haveibeenpwned doesn't accept plain-text passwords for checking, they use a k-anonymity model to protect both your passwords and the passwords in the database. the same goes for email addresses.

https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR...