I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces.
AS per my read I have 3 options to check out.
Download the password dictionary and implement my own breached password checker
call HIBP api to check whether the given password is already breached
Use one of the password managers to perform the task (as you mentioned in Troy Hunt's blogs: 1Password manager)
As a developer I prefer to choose either the 1st or 2nd option as I don't have to pay for it.
I wanted to check with you how reliable to use 1st or 2nd option: How often the password dictionary get updated?
What about the availability of the password dictionary/api? are there any policies covering this? If so, Do I need to pay for anything?