diff --git a/cmd/crane/cmd/auth.go b/cmd/crane/cmd/auth.go
index 1964ade91..5586e822c 100644
--- a/cmd/crane/cmd/auth.go
+++ b/cmd/crane/cmd/auth.go
@@ -39,7 +39,7 @@ func NewCmdAuth(options []crane.Option, argv ...string) *cobra.Command {
 		Args:  cobra.NoArgs,
 		RunE:  func(cmd *cobra.Command, _ []string) error { return cmd.Usage() },
 	}
-	cmd.AddCommand(NewCmdAuthGet(options, argv...), NewCmdAuthLogin(argv...))
+	cmd.AddCommand(NewCmdAuthGet(options, argv...), NewCmdAuthLogin(argv...), NewCmdAuthLogout(argv...))
 	return cmd
 }
 
@@ -203,3 +203,42 @@ func login(opts loginOptions) error {
 	log.Printf("logged in via %s", cf.Filename)
 	return nil
 }
+
+// NewCmdAuthLogout creates a new `crane auth logout` command.
+func NewCmdAuthLogout(argv ...string) *cobra.Command {
+	eg := fmt.Sprintf(`  # Log out of reg.example.com
+  %s logout reg.example.com`, strings.Join(argv, " "))
+
+	cmd := &cobra.Command{
+		Use:     "logout [SERVER]",
+		Short:   "Log out of a registry",
+		Example: eg,
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			reg, err := name.NewRegistry(args[0])
+			if err != nil {
+				return err
+			}
+			serverAddress := reg.Name()
+
+			cf, err := config.Load(os.Getenv("DOCKER_CONFIG"))
+			if err != nil {
+				return err
+			}
+			creds := cf.GetCredentialsStore(serverAddress)
+			if serverAddress == name.DefaultRegistry {
+				serverAddress = authn.DefaultAuthKey
+			}
+			if err := creds.Erase(serverAddress); err != nil {
+				return err
+			}
+
+			if err := cf.Save(); err != nil {
+				return err
+			}
+			log.Printf("logged out via %s", cf.Filename)
+			return nil
+		},
+	}
+	return cmd
+}
diff --git a/cmd/crane/doc/crane_auth.md b/cmd/crane/doc/crane_auth.md
index 6eb8fc8fc..8daa18a78 100644
--- a/cmd/crane/doc/crane_auth.md
+++ b/cmd/crane/doc/crane_auth.md
@@ -26,4 +26,5 @@ crane auth [flags]
 * [crane](crane.md)	 - Crane is a tool for managing container images
 * [crane auth get](crane_auth_get.md)	 - Implements a credential helper
 * [crane auth login](crane_auth_login.md)	 - Log in to a registry
+* [crane auth logout](crane_auth_logout.md)	 - Log out of a registry
 
diff --git a/cmd/crane/doc/crane_auth_logout.md b/cmd/crane/doc/crane_auth_logout.md
new file mode 100644
index 000000000..bfc9410ae
--- /dev/null
+++ b/cmd/crane/doc/crane_auth_logout.md
@@ -0,0 +1,34 @@
+## crane auth logout
+
+Log out of a registry
+
+```
+crane auth logout [SERVER] [flags]
+```
+
+### Examples
+
+```
+  # Log out of reg.example.com
+  crane auth logout reg.example.com
+```
+
+### Options
+
+```
+  -h, --help   help for logout
+```
+
+### Options inherited from parent commands
+
+```
+      --allow-nondistributable-artifacts   Allow pushing non-distributable (foreign) layers
+      --insecure                           Allow image references to be fetched without TLS
+      --platform platform                  Specifies the platform in the form os/arch[/variant][:osversion] (e.g. linux/amd64). (default all)
+  -v, --verbose                            Enable debug logs
+```
+
+### SEE ALSO
+
+* [crane auth](crane_auth.md)	 - Log in or access credentials
+