I went with HackMyIP because its response includes a risk score and password breakdown, which made the output more useful. But you're right it just proxies XposedOrNot.
You're right — it's a wrapper. I picked HackMyIP because it was
the easiest free API to start with, but you're correct that it
sits on top of XposedOrNot.