The Prevent Pwned Passwords extension checks password hashes against the online Have I Been Pwned service.

The extension works by making a request to the online service for each site you want to check against. The service sends back the result of the check in the form of a hash, and the extension hashes the provided password and checks the hash against the leaked hashes that are known to have been part of a data breach.

If the hash matches, it displays a notification. If it doesn't, it doesn't.

You can choose to check a site's passwords on any site, anytime, or only when you're logged in.

You can also whitelist sites and prevent checking passwords for them.