The Browser That Locks Down: Inside Bangladesh's Billion-Dollar Software Bet

Bangla Browser pairs the world's first built-in Lockdown Mode with its own search index, an agentic AI assistant and a full code editor — a homegrown platform with billion-dollar potential.

By the UISC BD Editorial Desk · United Information Service Center · Published 9 September 2026 · 12-minute read

Most countries import their software. They import the browser, the search engine, the code editor, the AI assistant, and the security model underneath all of it. Bangladesh has decided not to.

Bangla Browser, built in Dhaka by the Bir Bangali Group and now at version 9.0.1, is not a rebadged Chromium skin with a national flag on the splash screen. It ships its own search index, its own messenger, a full integrated development environment, an agentic AI assistant that can operate web pages on the user's behalf, and a security architecture that does something no mainstream browser has done before: it refuses everything by default.

Taken together, it represents the most commercially ambitious software product ever released from Bangladesh — and the clearest test yet of whether the country's ICT export ambitions can move beyond selling labour hours toward selling products.

Lockdown Mode: The First of Its Kind in a Consumer Browser

Every mainstream browser protects users with a blocklist — a running catalogue of domains already known to be malicious. The logic is reactive by design, and its weakness is arithmetic rather than engineering: a domain registered this morning cannot appear on a list of yesterday's threats.

Phishing operations exploit precisely that gap. A convincing replica of a bank login page, hosted on a domain registered hours earlier, will load without complaint in Chrome, Edge, Safari or Firefox until enough people are defrauded for someone to report it.

Bangla Browser's Lockdown Mode inverts the model entirely. Instead of listing what to block, the user lists what to allow. Anything outside that allowlist does not resolve, does not load, and never receives a connection.

The practical differences are stark:

This is, to the best of available public knowledge, the first time an allowlist-first security model has been shipped as a native, built-in mode of a general-purpose consumer browser — rather than as an enterprise proxy appliance, a corporate firewall policy, or a third-party extension the user has to find, install and trust separately.

The distinction matters commercially. Enterprise web-filtering is an established, expensive market. Bangla Browser puts a comparable capability in a free download aimed at families, freelancers and small offices.

TLD Locking, the Live Block Log, and Why Silent Blocking Fails

Two supporting features make Lockdown usable rather than merely strict.

TLD locking operates independently of the allowlist. It shuts an entire top-level domain family in one action. Most users never knowingly visit a .zip address; a great deal of malware distribution does. Blocking the whole family costs an ordinary user nothing and removes an entire attack surface.

The live block log solves the problem that sinks most aggressive security tools. A protection that refuses something silently produces a page that appears broken for no reason, and users respond by disabling the protection entirely. Bangla Browser lists every refusal as it happens — which domain was refused, why, and which page requested it — and lets the user approve the one it actually needed directly from that row. The log lives in memory and is never transmitted anywhere.

Protection Built for Children, Not Bolted On

Parental controls in most browsers are a toggle in a settings menu, which is to say they are a suggestion. Bangla Browser's approach is structurally different.

The parental PIN is hashed with PBKDF2, rate-limited after five wrong attempts, and re-locked whenever the application closes. Critically, resetting the browser's preferences does not clear it — the reset trick that defeats most parental controls simply does not work. There is deliberately no PIN recovery path, on the reasoning that a recovery path is itself the bypass.

Combined with Lockdown and TLD locking, this produces something genuinely rare in consumer software: a child's device on which a parent defines a finite list of permitted destinations, and the child cannot expand that list, reset it, or wait it out by restarting the machine.

For a country where a substantial share of children access the internet on a shared family device with limited supervision, that is not a minor feature.

A Search Engine, an Index, and the Profiling Question

The component that most distinguishes Bangla Browser from any comparable project is that it does not outsource search.

bangla.com is the browser's own search engine, running on its own index — not a reskinned front end over someone else's results. Building and maintaining a web index is one of the genuinely hard problems in computing, requiring continuous crawling, storage, ranking infrastructure and freshness management. Very few organisations anywhere attempt it, and almost none outside the United States, China and Russia sustain it.

