/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kpasswdd kpasswdd serves request for password changes. It listens on UDP port 464 (service kpasswd) and processes requests when they arrive. It changes the database directly and should thus only run on the master KDC.
The binary is a part of Heimdal private framework.