You have to do it over ssh:
https://lightning.codes/post/2021/06/18/setting-the-password-for-thunderhub-on-umbrel-eng/
See also this thread: Changing passwords
But it seems pretty crazy to direct traffic straight to your Umbrel when you can use a Tor browser to do it securely.