diff --git a/src/bggpipe/webreview.py b/src/bggpipe/webreview.py
index 99669af..56274fd 100644
--- a/src/bggpipe/webreview.py
+++ b/src/bggpipe/webreview.py
@@ -1080,7 +1080,10 @@ def run_web_review(
     import uvicorn
 
     url = f"http://127.0.0.1:{port}{landing}"
-    token = secrets.token_urlsafe(6) if lan else None
+    # 16 bytes = 128-bit key: standard session-credential strength. The
+    # cost is a longer one-time URL to get onto the phone — copy it, or
+    # type it once; the cookie remembers it from then on.
+    token = secrets.token_urlsafe(16) if lan else None
     if lan:
         ips = sorted(h for h in lan_hosts() if h.replace(".", "").isdigit())
         names = sorted(h for h in lan_hosts() if not h.replace(".", "").isdigit())