The company's stated direction extends further: indexing individual people and small entities — professionals, service providers and local businesses who have no website and therefore effectively do not exist in conventional search. In a market where a large share of economic activity runs through individuals rather than registered companies with web presences, an index built around people rather than domains addresses a real structural gap.

On privacy, the published position is explicit: no search profile is assembled and no query is sold to advertisers, and the default engine can be switched to Google or any other provider at any time. That combination — own index, no advertising profile, user-switchable default — is a deliberately different bargain from the one the search market normally offers.

Bangla Agent: Agentic Browsing With Your Own API Key

Bangla Browser ships an AI agent, Bangla Agent, directly in the toolbar. It reads the page, then clicks, types and navigates on the user's behalf — the emerging category usually called agentic browsing.

The architectural decision that matters here is provider neutrality. Rather than binding users to a single AI vendor, Bangla Agent accepts a user-supplied API key from any major provider — OpenAI, Anthropic (Claude), Google Gemini, DeepSeek or Qwen, or anything OpenAI-compatible, which includes aggregation layers such as OpenRouter. Users who prefer not to manage keys can instead subscribe to the company's own Bangla Cloud package.

The security handling is consistent with the rest of the product: API keys are encrypted in the device's own OS keychain, and no web page ever sees them, because every model call is routed through the browser's main process rather than the page context.

That design choice has a commercial dimension worth naming. Bring-your-own-key means the browser does not have to subsidise inference costs to acquire users — the constraint that has made agentic browsing economically punishing for better-funded competitors. It also means a user in Dhaka paying for frontier model access can route it through software built locally rather than surrendering the interface layer to a foreign platform.

Bangla Coder: An IDE Inside the Browser

Bangla Coder is a full development environment built into the browser: file tree, syntax highlighting, integrated terminal, Git support, and an AI pair-programmer panel offering one-click Fix, Explain, Optimize, Tests, Docs and Security actions, with keyboard shortcuts for rapid file navigation, project-wide search, command palette and a focused Zen editing mode.

The strategic logic becomes clear when you consider the user base. Bangladesh has roughly a million freelancers, a large share working in software and web development, many on modest hardware. Shipping a capable IDE inside the browser they already run removes an installation, a licence consideration, and a hardware requirement simultaneously.

The Encryption Specification, Stated Precisely

Security claims are easy to make and hard to verify. Bangla Browser publishes its specification, which allows the claims to be assessed on their merits:

Two of those entries deserve context rather than adjectives. AES-256 is the symmetric cipher approved by the United States National Security Agency for protecting information classified up to TOP SECRET — the same algorithm class relied on by defence and government systems worldwide. And 600,000 PBKDF2 iterations is a deliberately expensive key-derivation setting that meets current OWASP guidance, making offline password-cracking attempts dramatically slower.

Sync data, saved passwords and card details are encrypted on the device before anything leaves it, and the passphrase never reaches a server — which also means the company cannot recover it. That is a genuine trade-off, disclosed rather than hidden.

Why Defence and Government Offices Are an Explicit Target

The company names defence and state offices among its intended users, and the reasoning is straightforward. With Lockdown and TLD locking both enabled, a terminal becomes effectively a closed system: it reaches approved destinations and nothing else. That is the security posture normally achieved with dedicated hardware appliances and a managed network — delivered here as browser configuration.

For an organisation where a single exfiltration event is unrecoverable, an allowlist enforced at the browser rather than only at the network edge closes the gap that opens the moment a laptop leaves the building.

Everything Else in the Box

• Bangla Bird — a built-in messenger handling chat, voice and file transfer across a single Wi-Fi network, with nothing routed through an external server
• 329 offline tools — PDF, image and video utilities, converters and calculators, all processing files locally with no upload
• 219 built-in games — no advertising, no in-app purchases, fully functional with the network disconnected
• An offline learning library, plus dedicated modules for farmers, livestock keepers and fishers

The offline emphasis is a design response to local conditions rather than a novelty. In areas where connectivity is intermittent or metered, software that keeps working without a connection is not a convenience feature.

