Short: We query haveibeenpwned. Long: We create a cryptographic hash of the password and query the password API of haveibeenpwned with the first 5 digits of said hash. Then we get the hashes of all passwords whose first 5 digits match our query. Then we can check whether one of the returned hashes matches the complete hash of the password. If thats the case, we know that the password has been breached. Note that the haveibeenpwned service never knows the password, because it is only fed with the first 5 digits of the 40 digit hash of the password. PwdSafe does not know the password either, because all checks happen in your browser and not on the PwdSafe server.