If someone changes a password for a login, offer a toggle to allow it being checked with the haveibeenpwned site. All data would be encrypted, or as much as possible. https://haveibeenpwned.com/Passwords is the site in question.