haveibeenpwned doesn't accept plain-text passwords for checking, they use a k-anonymity model to protect both your passwords and the passwords in the database. the same goes for email addresses.

https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR...

HIBP doesn't work that way really. You don't query for a site breach + email combination, you basically give your email address and then it returns back a list of breaches your email address was part of.

As far as HIBP linking your email to specific breaches, well, it is essentially using public data sets so that disclosure exists already (before HIBP even enters the picture). They are a bit more reserved with certain cases (the Ashley Madison breach for example), but even then if someone wanted to locate email addresses in that breach, they'd just go get that data set.

Answered here: https://news.ycombinator.com/item?id=20465981

They don't look at passwords

They look at breached sites and rather or not you saved a login for that site on a date before the site was breached.