diff --git a/src/users.js b/src/users.js
index de2acdabc..472e74dbd 100644
--- a/src/users.js
+++ b/src/users.js
@@ -710,7 +710,7 @@ function addAppPassword(userId, identifier, name, callback) {
 
     if (identifier.length < 1) return callback(new BoxError(BoxError.BAD_FIELD, 'identifier must be atleast 1 char'));
 
-    const password = hat(8 * 4);
+    const password = hat(16 * 4);
     const hashedPassword = crypto.createHash('sha256').update(password).digest('base64');
 
     var appPassword = {