> Only the first 5 characters of a SHA-1 hash go to HIBP

Some would consider the first five characters being sent over the internet to be 'your secret leaving your system'.

Some would consider phoning home to a remote server to be worrisome. It's home assistant not cloud assistant.