orymh said: "BitAddress.org (https://www.bitaddress.org) also has a vanity address generator. It's client-side JavaScript, so the source is available, and it can be run while disconnected from the Internet for a little extra safety."

BitAddress.org doesn't generate the vanity address, it pieces together the vanity pool's part of the key which is generated for you, and your part of the key.