diff --git a/android/app/src/main/java/com/meshchatx/MeshchatDownloadUtils.java b/android/app/src/main/java/com/meshchatx/MeshchatDownloadUtils.java
index 8ad709d..a19da78 100644
--- a/android/app/src/main/java/com/meshchatx/MeshchatDownloadUtils.java
+++ b/android/app/src/main/java/com/meshchatx/MeshchatDownloadUtils.java
@@ -16,7 +16,8 @@ final class MeshchatDownloadUtils {
         if (base.isEmpty()) {
             return "download.bin";
         }
-        base = base.replaceAll("[^A-Za-z0-9._ -]+", "_").trim();
+        // Hyphen must be first or last in the class so it is literal, not a range (space..hyphen would include '*').
+        base = base.replaceAll("[^A-Za-z0-9._ \\-]+", "_").trim();
         if (base.isEmpty()) {
             return "download.bin";
         }
diff --git a/android/app/src/test/java/com/meshchatx/MeshchatDownloadUtilsTest.java b/android/app/src/test/java/com/meshchatx/MeshchatDownloadUtilsTest.java
index 1761ea8..73cf40a 100644
--- a/android/app/src/test/java/com/meshchatx/MeshchatDownloadUtilsTest.java
+++ b/android/app/src/test/java/com/meshchatx/MeshchatDownloadUtilsTest.java
@@ -19,7 +19,7 @@ public class MeshchatDownloadUtilsTest {
 
     @Test
     public void sanitize_replacesUnsafeCharacters() {
-        Assert.assertEquals("mesh_x_folders.json", MeshchatDownloadUtils.sanitizeFileName("mesh:x?folders*.json"));
+        Assert.assertEquals("mesh_x_folders_.json", MeshchatDownloadUtils.sanitizeFileName("mesh:x?folders*.json"));
     }
 
     @Test