The password isn't actually stored anywhere on the system, a [one way hash of it is](http://en.wikipedia.org/wiki/Cryptographic_hash_function).  This means even if you have the hash, you won't be able to deduce the password.

The hash itself is stored in `/etc/shadow`.  Take the SD card out and stick it in another linux system; any common distro (ubuntu, fedora, arch, etc.) should do.  On that system, create a new temporary user -- do all this via `sudo` or as root:

    > useradd tmpuser
    > grep tmpuser /etc/shadow
    tmpuser:!:16406:0:99999:7:::

The last line of output is just an example but that's more or less what you should see.  There might be two exclamation marks.  Now open `/etc/shadow`, find that line (the one starting with `tmpuser`, or whatever name you used) and remove the `!` (or two) from between the first two colons, so it is `tmuser::16406...`.  This makes this a passwordless account.  Now:

    > su tmpuser
    > passwd
    Enter new UNIX password:

Go ahead and enter a password.  This creates a hash in `/etc/shadow`; if you run `grep tmpuser /etc/shadow` you'll now see a *long* string between the first two colons; it probably begins with `$6$,`, eg.

    tmpuser:$6$jlBY96dq$V7tFs2xEv.a3kXArkyTEcEbGDX43d6UpzMcy/aplV8khxUFJKPMg0ugGBfWVZMpJRpaMXAATEAb5inu7/G.Iz1:16406:0:99999:7:::

Now open the `/etc/shadow` file *on the second partition of the SD card*, i.e., the one used on the pi.  In there you'll find a line beginning with `pi` or whatever user it is you are interested in.  It will have a long string between the first two colons as above.  Erase that (only the stuff between the first two colons!) and replace it with the string from `tmpuser` on the current system.

You could just remove it and leave the account passwordless, but I think you may then have problems with `ssh`.  Whereas this method is pretty foolproof.

Unmount the partition, take the card out, boot it in the pi, and the password will be whatever you created above.  You can then change that with `passwd` if you want.

To remove the temporary user you created for this purpose on the other system (n.b., you could always skip that and just use the hash from an account you know the password for):

    > userdel tmpuser