On: Project Svalbard: The Future of Have I Been Pwned

[fjsolwmv]

That doesn't work, because of hunter2 is in the PW database but hunter3 isn't, your system will think hunter3 is secure even though it's not.

[noisy_boy → fjsolwmv]

I think it should be two step - checking against the list and if that passes, complexity check. Covers complex passwords that are known to have been in use/leaked and non-complex ones too.