Three Editions, One Security Model

• Bangla (343 MB) — the full edition with the complete tool, game and learning library, Coder and Bird included. Windows and Linux.
• Bangla Lite (146 MB) — browser and security only, for older hardware and single-purpose office machines. Runs portably with no installation.
• Bangla for Android (v0.1.0, Android 8+) — a native application rather than a wrapped web view, carrying browser-level Lockdown and the parental PIN to mobile, and syncing with the desktop edition.

Lockdown, TLD locking, the PIN and the encryption are identical across all three. Only the bundled software differs.

The Billion-Dollar Question

Is the commercial opportunity real? The honest answer is that the addressable markets are real, and capturing them is unproven.

Consider what the product touches: the enterprise web-filtering market, the parental-control software market, the developer-tools market, the emerging agentic-browsing market, and search advertising. Each is measured in billions of dollars globally. A product that credibly addresses several at once, from a low-cost engineering base, has a plausible path to significant revenue.

The obstacles are equally real: distribution, brand trust outside Bangladesh, security auditing by independent third parties, and the sheer cost of maintaining a search index against incumbents with vastly deeper resources.

What can be said without exaggeration is that Bangladesh now has a software product operating in categories its ICT sector has never competed in before — and that this is precisely the move up the value chain that the pharmaceutical sector made a generation earlier, and that the country's technology strategy has been calling for.

Download Bangla Browser

Bangla Browser is free, requires no account, and collects no telemetry. Builds are available for Windows 10/11 (installer or portable), macOS (.dmg or portable .zip), major Linux distributions — Ubuntu, Debian, Mint, Pop!_OS, Fedora, RHEL, openSUSE, Arch, Manjaro, EndeavourOS, plus generic AppImage and tar.gz — and Android.

Official download page: https://bangla.it.com/en/

On Windows, the installer can be launched from PowerShell in the Downloads folder. On Android, the system will ask once for permission to install from an unknown source.

Frequently Asked Questions

Is Bangla Browser free to download?

Yes. All three editions are free, with no account required and no telemetry collected. The optional Bangla Cloud package for the AI agent is the only paid component.

What is Lockdown Mode in a browser?

Lockdown Mode is an allowlist-based security setting: only domains you explicitly approve will load, and everything else is refused before a connection is opened. It ships switched off and is opt-in.

Won't an allowlist break normal web browsing?

It changes it substantially, which is why it is off by default. It is designed for users who specifically want a closed browsing environment — a child's device, a single-purpose office machine, or a terminal handling sensitive work.

Can a child turn off the parental controls?

Not without the PIN. The setting survives a preferences reset and an application restart, and there is no recovery path.

Which AI models does Bangla Agent support?

Any OpenAI-compatible model, including OpenAI, Anthropic Claude, Google Gemini, DeepSeek and Qwen, using your own API key — or the Bangla Cloud subscription if you prefer not to manage keys.

Is Bangla Browser safe to use?

Its published specification uses AES-256-GCM encryption, PBKDF2 key derivation at 600,000 iterations, DNS-over-HTTPS and HTTPS-only defaults, with no telemetry. As with any security product, independent third-party auditing would strengthen the claims further.

Does it work offline?

Substantially, yes. The 329 tools, 219 games and learning library all function with no network connection.

