This is so useful I've knocked up a quick gem to wrap the range service (i.e. it only transmits the first 5 chars of the SHA1 hash)

https://github.com/dansingerman/pwned_passwords_v2

The code is left deliberately simple so eyeballing lets you know it's not doing anything hinky with the passwords.