F12 reports using that tool sends the password as a form body field to their site (which means their server can read the request in plain text), which responses a json with just a field of how many “matches”.

There’s no way to know whether they log the requests (so you should assume they do in uncertainty like this), but it certainly does the real thing of comparing it against a “leaked password” database in their servers. (If you want to check against these, there are real password dumps with list of leaked passwords you can ctrl+f yourself in your own PC, but even then they are likely not complete list as there still exist other database leaks of hashes where your password is not bruteforced yet to be put in plaintext but someone with more time might have gotten to it)