diff --git a/config/config.go b/config/config.go
index 7c6c7f3..f96b56f 100644
--- a/config/config.go
+++ b/config/config.go
@@ -1,11 +1,11 @@
 package config
 
 import (
+	"bytes"
 	"encoding/hex"
 	"fmt"
 	"net"
 	"strconv"
-	"strings"
 
 	"github.com/juju/errors"
 	statsd "gopkg.in/alexcesaro/statsd.v2"
@@ -116,28 +116,18 @@ func getAddr(host fmt.Stringer, port uint16) string {
 func NewConfig(debug, verbose bool, // nolint: gocyclo
 	bindIP, publicIPv4, publicIPv6, statsIP net.IP,
 	bindPort, publicIPv4Port, publicIPv6Port, statsPort, statsdPort uint16,
-	secret, adtag, statsdIP, statsdNetwork, statsdPrefix, statsdTagsFormat string,
-	statsdTags map[string]string) (*Config, error) {
+	statsdIP, statsdNetwork, statsdPrefix, statsdTagsFormat string,
+	statsdTags map[string]string,
+	secret, adtag []byte) (*Config, error) {
 	secureMode := false
-	if strings.HasPrefix(secret, "dd") && len(secret) == 34 {
+	if bytes.HasPrefix(secret, []byte{0xdd}) && len(secret) == 17 {
 		secureMode = true
-		secret = strings.TrimPrefix(secret, "dd")
-	} else if len(secret) != 32 {
+		secret = bytes.TrimPrefix(secret, []byte{0xdd})
+	} else if len(secret) != 16 {
 		return nil, errors.New("Telegram demands secret of length 32")
 	}
-	secretBytes, err := hex.DecodeString(secret)
-	if err != nil {
-		return nil, errors.Annotate(err, "Cannot create config")
-	}
-
-	var adTagBytes []byte
-	if len(adtag) != 0 {
-		adTagBytes, err = hex.DecodeString(adtag)
-		if err != nil {
-			return nil, errors.Annotate(err, "Cannot create config")
-		}
-	}
 
+	var err error
 	if publicIPv4 == nil {
 		publicIPv4, err = getGlobalIPv4()
 		if err != nil {
@@ -177,8 +167,8 @@ func NewConfig(debug, verbose bool, // nolint: gocyclo
 		PublicIPv6Port: publicIPv6Port,
 		StatsIP:        statsIP,
 		StatsPort:      statsPort,
-		Secret:         secretBytes,
-		AdTag:          adTagBytes,
+		Secret:         secret,
+		AdTag:          adtag,
 		SecureMode:     secureMode,
 	}
 
@@ -187,7 +177,10 @@ func NewConfig(debug, verbose bool, // nolint: gocyclo
 		conf.StatsD.Prefix = statsdPrefix
 		conf.StatsD.Tags = statsdTags
 
-		var addr net.Addr
+		var (
+			addr net.Addr
+			err  error
+		)
 		hostPort := net.JoinHostPort(statsdIP, strconv.Itoa(int(statsdPort)))
 		switch statsdNetwork {
 		case "tcp":
diff --git a/main.go b/main.go
index 712d92c..72eee60 100644
--- a/main.go
+++ b/main.go
@@ -110,8 +110,8 @@ var (
 		Envar("MTG_STATSD_TAGS").
 		StringMap()
 
-	secret = app.Arg("secret", "Secret of this proxy.").Required().String()
-	adtag  = app.Arg("adtag", "ADTag of the proxy.").String()
+	secret = app.Arg("secret", "Secret of this proxy.").Required().HexBytes()
+	adtag  = app.Arg("adtag", "ADTag of the proxy.").HexBytes()
 )
 
 func init() {
@@ -120,7 +120,7 @@ func init() {
 
 }
 
-func main() {
+func main() { // nolint: gocyclo
 	kingpin.MustParse(app.Parse(os.Args[1:]))
 
 	err := setRLimit()
@@ -131,8 +131,9 @@ func main() {
 	conf, err := config.NewConfig(*debug, *verbose,
 		*bindIP, *publicIPv4, *publicIPv6, *statsIP,
 		*bindPort, *publicIPv4Port, *publicIPv6Port, *statsPort, *statsdPort,
-		*secret, *adtag, *statsdIP, *statsdNetwork, *statsdPrefix, *statsdTagsFormat,
+		*statsdIP, *statsdNetwork, *statsdPrefix, *statsdTagsFormat,
 		*statsdTags,
+		*secret, *adtag,
 	)
 	if err != nil {
 		usage(err.Error())