[supriyo-biswas]

There’s no reason this functionality couldn’t be built into the client. Adding an unencrypted hash provides a side-channel into the encrypted passwords and should be avoided. Since passwords are not chosen at random and even when using a password manager, the generated passwords usually optimize for memorization, so the input domain for the hash function is substantially smaller, and therefore, can be brute forced to reveal the password.

As for the second question, it is usually implemented using hashing the password but revealing only a small prefix of the hash to a remote server. The remote server then sends a list of known-to-be-compromised password hashes that start with said prefix, which the client can use to find out if a password is compromised without revealing the password or its complete hash to the server[1].

[1] https://www.troyhunt.com/understanding-have-i-been-pwneds-us...