At the top level. A third party must have your password to check it against anything. I do not, should not and will not trust my passwords to anyone.