I think the passwords are set by the common room guardians.
When Sir Cadogan is guarding Gryffindor Tower, we’re told:
The Fat Lady’s ripped canvas had been taken off the wall and
replaced with the portrait of Sir Cadogan and his fat gray pony. Nobody was very happy about this. Sir Cadogan spent half his time challenging people to duels, and the rest thinking up ridiculously complicated passwords, which he changed at least twice a day.
— Prisoner of Azkaban, chapter 9 (Grim Defeat)
If the passwords were being set by an external authority (say, the headmaster or head of house), it’s unlikely he’d be able to get away with such an aggressive policy.
The Ravenclaw guardian doesn’t even use passwords:
Luna reached out a pale hand, which looked eerie floating in midair, unconnected to arm or body. She knocked once, and in the silence it sounded to Harry like a cannon blast. At once the beak of the eagle opened, but instead of a bird’s call, a soft, musical voice said, “Which came first, the phoenix or the flame?”
“Hmm… What do you think, Harry?” said Luna, looking thoughtful.
“What? Isn’t there just a password?”
“Oh no, you’ve got to answer a question,” said Luna.
— Deathly Hallows, chapter 29 (The Lost Diadem)
Although it would be possible for a teacher to give the eagle a list of riddles to use, it seems much more plausible that the eagle is partially sentient, and dreams up its own riddles. (If nothing else, to avoid it running out of unique riddles and having students remember the answers.)
Then consider the “pureblood” password for Slytherin’s common room. There’s a racial undertone to that word which means I can’t see Snape setting it as a password. It could be a prefect, but it’s implied that prefects don’t set the passwords, they just learn them like everybody else (I don’t have a reference to hand, sorry).