Comment by adameasterling

It is not hard and every web service really should implement this sort of check. I’m actually pretty surprised to see so many comments here that aren’t aware of it!

See: https://haveibeenpwned.com/Passwords