diff --git a/src/apppasswords.js b/src/apppasswords.js
index e2c60256f..4afbd0c8b 100644
--- a/src/apppasswords.js
+++ b/src/apppasswords.js
@@ -78,7 +78,7 @@ async function add(userId, identifier, name, expiresAt) {
 async function list(userId) {
     assert.strictEqual(typeof userId, 'string');
 
-    return await database.query('SELECT ' + APP_PASSWORD_FIELDS + ' FROM appPasswords WHERE userId = ?', [ userId ]);
+    return await database.query('SELECT ' + APP_PASSWORD_FIELDS + ' FROM appPasswords WHERE userId = ? ORDER BY name', [ userId ]);
 }
 
 async function del(id) {
diff --git a/src/routes/test/apppasswords-test.js b/src/routes/test/apppasswords-test.js
index d299e7da6..95ab2b48c 100644
--- a/src/routes/test/apppasswords-test.js
+++ b/src/routes/test/apppasswords-test.js
@@ -89,13 +89,13 @@ describe('App Passwords', function () {
             expect(response.status).to.equal(200);
             expect(response.body.appPasswords).to.be.an(Array);
             expect(response.body.appPasswords.length).to.be(2);
-            expect(response.body.appPasswords[0].name).to.be('my-device');
-            expect(response.body.appPasswords[0].identifier).to.be('someapp');
-            expect(response.body.appPasswords[0].expiresAt).to.be(null);
-            expect(response.body.appPasswords[0].hashedPassword).to.be(undefined);
-            expect(response.body.appPasswords[0].password).to.be(undefined);
-            expect(response.body.appPasswords[1].name).to.be('expiring-device');
-            expect(response.body.appPasswords[1].expiresAt).to.be.a('string');
+            expect(response.body.appPasswords[0].name).to.be('expiring-device');
+            expect(response.body.appPasswords[0].expiresAt).to.be.a('string');
+            expect(response.body.appPasswords[1].name).to.be('my-device');
+            expect(response.body.appPasswords[1].identifier).to.be('someapp');
+            expect(response.body.appPasswords[1].expiresAt).to.be(null);
+            expect(response.body.appPasswords[1].hashedPassword).to.be(undefined);
+            expect(response.body.appPasswords[1].password).to.be(undefined);
         });
 
         it('can get app password', async function () {