It's fairly well established that students get the initial password from prefects. For example, when Harry and Ron arrive at the entrance for the first time in Chamber of Secrets, having not been to the Great Hall, we are told the following:
They didn't know the new year's password, not having met a Gryffindor prefect yet,
As to how the prefects are informed, we don't have much information. However, we can assume that they are not told directly by the Fat Lady, because they already know the password before they ever go up to her portrait. Presumably, then, the prefects are told the password by a member of the staff, likely the head of house Professor McGonagall. Assuming as you do that the Fat Lady sets the password, we would have to assume that she gives it to McGonagall in advance.
The above is all in reference to the initial password for the year. That is where we find a bunch of examples throughout the books of prefects knowing the passwords. However, the passwords also routinely change throughout the year, and in those cases we don't see prefects giving the passwords to the other students. In fact, we don't see anything about how new passwords are spread around. We do see an instance of a password having been changed in Chapter Seventeen of Half-Blood Prince:
"Baubles," said Ron confidently, when they reached the Fat Lady, who was looking rather paler than usual and winced at his loud voice.
"No," she said.
"What d'you mean, 'no' ?
"There is a new password," she said. "And please don't shout."
"But we've been away, how're we supposed to — ?"
But this just tells us that the Fat Lady won't give the new password to students trying too get into the common room. It doesn't tell us how the new password would actually be spread around.
Later in Chapter Twenty-Three there is another instance that may shed a little bit of light on the system:
By the time he got up to the portrait of the Fat Lady and pulled off his Invisibility Cloak, he was not surprised to find her in a most unhelpful mood.
"What sort of time do you call this?"
"I'm really sorry — I had to go out for something important —"
"Well, the password changed at midnight, so you'll just have to sleep in the corridor, won't you?"
"You're joking!" said Harry. "Why did it have to change at midnight?"
"That's the way it is," said the Fat Lady. "If you're angry, go and take it up with the headmaster, he's the one who's tightened security."
Here we see another example of a password being changed and a student not knowing the new password. Again the Fat Lady does not tell him the new password. Now if we consider the claim that the password changed at midnight, we have to wonder how anyone would know the new password. As soon as they exit the common room the next morning they would be unable to get back in. Even if they could find out the password in the Great Hall during breakfast (as in the beginning of the year) that wouldn't help for anyone who needed to get back in before going down to breakfast. It would seem reasonable, then, that password changes are displayed in the common room itself. So when the Fat Lady chooses a new password there might be some magical sign inside the room that automatically updates with the new password. Thus, any student already inside would be able to learn the new password before leaving the room.
Now it turns out that in the above case the Fat Lady was lying, and the password actually hadn't been changed:
He wheeled about and sprinted off again, ignoring the Fat Lady who was calling after him.
"Come back! All right, I lied! I was annoyed you woke me up! The password's still 'tapeworm'!"
However, from what Harry responded (and didn't respond) we can perhaps infer that nothing that the Fat Lady was claiming was fundamentally against how the system worked.
However, there is a slight issue with assuming that the new password is displayed inside the common room. As part of his punishment for enabling Sirius Black to gain access to the common room, Neville was not told the new passwords:
Neville was in total disgrace. Professor McGonagall was so furious with
him she had banned him from all future Hogsmeade visits, given him a detention, and forbidden anyone to give him the password into the tower.
If the passwords were displayed in the common room, this would be a meaningless punishment since he could easily find it out even if no one would tell it to him. So we would now either have to assume that McGonagall gave him a meaningless punishment, or accept that the password is not displayed in the common room. If it is not displayed, then we are stuck with saying that students could not find out the new password until the next time they saw a prefect. Depending on what time of day the password is changed, this could cause some logistical issues. It is theoretically possible that passwords would only change overnight and the prefects would somehow get notified right away so that they could tell the other students before they leave the common room, but there doesn't seem to be any specific evidence for this.
Perhaps relevant to this is Percy's reaction in Prisoner of Azkaban when he finds everyone waiting outside after the Fat Lady was attacked:
"Let me through, please," came Percy's voice, and he came bustling importantly through the crowd. "What's the holdup here? You can't all have forgotten the password – excuse me, I'm Head Boy –"
Here Percy does not even entertain the idea that the password might have been changed. Perhaps we can infer from this that either the password would never change at that time of day, or that the password would never change without Percy (as a prefect/head boy) being immediately notified.
In short, I would say that aside for the first password of the year, we don't really know how the students are informed.
