This took me a while to figure out. You have to open the Steam client, go to Settings (in Windows) or Preferences (in Mac OS X) and click the change password button in there under the Account tab.
Has the site been secured yet? Would it be wise to change your password before there is confirmation that steam's site is safe? Instead I would change the password on any other accounts that use the same password as your steam account.