Seen in breaches? Send the password's SHA-1 (never the password); only 5 hex chars go upstream. Count and verdict.