For those worried about inputting a password into a tool like this, they've actually done a great job keeping your pass secure.

Passwords entered on this site do not get transmitted to the server. Instead, they are hashed, then only the first half of the hash is sent to the server. The server replies with a list of every password hash they've found in leaks that match the partial hash you sent them. Your computer then looks through the list and tells you if the password you entered (which was kept on your pc, not transmitted) exists in that list.

From Haveibeenpwneds perspective; they sent you a big list of potential matches, but don't know which one if any actually matches your password, because they were never given the full hash, let alone the raw password.

There's even an open-source script you can run that does this within a console instead of a browser. Or, you can download their whole password DB via their github tools, then check it entirely offline.