secure browser bangladesh (1)

Bangla Browser: The Web Browser Bangladesh Built for Itself

Bangla Browser is Bangladesh's own web browser: an allowlist-based Lockdown Mode, AES-256 encryption and 329 built-in offline tools. Free for Windows, macOS, Linux and Android.

Bangla Browser's new-tab dashboard, showing the bangla.com search bar, quick-access shortcuts to AICMS, Ezimart, ChatGPT and YouTube, and a live content feed with news, jobs, freelancing, AI and weather tabs Bangla Browser's new-tab dashboard — search, shortcuts, and a live content feed (news, jobs, freelancing, AI, weather) built into the browser itself.

By the UISC BD Editorial Desk · United Information Service Center · Updated September 2026 · 7-minute read

Most of the software a person in Dhaka, Sylhet, or Rajshahi uses every day — the browser, the search box, the messaging app — was built somewhere else, for someone else's market. Bangla Browser is a rare and deliberate exception. Built by the Dhaka-based Bir Bangali Group, it is a complete, homegrown web browser — search engine, code editor, messenger, and a 329-tool offline library all included — designed and shipped from Bangladesh, for anyone in the world who wants a browser that answers to them rather than to an advertising network.

Now at version 9.0.1, Bangla Browser is free, requires no account, and runs on Windows, macOS, Linux, and Android. What makes it genuinely newsworthy, though, is not that a Bangladeshi team built a browser — it's the security model they chose to build it around.

Lockdown Mode: Turning the Security Model Inside Out

Every mainstream browser secures you with a blocklist: a running list of domains already known to be dangerous. The obvious flaw is timing. A blocklist cannot warn you about a phishing domain that was registered an hour ago, because it hasn't been reported yet — and a fresh look-alike of your bank's login page will load without complaint until someone else gets burned first and flags it.

Bangla Browser's signature feature, Lockdown Mode, inverts that logic entirely. Instead of a list of what to block, you keep a list of what to allow. Nothing outside it resolves, loads, or receives a connection — not a freshly registered scam domain, not a convincing look-alike of a familiar site, and not even a bare IP address typed directly into the bar, since an address can't be placed on a name-based allowlist in the first place. If an approved site needs a resource that isn't on the list yet, a live block log shows exactly which domain was refused and why, and it can be allowed in a single click.

Layered alongside Lockdown is TLD locking — the ability to shut an entire top-level domain, such as .zip, .top, or .xyz, in one move rather than blocking one malicious address at a time forever. For a family, that protection is backed by a PIN hashed with PBKDF2 and rate-limited after five wrong attempts; the browser deliberately has no PIN-recovery path, because a recovery path is exactly the kind of bypass a determined teenager — or an attacker — would look for.

Who Actually Needs This

The Bir Bangali Group built Lockdown Mode with specific, high-stakes users in mind, and their target list reads like a map of Bangladesh's digital economy:

  • Government and defence offices, where Lockdown and TLD locking together turn a terminal into a closed system that reaches only pre-approved destinations.
  • Freelancers and remittance earners — a workforce this newsroom has covered in depth (see our report on Bangladesh's freelance economy) — for whom a single hijacked marketplace account can mean a month's income vanishing overnight.
  • Doctors, engineers, teachers, and small business owners who keep patient files, technical drawings, exam papers, or account books on the same machine they browse with.
  • Parents, via the PIN-protected controls that survive both a settings reset and an app restart.

What's Built In, Not Bolted On

Bangla Browser's second distinguishing choice is how little it depends on outside services. Search, messaging, code editing, and an offline library are all built by the same team, under the same roof:

  • bangla.com search — the browser's own index. No search-history profile is assembled, and no query is sold; the default engine can be switched to Google or any other provider at will.
  • Bangla Bird — a built-in messenger for chat, voice, and file transfer across a shared Wi-Fi network, with nothing routed through an external server.
  • Bangla Coder — a full code editor with a file tree, syntax highlighting, an integrated terminal, Git support, and an assistant, so a developer never has to install a separate IDE.
  • 329 offline tools and 219 built-in games — PDF, image, and video utilities, converters, and calculators that all run locally, plus an offline learning library and game library that work with the network unplugged entirely.
  • A built-in WireGuard VPN, shipped as part of the browser rather than as a third-party extension the user has to trust separately.
Bangla Coder, Bangla Browser's built-in code editor, showing the file explorer, editor pane, and the Bangla AI assistant panel with keyboard shortcuts and Fix, Explain, Optimize, Tests, Docs and Security actions Bangla Coder's built-in AI assistant panel — file tree, editor and terminal on the left, an in-editor AI pair-programmer on the right, with one-click Fix, Explain, Optimize, Tests, Docs and Security actions.