Related reading

• Bangla Browser: Bangladesh's Own Secure Web Browser
• Bangladesh's ICT Export Industry: From 2% of GDP to 10%
• Quantum Computers Crossed the Error Threshold That Made Them Useless
• What an AI Agent Actually Is, and How It Differs From a Chatbot

Sources

• Bangla Browser, official product site — bangla.it.com/en
• Product interface documentation, Bangla Agent and Bangla Coder settings screens (bangla://agent, bangla://bangla-coder), version 9.0.1
• AiCMS.BD public code repositories — github.com/aicmsbd
• OWASP Password Storage Cheat Sheet (PBKDF2 iteration guidance) — cheatsheetseries.owasp.org

Bangla Browser: The Web Browser Bangladesh Built for Itself

Bangla Browser is Bangladesh's own web browser: an allowlist-based Lockdown Mode, AES-256 encryption and 329 built-in offline tools. Free for Windows, macOS, Linux and Android.

By the UISC BD Editorial Desk · United Information Service Center · Updated September 2026 · 7-minute read

Most of the software a person in Dhaka, Sylhet, or Rajshahi uses every day — the browser, the search box, the messaging app — was built somewhere else, for someone else's market. Bangla Browser is a rare and deliberate exception. Built by the Dhaka-based Bir Bangali Group, it is a complete, homegrown web browser — search engine, code editor, messenger, and a 329-tool offline library all included — designed and shipped from Bangladesh, for anyone in the world who wants a browser that answers to them rather than to an advertising network.

Now at version 9.0.1, Bangla Browser is free, requires no account, and runs on Windows, macOS, Linux, and Android. What makes it genuinely newsworthy, though, is not that a Bangladeshi team built a browser — it's the security model they chose to build it around.

Lockdown Mode: Turning the Security Model Inside Out

Every mainstream browser secures you with a blocklist: a running list of domains already known to be dangerous. The obvious flaw is timing. A blocklist cannot warn you about a phishing domain that was registered an hour ago, because it hasn't been reported yet — and a fresh look-alike of your bank's login page will load without complaint until someone else gets burned first and flags it.

Bangla Browser's signature feature, Lockdown Mode, inverts that logic entirely. Instead of a list of what to block, you keep a list of what to allow. Nothing outside it resolves, loads, or receives a connection — not a freshly registered scam domain, not a convincing look-alike of a familiar site, and not even a bare IP address typed directly into the bar, since an address can't be placed on a name-based allowlist in the first place. If an approved site needs a resource that isn't on the list yet, a live block log shows exactly which domain was refused and why, and it can be allowed in a single click.

Layered alongside Lockdown is TLD locking — the ability to shut an entire top-level domain, such as .zip, .top, or .xyz, in one move rather than blocking one malicious address at a time forever. For a family, that protection is backed by a PIN hashed with PBKDF2 and rate-limited after five wrong attempts; the browser deliberately has no PIN-recovery path, because a recovery path is exactly the kind of bypass a determined teenager — or an attacker — would look for.

Who Actually Needs This

The Bir Bangali Group built Lockdown Mode with specific, high-stakes users in mind, and their target list reads like a map of Bangladesh's digital economy:

• Government and defence offices, where Lockdown and TLD locking together turn a terminal into a closed system that reaches only pre-approved destinations.
• Freelancers and remittance earners — a workforce this newsroom has covered in depth (see our report on Bangladesh's freelance economy) — for whom a single hijacked marketplace account can mean a month's income vanishing overnight.
• Doctors, engineers, teachers, and small business owners who keep patient files, technical drawings, exam papers, or account books on the same machine they browse with.
• Parents, via the PIN-protected controls that survive both a settings reset and an app restart.

What's Built In, Not Bolted On

Bangla Browser's second distinguishing choice is how little it depends on outside services. Search, messaging, code editing, and an offline library are all built by the same team, under the same roof:

• bangla.com search — the browser's own index. No search-history profile is assembled, and no query is sold; the default engine can be switched to Google or any other provider at will.
• Bangla Bird — a built-in messenger for chat, voice, and file transfer across a shared Wi-Fi network, with nothing routed through an external server.
• Bangla Coder — a full code editor with a file tree, syntax highlighting, an integrated terminal, Git support, and an assistant, so a developer never has to install a separate IDE.
• 329 offline tools and 219 built-in games — PDF, image, and video utilities, converters, and calculators that all run locally, plus an offline learning library and game library that work with the network unplugged entirely.
• A built-in WireGuard VPN, shipped as part of the browser rather than as a third-party extension the user has to trust separately.

