Measure entropy and strength, and see if a password has appeared in known breaches. Only the first 5 characters of its SHA-1 are ever sent — the password itself stays in your browser.
Privacy: the breach check uses k-anonymity. Your browser SHA-1s the password and sends only the first 5 hex characters to this server, which relays them to HIBP. The full password and hash never leave your browser.