What is the purpose of checking user-supplied passwords against a 'have I been pwned' (HIBP) database during registration or password change?

• A.To confirm that the password has been hashed with SHA-1 before it is stored, matching each prefix against the public database and warning the user when the hash format is outdated for the registration form
• B.To check that the new password differs from the user's previous ten passwords, comparing hashes held by the breach service and blocking any reuse of an old value inside the same account
• C.To reject passwords that have appeared in known data breaches, preventing users from choosing compromised credentials that are already in attacker wordlists - significantly reducing credential stuffing and brute-force attack success rates
• D.To measure how quickly attackers could crack the chosen password offline, returning an estimated time and rejecting entries that a GPU rig would finish within an hour of effort