This is a good point as not all passwords will be in known set.

I guess it’s only a 1:500 if the password has been pwned. In which case, the owner should promptly change it and remove the risk.

Thanks, I didn’t think of that. For some reason I was stuck in thinking that all passwords have been pwned and in the file.