This is a major security risk too you could alternatively download exposed passwords (which haveibeenpwned does not distribute but they are usually from public leaks) and check it offline because you are still entering a password into a different site other than the ones its used for which is a security breach in itself unless you trust a third party with storing your password to check if its been "pwned".