>
+
+	<para>This lists all available mechanimsms for a PKCS#11 token</para>
+
+</refsect1>
+
 <refsect1 id="p11-kit-print-config">
 	<title>Print Config</title>
 
diff --git a/p11-kit/Makefile.am b/p11-kit/Makefile.am
index 4cdc51b6..47f9ed26 100644
--- a/p11-kit/Makefile.am
+++ b/p11-kit/Makefile.am
@@ -270,6 +270,7 @@ p11_kit_p11_kit_SOURCES = \
 	p11-kit/generate-keypair.c \
 	p11-kit/list-objects.c \
 	p11-kit/list-profiles.c \
+	p11-kit/list-mechanisms.c \
 	p11-kit/lists.c \
 	p11-kit/p11-kit.c \
 	p11-kit/print-config.c \
@@ -301,6 +302,7 @@ p11_kit_p11_kit_testable_SOURCES = \
 	p11-kit/generate-keypair.c \
 	p11-kit/list-objects.c \
 	p11-kit/list-profiles.c \
+	p11-kit/list-mechanisms.c \
 	p11-kit/lists.c \
 	p11-kit/p11-kit.c \
 	p11-kit/print-config.c \
@@ -425,6 +427,7 @@ sh_tests += \
 	p11-kit/test-objects.sh \
 	p11-kit/test-lists.sh \
 	p11-kit/test-server.sh \
+	p11-kit/test-list-mechanisms.sh \
 	$(NULL)
 
 if WITH_ASN1
@@ -618,4 +621,5 @@ EXTRA_DIST += \
 	p11-kit/test-messages.sh \
 	p11-kit/test-server.sh \
 	p11-kit/test-export-public.sh \
+	p11-kit/test-list-mechanisms.sh \
 	$(NULL)
diff --git a/p11-kit/list-mechanisms.c b/p11-kit/list-mechanisms.c
new file mode 100644
index 00000000..07b5f52d
--- /dev/null
+++ b/p11-kit/list-mechanisms.c
@@ -0,0 +1,281 @@
+/*
+ * Copyright (c) 2023, Red Hat Inc.
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *     * Redistributions of source code must retain the above
+ *       copyright notice, this list of conditions and the
+ *       following disclaimer.
+ *     * Redistributions in binary form must reproduce the
+ *       above copyright notice, this list of conditions and
+ *       the following disclaimer in the documentation and/or
+ *       other materials provided with the distribution.
+ *     * The names of contributors to this software may not be
+ *       used to endorse or promote products derived from this
+ *       software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ * Author: Alexander Sosedkin <asosedkin@redhat.com>
+ */
+
+#include "config.h"
+
+#include "constants.h"
+#define P11_DEBUG_FLAG P11_DEBUG_TOOL
+#include "debug.h"
+#include "iter.h"
+#include "message.h"
+#include "pkcs11.h"
+#include "print.h"
+#include "tool.h"
+#include "uri.h"
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#ifdef ENABLE_NLS
+#include <libintl.h>
+#define _(x) dgettext(PACKAGE_NAME, x)
+#else
+#define _(x) (x)
+#endif
+
+int
+p11_kit_list_mechanisms (int argc,
+		         char *argv[]);
+
+static void
+print_mechanism_with_info (CK_MECHANISM_TYPE mechanism,
+		           CK_MECHANISM_INFO info)
+{
+	const char *mechanism_nick = NULL;
+
+	mechanism_nick = p11_constant_nick (p11_constant_mechanisms, mechanism);
+	if (mechanism_nick == NULL)
+		printf ("0x%lX (unknown):", mechanism);
+	else
+		printf ("%s:", mechanism_nick);
+
+	if (info.flags & CKF_HW)
+		printf (" hw");
+	if (info.flags & CKF_MESSAGE_ENCRYPT)
+		printf (" message-encrypt");
+	if (info.flags & CKF_MESSAGE_DECRYPT)
+		printf (" message-decrypt");
+	if (info.flags & CKF_MESSAGE_SIGN)
