The point of a secure password is that it _won't_ be in the list of hashes by the server. The service should prevent the user from using any of the passwords that are matched by the password database.