diff --git a/src/Illuminate/Validation/NotPwnedVerifier.php b/src/Illuminate/Validation/NotPwnedVerifier.php
index a178f8c14010..a7ae7c69e429 100644
--- a/src/Illuminate/Validation/NotPwnedVerifier.php
+++ b/src/Illuminate/Validation/NotPwnedVerifier.php
@@ -15,15 +15,24 @@ class NotPwnedVerifier implements UncompromisedVerifier
      */
     protected $factory;
 
+    /**
+     * The number of seconds the request can run before timing out.
+     *
+     * @var int
+     */
+    public $timeout;
+
     /**
      * Create a new uncompromised verifier.
      *
      * @param  \Illuminate\Http\Client\Factory  $factory
+     * @param  int  $timeout
      * @return void
      */
-    public function __construct($factory)
+    public function __construct($factory, $timeout = null)
     {
         $this->factory = $factory;
+        $this->timeout = $timeout ?? 15;
     }
 
     /**
@@ -77,7 +86,7 @@ protected function search($hashPrefix)
         try {
             $response = $this->factory->withHeaders([
                 'Add-Padding' => true,
-            ])->get(
+            ])->timeout($this->timeout)->get(
                 'https://api.pwnedpasswords.com/range/'.$hashPrefix
             );
         } catch (Exception $e) {
diff --git a/tests/Validation/ValidationNotPwnedVerifierTest.php b/tests/Validation/ValidationNotPwnedVerifierTest.php
index fb50b61a81fa..f647de68a786 100644
--- a/tests/Validation/ValidationNotPwnedVerifierTest.php
+++ b/tests/Validation/ValidationNotPwnedVerifierTest.php
@@ -7,6 +7,7 @@
 use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Http\Client\Factory as HttpFactory;
 use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\UncompromisedVerifier;
 use Illuminate\Validation\NotPwnedVerifier;
 use Mockery as m;
 use PHPUnit\Framework\TestCase;
@@ -46,6 +47,12 @@ public function testApiResponseGoesWrong()
             ->with(['Add-Padding' => true])
             ->andReturn($httpFactory);
 
+        $httpFactory
+            ->shouldReceive('timeout')
+            ->once()
+            ->with(15)
+            ->andReturn($httpFactory);
+
         $httpFactory->shouldReceive('get')
             ->once()
             ->andReturn($response);
@@ -77,6 +84,12 @@ public function testApiGoesDown()
             ->with(['Add-Padding' => true])
             ->andReturn($httpFactory);
 
+        $httpFactory
+            ->shouldReceive('timeout')
+            ->once()
+            ->with(15)
+            ->andReturn($httpFactory);
+
         $httpFactory->shouldReceive('get')
             ->once()
             ->andReturn($response);
@@ -112,6 +125,12 @@ public function testDnsDown()
             ->with(['Add-Padding' => true])
             ->andReturn($httpFactory);
 
+        $httpFactory
+            ->shouldReceive('timeout')
+            ->once()
+            ->with(15)
+            ->andReturn($httpFactory);
+
         $httpFactory
             ->shouldReceive('get')
             ->once()