+		printf (" message-sign");
+	if (info.flags & CKF_MESSAGE_VERIFY)
+		printf (" message-verify");
+	if (info.flags & CKF_MULTI_MESSAGE)
+		printf (" multi-message");
+	if (info.flags & CKF_FIND_OBJECTS)
+		printf (" find-objects");
+	if (info.flags & CKF_ENCRYPT)
+		printf (" encrypt");
+	if (info.flags & CKF_DECRYPT)
+		printf (" decrypt");
+	if (info.flags & CKF_DIGEST)
+		printf (" digest");
+	if (info.flags & CKF_SIGN)
+		printf (" sign");
+	if (info.flags & CKF_SIGN_RECOVER)
+		printf (" sign-recover");
+	if (info.flags & CKF_VERIFY)
+		printf (" verify");
+	if (info.flags & CKF_SIGN_RECOVER)
+		printf (" verify-recover");
+	if (info.flags & CKF_GENERATE)
+		printf (" generate");
+	if (info.flags & CKF_GENERATE_KEY_PAIR)
+		printf (" generate-key-pair");
+	if (info.flags & CKF_WRAP)
+		printf (" wrap");
+	if (info.flags & CKF_UNWRAP)
+		printf (" unwrap");
+	if (info.flags & CKF_DERIVE)
+		printf (" derive");
+	if (info.flags & CKF_EXTENSION)
+		printf (" extension");
+
+	if (info.ulMaxKeySize)
+		printf (" key-size=%lu-%lu", info.ulMinKeySize, info.ulMaxKeySize);
+	printf ("\n");
+}
+
+static int
+list_mechanisms (const char *token_str)
+{
+	int ret = 1;
+	CK_FUNCTION_LIST **modules = NULL;
+	CK_FUNCTION_LIST *module = NULL;
+	P11KitUri *uri = NULL;
+	P11KitIter *iter = NULL;
+	CK_SESSION_HANDLE session = 0;
+	CK_SLOT_ID slot = 0;
+	CK_TOKEN_INFO token_info;
+	CK_MECHANISM_INFO mechanism_info;
+	CK_MECHANISM_TYPE_PTR mechanisms = NULL;
+	CK_MECHANISM_TYPE_PTR mechanisms_new = NULL;
+	unsigned long mechanisms_count = 0;
+	unsigned long i;
+	p11_list_printer printer;
+	CK_RV rv;
+
+	uri = p11_kit_uri_new ();
+	if (uri == NULL) {
+		p11_message (_("failed to allocate memory"));
+		goto cleanup;
+	}
+
+	if (p11_kit_uri_parse (token_str, P11_KIT_URI_FOR_TOKEN, uri) != P11_KIT_URI_OK) {
+		p11_message (_("failed to parse URI"));
+		goto cleanup;
+	}
+
+	modules = p11_kit_modules_load_and_initialize (0);
+	if (modules == NULL) {
+		p11_message (_("failed to load and initialize modules"));
+		goto cleanup;
+	}
+
+	iter = p11_kit_iter_new (uri, P11_KIT_ITER_WITH_LOGIN | P11_KIT_ITER_WITH_TOKENS | P11_KIT_ITER_WITHOUT_OBJECTS);
+	if (iter == NULL) {
+		p11_debug ("failed to initialize iterator");
+		goto cleanup;
+	}
+
+	p11_list_printer_init (&printer, stdout, 0);
+	p11_kit_iter_begin (iter, modules);
+	rv = p11_kit_iter_next (iter);  // we will stop at the first token
+	if (rv == CKR_OK) {
+		module = p11_kit_iter_get_module (iter);
+		if (module == NULL) {
+			p11_message (_("failed to obtain module"));
+			goto cleanup;
+		}
+
+		slot = p11_kit_iter_get_slot (iter);
+
+		rv = module->C_GetTokenInfo (slot, &token_info);
+		if (rv != CKR_OK) {
+			p11_message (_("couldn't load token info: %s"), p11_kit_strerror (rv));
+			goto cleanup;
+		}
+
+		rv = module->C_GetMechanismList (slot, NULL, &mechanisms_count);
+		if (rv != CKR_OK) {
+			p11_message (_("querying amount of mechanisms failed: %s"), p11_kit_strerror (rv));
+			goto cleanup;
+		}
+
+		mechanisms_new = reallocarray (mechanisms, mechanisms_count, sizeof (CK_MECHANISM_TYPE));
