Hacker News Reader

that doesn't explain anything. they shouldn't be uploading unsalted hashes either. and if it's salted, it won't match with any database

True, the best solution is to download the list of hashed "bad passwords" and check if the one entered matches against that.

if salted hash is leaked then it doesn't matter and does not need to be detected anyway.