Bangla Agent: A Web AI Agent Built Into the Browser

Beyond the offline tools and Bangla Coder, the browser also ships with Bangla Agent (বাঙলা এজেন্ট) — an AI agent that reads a webpage, clicks, types, and navigates on the user's behalf, directly from the browser's own toolbar. Rather than locking users into one AI provider, Bangla Agent lets a user bring their own API key from OpenAI, Claude, Gemini, DeepSeek, or Qwen and run it free of charge, or subscribe to the company's own "Bangla Cloud" package to skip managing an API key altogether.

The security framing is consistent with the rest of the browser: the interface states that API keys are encrypted in the device's own OS keychain and that no webpage ever sees them, since every model call is routed through the browser's main process rather than the page itself. It is a small but telling design choice — even a bolted-on AI feature gets the same "keep it on the device" treatment as passwords and sync data.

The Numbers Behind the Encryption

Bangla Browser publishes its cryptographic specification rather than asking users to take security on faith — a transparency choice worth naming directly, because it's the kind of verifiable claim that separates a real security product from a marketing one:

Sync data, saved passwords, and card details are encrypted on the device itself before anything leaves it, and the passphrase never reaches a server — which also means the Bir Bangali Group cannot recover it on a user's behalf. That is a deliberate trade-off, not an oversight: no recovery channel means no channel for anyone else to exploit either.

Three Editions, One Security Model

Bangla Browser ships in three editions, and the company is explicit that Lockdown Mode, TLD locking, the PIN, and the encryption are identical across all three — only the surrounding software differs:

• Bangla (343 MB) — the full edition, bundling the 219 games, 329 tools, the offline learning library, Bangla Coder, and Bangla Bird alongside the browser.
• Bangla Lite (146 MB) — browser and security only, built for older hardware and office machines, and able to run portably with no installation at all.
• Bangla for Android — a native mobile app, not a wrapped web view, bringing the same Lockdown Mode and parental PIN to a phone and syncing with the desktop edition.

Why This Matters Beyond Bangladesh

It is easy to undersell what it takes for a team outside the usual browser-building centres — Mountain View, Redmond, Beijing — to ship a Chromium-class browser with its own search index, its own messenger, its own IDE, and a cryptographic specification it is willing to publish for scrutiny. Every one of those components is a place where a typical browser quietly hands your data to a third party; Bangla Browser's entire design argument is that fewer of those handoffs means fewer places for anything to leak. For a country whose freelancers, garment-sector back offices, and public agencies increasingly live online, that argument lands with unusual weight — and it's the kind of quietly ambitious, homegrown engineering that deserves to be known well outside Bangladesh's own borders.

Download Bangla Browser

Bangla Browser is free, requires no account, and is available for Windows 10/11 (installer or portable), macOS (.dmg or portable .zip), most major Linux distributions (Ubuntu, Debian, Mint, Pop!_OS, Fedora, RHEL, openSUSE, Arch, Manjaro, EndeavourOS, plus generic AppImage and tar.gz builds), and Android.

Official download page: https://bangla.it.com/en/

Frequently Asked

Won't an allowlist break the ordinary web? Bangla Browser ships with Lockdown Mode switched off by default; it is an opt-in mode for people who specifically want a closed browsing environment, not the default experience.

Is it Chromium-based, and is it open source? and where does my data go? — these and other common questions are answered directly on the official FAQ at bangla.it.com.

Related reading

• The Browser That Locks Down: Bangladesh's Billion-Dollar Bet
• Bangladesh's ICT Export Industry: From 2% of GDP to 10%
• Is Your Data Safe With AI Chatbots? How to Opt Out of Training
• Vibe Coding: Why AI-Written Code Fails Security Tests

Sources

• Bangla Browser, official product site (English) — bangla.it.com/en