Not to detract from your efforts, but you can actually check your passwords with HIBP without sending the plaintext password. You can send the first 5 characters of the SHA-1 hash, and it will send back the rest of hashes that match for you to compare against. See https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR...

The entire premise of this ignores that you can use the api for HIBP to do local comparison of a password.

Nice, now we can download it to a computer, unplug it from the internet, test passwords, then burn the computer to be sure ;)

Thanks!

https://github.com/terencechow/PwnedPasswords