Passwords are not saved to storage or transmitted in whole over a network. Each password is hashed and then a snippet of that is sent to the api (to ensure k-anonymity) which will return a list of possible matches. These matches are then compared to the original hash.