+		if (mechanisms_new == NULL) {
+			p11_message (_("failed to allocate memory"));
+			goto cleanup;
+		}
+		mechanisms = mechanisms_new;
+
+		rv = module->C_GetMechanismList (slot, mechanisms, &mechanisms_count);
+		if (rv != CKR_OK) {
+			p11_message (_("querying mechanisms failed: %s"), p11_kit_strerror (rv));
+			goto cleanup;
+		}
+
+		for (i = 0; i < mechanisms_count; i++) {
+			rv = module->C_GetMechanismInfo (slot, mechanisms[i], &mechanism_info);
+			if (rv != CKR_OK) {
+				p11_message (_("querying mechanism info failed: %s"), p11_kit_strerror (rv));
+				goto cleanup;
+			}
+
+			print_mechanism_with_info (mechanisms[i], mechanism_info);
+		}
+		ret = 0;
+	} else {
+		assert (rv == CKR_CANCEL);
+		p11_message (_("no matching token"));
+	}
+
+cleanup:
+	if (session)
+		module->C_CloseSession (session);
+	if (mechanisms)
+		free (mechanisms);
+	p11_kit_iter_free (iter);
+	p11_kit_uri_free (uri);
+	if (modules != NULL)
+		p11_kit_modules_finalize_and_release (modules);
+
+	return ret;
+}
+
+int
+p11_kit_list_mechanisms (int argc,
+		         char *argv[])
+{
+	int opt;
+
+	enum {
+		opt_verbose = 'v',
+		opt_quiet = 'q',
+		opt_help = 'h',
+	};
+
+	struct option options[] = {
+		{ "verbose", no_argument, NULL, opt_verbose },
+		{ "quiet", no_argument, NULL, opt_quiet },
+		{ "help", no_argument, NULL, opt_help },
+		{ 0 },
+	};
+
+	p11_tool_desc usages[] = {
+		{ 0, "usage: p11-kit list-mechanisms pkcs11:token" },
+		{ 0 },
+	};
+
+	while ((opt = p11_tool_getopt (argc, argv, options)) != -1) {
+		switch (opt) {
+		case opt_verbose:
+			p11_kit_be_loud ();
+			break;
+		case opt_quiet:
+			p11_kit_be_quiet ();
+			break;
+		case opt_help:
+			p11_tool_usage (usages, options);
+			return 0;
+		case '?':
+			return 2;
+		default:
+			assert_not_reached ();
+			break;
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+
+	if (argc != 1) {
+		p11_tool_usage (usages, options);
+		return 2;
+	}
+
+	return list_mechanisms (*argv);
+}
diff --git a/p11-kit/meson.build b/p11-kit/meson.build
index 6bf9bcf3..6aa69675 100644
--- a/p11-kit/meson.build
+++ b/p11-kit/meson.build
@@ -217,6 +217,7 @@ p11_kit_sources = [
   'generate-keypair.c',
   'list-objects.c',
   'list-profiles.c',
+  'list-mechanisms.c',
   'lists.c',
   'p11-kit.c',
   'print-config.c'
@@ -401,6 +402,10 @@ if get_option('test')
     test('test-server.sh',
          find_program('test-server.sh'),
          env: p11_kit_tests_env)
+
+    test('test-list-mechanisms.sh',
+         find_program('test-list-mechanisms.sh'),
+         env: p11_kit_tests_env)
   endif
 
   if with_asn1 and host_system != 'windows'
diff --git a/p11-kit/p11-kit.c b/p11-kit/p11-kit.c
index 359a8c0b..04a55f1e 100644
--- a/p11-kit/p11-kit.c
+++ b/p11-kit/p11-kit.c
@@ -83,6 +83,9 @@ int       p11_kit_add_profile      (int argc,
 int       p11_kit_delete_profile   (int argc,
                                     char *argv[]);
 
+int       p11_kit_list_mechanisms  (int argc,
+                                    char *argv[]);
+
 int       p11_kit_print_config     (int argc,
                                     char *argv[]);
 
@@ -102,6 +105,7 @@ static const p11_tool_command commands[] = {
 	{ "add-profile", p11_kit_add_profile, N_("Add PKCS#11 profile to the token") },
 	{ "delete-profile", p11_kit_delete_profile, N_("Delete PKCS#11 profile from the token") },
 	{ "print-config", p11_kit_print_config, N_("Print merged configuration") },
+	{ "list-mechanisms", p11_kit_list_mechanisms, N_("List supported mechanisms") },
 	{ "remote", p11_kit_external, N_("Run a specific PKCS#11 module remotely") },
 	{ "server", p11_kit_external, N_("Run a server process that exposes PKCS#11 module remotely") },
 	{ P11_TOOL_FALLBACK, p11_kit_external, NULL },
diff --git a/p11-kit/test-list-mechanisms.sh b/p11-kit/test-list-mechanisms.sh
new file mode 100755
index 00000000..241c3aa4
--- /dev/null
+++ b/p11-kit/test-list-mechanisms.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+
+test "${abs_top_builddir+set}" = set || {
+	echo "set abs_top_builddir" 1>&2
+	exit 1
+}
+
+. "$abs_top_builddir/common/test-init.sh"
+
+setup() {
+	testdir=$PWD/test-mechanisms-$$
+	test -d "$testdir" || mkdir "$testdir"
+	cd "$testdir"
+}
+
+teardown() {
+	rm -rf "$testdir"
+}
+
+test_list_mechanisms_multi() {  # pkcs11: matches only the first token
+	cat > list.exp <<EOF
+0x80000001 (unknown): encrypt decrypt key-size=512-4096
+0x80000002 (unknown): sign verify key-size=2048-2048
+EOF
+
+	if ! "$abs_top_builddir"/p11-kit/p11-kit-testable list-mechanisms pkcs11: > list.out; then
+		assert_fail "unable to run: p11-kit list-mechanisms"
+	fi
+
+	: ${DIFF=diff}
+	if ! ${DIFF} list.exp list.out > list.diff; then
+		sed 's/^/# /' list.diff
+		assert_fail "output contains wrong results"
+	fi
+}
+
+test_list_mechanisms_single() {  # specific existing token can be specified
+	cat > list.exp <<EOF
+0x80000001 (unknown): encrypt decrypt key-size=512-4096
+0x80000002 (unknown): sign verify key-size=2048-2048
+EOF
+
+	if ! "$abs_top_builddir"/p11-kit/p11-kit-testable list-mechanisms pkcs11:token=PUBKEY%20LABEL > list.out; then
+		assert_fail "unable to run: p11-kit list-mechanisms"
+	fi
+
+	: ${DIFF=diff}
+	if ! ${DIFF} list.exp list.out > list.diff; then
+		sed 's/^/# /' list.diff
+		assert_fail "output contains wrong results"
+	fi
+}
+
+test_list_mechanisms_nonex() {  # specific nonexisting token leads to a warning
+	if "$abs_top_builddir"/p11-kit/p11-kit-testable list-mechanisms pkcs11:token=nonex 2> list.err; then
+		assert_fail "p11-kit list-mechanisms returned 0 for nonexisting token"
+	fi
+
+	: ${GREP=grep}
+	if ! ${GREP} -Fqx 'p11-kit: no matching token' list.err; then
+		assert_fail "p11-kit list-mechanisms hasn't printed 'no matching token' error"
+	fi
+}
+
+run test_list_mechanisms_multi
+run test_list_mechanisms_single
+run test_list_mechanisms_nonex
diff --git a/po/POTFILES.in b/po/POTFILES.in
index c902f33a..11333ac6 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -9,6 +9,7 @@ p11-kit/filter.c
 p11-kit/generate-keypair.c
 p11-kit/list-objects.c
 p11-kit/list-profiles.c
+p11-kit/list-mechanisms.c
 p11-kit/lists.c
 p11-kit/messages.c
 p11-kit/modules.c