Depends on how you do it. On the very off chance that you just display the password in plain sight (no asterisks), you can do it on the same page. But if you do it using two masked fields (type and verify), then a separate page is better, for a couple of reasons:
- Security - you do need to make sure that it's really the account
owner who is trying to change the password, rather than someone who
had walked up to the computer when the owner was logged in.
- The concept of "blank field = no change in password" is too complicated for the user to figure out by himself, and it violates basic usability principles. A blank field should mean that the field is blank, i.e. there's no password, not that there's some hidden password. A blank field in a "new user" page would pop an error message, while the same blank field in an "edit" page is ok? This decision must be made by the user explicitly, not implicitly - maybe a checkbox that says "Change password" and then enables the two fields.
If you go about this the other way, and provide password fields that are already filled in, and just show meaningless asterisks, then you're relying on the user's memory to tell him which fields have been updated. Furthermore, in this fashion it's inevitable that the user gets an error message when the user is done editing the first field.
You will need to change the page slightly. It can be a checkbox or a button that brings up a popup for the new password, or some other way.