diff --git a/src/node/cli.ts b/src/node/cli.ts
index 2433ddf2e..088431b7a 100644
--- a/src/node/cli.ts
+++ b/src/node/cli.ts
@@ -502,10 +502,21 @@ export async function setDefaults(cliArgs: Args, configArgs?: ConfigArgs): Promi
   } as DefaultedArgs // TODO: Technically no guarantee this is fulfilled.
 }
 
-async function defaultConfigFile(): Promise<string> {
+/**
+ * Helper function to return the default config file.
+ *
+ * @param {string} password - Password passed in (usually from generatePassword())
+ * @returns The default config file:
+ *
+ * - bind-addr: 127.0.0.1:8080
+ * - auth: password
+ * - password: <password>
+ * - cert: false
+ */
+export function defaultConfigFile(password: string): string {
   return `bind-addr: 127.0.0.1:8080
 auth: password
-password: ${await generatePassword()}
+password: ${password}
 cert: false
 `
 }
@@ -530,7 +541,8 @@ export async function readConfigFile(configPath?: string): Promise<ConfigArgs> {
   await fs.mkdir(path.dirname(configPath), { recursive: true })
 
   try {
-    await fs.writeFile(configPath, await defaultConfigFile(), {
+    const generatedPassword = await generatePassword()
+    await fs.writeFile(configPath, defaultConfigFile(generatedPassword), {
       flag: "wx", // wx means to fail if the path exists.
     })
     logger.info(`Wrote default config file to ${humanPath(configPath)}`)
diff --git a/test/unit/node/cli.test.ts b/test/unit/node/cli.test.ts
index e92cb9758..97b648788 100644
--- a/test/unit/node/cli.test.ts
+++ b/test/unit/node/cli.test.ts
@@ -6,6 +6,7 @@ import * as path from "path"
 import {
   Args,
   bindAddrFromArgs,
+  defaultConfigFile,
   parse,
   setDefaults,
   shouldOpenInExistingInstance,
@@ -13,7 +14,7 @@ import {
   splitOnFirstEquals,
 } from "../../../src/node/cli"
 import { tmpdir } from "../../../src/node/constants"
-import { paths } from "../../../src/node/util"
+import { generatePassword, paths } from "../../../src/node/util"
 import { useEnv } from "../../utils/helpers"
 
 type Mutable<T> = {
@@ -642,3 +643,15 @@ describe("bindAddrFromArgs", () => {
     resetValue()
   })
 })
+
+describe("defaultConfigFile", () => {
+  it("should return the default config file as a string", async () => {
+    const password = await generatePassword()
+    const actual = defaultConfigFile(password)
+
+    expect(actual).toMatch(`bind-addr: 127.0.0.1:8080
+auth: password
+password: ${password}
+cert: false`)
+  })
+})