The standard way is, as is pointed out in a parallel comment, checking when the user logs in (since they have to send their unhashed password to the server as p

The standard way is, as is pointed out in a parallel comment, checking when the user logs in (since they have to send their unhashed password to the server as part of logging in). Another approach is to use things like https://haveibeenpwned.com/ https://haveibeenpwned.com/ to detect users whose credentials are compromised and alert them. Another more involved approach is to actually try to find collisions with user passwords (using either common wordlists, generated wordlists, or straight brute force) and then notifying users if they find a hit.