isn't a password, that is generated by such a tool, insecure?
Why would you think so? Every time you run the tool OpenSSL RNG is properly seeded and 16-character random prefix is generated, which becomes part of the account password. I personally do not see any issue with this.
I'm also planning to add some minor features and release the source code so anyone can audit.
Please, do release the source of your vanity generator. I was about to warn people not to use it, because it is a closed source tool posted by a new user with 5 posts only. Can't be too paranoid after the incident we already had. Without the source, how does one know if your random prefix is really random?