diff --git a/services/wordlist.js b/services/wordlist.js
index 2ae8ed90c..477baace6 100644
--- a/services/wordlist.js
+++ b/services/wordlist.js
@@ -9,6 +9,10 @@ const Errors = require('../errors');
 // REGEX to prevent emoji's from entering the wordlist.
 const EMOJI_REGEX = /(?:[\u2700-\u27bf]|(?:\ud83c[\udde6-\uddff]){2}|[\ud800-\udbff][\udc00-\udfff])[\ufe0e\ufe0f]?(?:[\u0300-\u036f\ufe20-\ufe23\u20d0-\u20f0]|\ud83c[\udffb-\udfff])?(?:\u200d(?:[^\ud800-\udfff]|(?:\ud83c[\udde6-\uddff]){2}|[\ud800-\udbff][\udc00-\udfff])[\ufe0e\ufe0f]?(?:[\u0300-\u036f\ufe20-\ufe23\u20d0-\u20f0]|\ud83c[\udffb-\udfff])?)*/;
 
+const escapeRegExp = function(s) {
+  return String(s).replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+};
+
 /**
  * The root wordlist object.
  * @type {Object}
@@ -74,7 +78,7 @@ class Wordlist {
         return [word];
       }
       
-      return tokenizer.tokenize(word.toLowerCase());
+      return tokenizer.tokenize(escapeRegExp(word.toLowerCase()));
     })
     .filter((tokens) => {
       if (tokens.length === 0) {