You're confusing pwned passwords wtih https://haveibeenpwned.com/

As for pwned passwords, it doesn't send the password. The way it works is that you submit the first 5 characters of a hash, and get back a list of all hashes.

You then locally compare the complete hash to see if it is there.