diff --git a/src/error.rs b/src/error.rs
index e7bc5e8..66789db 100644
--- a/src/error.rs
+++ b/src/error.rs
@@ -23,6 +23,19 @@ pub enum Fido2LuksError {
     StringEncodingError { cause: FromUtf8Error },
 }
 
+impl Fido2LuksError {
+    pub fn exit_code(&self) -> i32 {
+        use Fido2LuksError::*;
+        match self {
+            AskPassError { .. } | KeyfileError { .. } => 2,
+            AuthenticatorError { .. } => 3,
+            NoAuthenticatorError => 4,
+            WrongSecret => 5,
+            _ => 1,
+        }
+    }
+}
+
 #[derive(Debug, Fail)]
 pub enum AskPassError {
     #[fail(display = "unable to retrieve password: {}", _0)]
diff --git a/src/main.rs b/src/main.rs
index 4f2cbd3..e7ac839 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -11,6 +11,7 @@ use ring::digest;
 
 use std::io::{self};
 use std::path::PathBuf;
+use std::process::exit;
 
 mod cli;
 mod config;
@@ -34,7 +35,16 @@ fn assemble_secret(hmac_result: &[u8], salt: &[u8]) -> [u8; 32] {
 }
 
 fn main() -> Fido2LuksResult<()> {
-    run_cli()
+    match run_cli() {
+        Err(e) => {
+            #[cfg(debug_assertions)]
+            eprintln!("{:?}", e);
+            #[cfg(not(debug_assertions))]
+            eprintln!("{}", e);
+            exit(e.exit_code())
+        }
+        _ => exit(0),
+    }
 }
 
 #[cfg(test)]