You're right — it's a wrapper. I picked HackMyIP because it was the easiest free API to start with, but you're correct that it sits on top of XposedOrNot.

I went with HackMyIP because its response includes a risk score and password breakdown, which made the output more useful. But you're right it just proxies XposedOrNot.