I think that this point in time if you're building a password authentication system, you definitely should check user passwords against Pwned Passwords[0] when creating the account and maybe even when they log in.
The better way of course is to outsource the authentication to Google, Microsoft, Okta, or someone else and let them deal with the bots. :)
The better way of course is to outsource the authentication to Google, Microsoft, Okta, or someone else and let them deal with the bots. :)
[0]: https://haveibeenpwned.com/API/v2#PwnedPasswords