It makes a cryptographically-secure hash of the password you enter, then truncates that before sending it to the server so the only information they get would be in common with a huge number of other passwords. They then send back the leaked passwords with the same truncated hash, and your computer checks to see if what you’ve entered matches anything on the list. It’s not practical to send the whole list for every query as there’s just too much data, but if you don’t trust their site, you can just download the whole list and check against it yourself.