Only the first five characters of the hash of your password get send to haveibeenpwned.com

Source code on github