I am storing user passwords bcrypted in my user database. So far so good.

Even if I am checking new (!) user passwords against haveibeenpwned.com’s api, I want to replay the check from time to time to warn my users.

I am thinking about storing the first 5 digits of the sha-1 hash of the original password to be able to re-check at any time.

Is there anyone here who can tell me – based upon some mathematics – how much this additional data will be a security problem?

To clarify: I will NOT use this 5 chars of the sha1-hash for authentication, so the collision problem is not a one (I suppose). But I don’t know whether this could become a problem together with the bcrypted hash which also exists.