[estroz]

The library alternative was suggested in another comment and is definitely a path I'll consider over a service. The goal of this project wouldn't necessarily be to start a business, but to help standardise how websites interact with sensitive user data.

Perhaps encrypting hashed passwords with a session key and matching against hashes encrypted with that key server-side would solve the issue you mention.

[jimrandomh]

In order to do that you'd have to re-hash each of the data-dumped passwords with a new salt, each time you wanted to do a comparison. But a good password-hash algorithm is specifically designed to be slow, so re-hashing the whole database will take quite a lot of computational power, likely enough to make that strategy infeasible.