You're confusing pwned passwords wtih https://haveibeenpwned.com/ https://haveibeenpwned.com/ As for pwned passwords, it doesn't send the password. The way it

You're confusing pwned passwords wtih https://haveibeenpwned.com/ https://haveibeenpwned.com/ As for pwned passwords, it doesn't send the password. The way it works is that you submit the first 5 characters of a hash, and get back a list of all hashes. You then locally compare the complete hash to see if it is there.