NIST and OWASP ASVS recommends checking passwords against those obtained from previous data breaches. The list of such passwords can be downloaded from "Have I Been Pwned" (https://haveibeenpwned.com/Passwords), but there are more than 300 million pwned passwords. Do you recommend comparing users' passwords (during registration, password change, or even every successful login) with such a large list? Will it affect the performance too much?
Is it a better idea to compare passwords with smaller lists like top 1000 or 10000 most common passwords for example https://github.com/danielmiessler/SecLists/tree/master/Passwords? That is the exact recommendation from OWASP ASVS.