Pwned Passwords uses a k-anonymity scheme so that your password is never actually sent to the server [0]. You can just call the API directly [1] so that you don’t have to trust haveibeenpwned.com’s JavaScript with your password.
[0]: https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...