Bangla Agent: A Web AI Agent Built Into the Browser

Beyond the offline tools and Bangla Coder, the browser also ships with Bangla Agent (বাঙলা এজেন্ট) — an AI agent that reads a webpage, clicks, types, and navigates on the user's behalf, directly from the browser's own toolbar. Rather than locking users into one AI provider, Bangla Agent lets a user bring their own API key from OpenAI, Claude, Gemini, DeepSeek, or Qwen and run it free of charge, or subscribe to the company's own "Bangla Cloud" package to skip managing an API key altogether.

Bangla Agent settings screen in Bangla Browser, showing options to use a personal API key from OpenAI, Claude, Gemini, DeepSeek or Qwen, or subscribe to the Bangla Cloud package Bangla Agent's setup screen — bring your own API key from any major AI provider, or use the browser maker's own Bangla Cloud package.

The security framing is consistent with the rest of the browser: the interface states that API keys are encrypted in the device's own OS keychain and that no webpage ever sees them, since every model call is routed through the browser's main process rather than the page itself. It is a small but telling design choice — even a bolted-on AI feature gets the same "keep it on the device" treatment as passwords and sync data.

The Numbers Behind the Encryption

Bangla Browser publishes its cryptographic specification rather than asking users to take security on faith — a transparency choice worth naming directly, because it's the kind of verifiable claim that separates a real security product from a marketing one:

ComponentSpecification
CipherAES-256-GCM
Key derivationPBKDF2, 600,000 iterations
DNSDNS-over-HTTPS by default
TransportHTTPS-only by default
Malware blocklist517 hosts, regularly updated
VPNWireGuard, built in
TelemetryNone
Account requiredNo

Sync data, saved passwords, and card details are encrypted on the device itself before anything leaves it, and the passphrase never reaches a server — which also means the Bir Bangali Group cannot recover it on a user's behalf. That is a deliberate trade-off, not an oversight: no recovery channel means no channel for anyone else to exploit either.

Three Editions, One Security Model

Bangla Browser ships in three editions, and the company is explicit that Lockdown Mode, TLD locking, the PIN, and the encryption are identical across all three — only the surrounding software differs:

  • Bangla (343 MB) — the full edition, bundling the 219 games, 329 tools, the offline learning library, Bangla Coder, and Bangla Bird alongside the browser.
  • Bangla Lite (146 MB) — browser and security only, built for older hardware and office machines, and able to run portably with no installation at all.
  • Bangla for Android — a native mobile app, not a wrapped web view, bringing the same Lockdown Mode and parental PIN to a phone and syncing with the desktop edition.

Why This Matters Beyond Bangladesh

It is easy to undersell what it takes for a team outside the usual browser-building centres — Mountain View, Redmond, Beijing — to ship a Chromium-class browser with its own search index, its own messenger, its own IDE, and a cryptographic specification it is willing to publish for scrutiny. Every one of those components is a place where a typical browser quietly hands your data to a third party; Bangla Browser's entire design argument is that fewer of those handoffs means fewer places for anything to leak. For a country whose freelancers, garment-sector back offices, and public agencies increasingly live online, that argument lands with unusual weight — and it's the kind of quietly ambitious, homegrown engineering that deserves to be known well outside Bangladesh's own borders.

Download Bangla Browser

Bangla Browser is free, requires no account, and is available for Windows 10/11 (installer or portable), macOS (.dmg or portable .zip), most major Linux distributions (Ubuntu, Debian, Mint, Pop!_OS, Fedora, RHEL, openSUSE, Arch, Manjaro, EndeavourOS, plus generic AppImage and tar.gz builds), and Android.

Official download page: https://bangla.it.com/en/

Frequently Asked

Won't an allowlist break the ordinary web? Bangla Browser ships with Lockdown Mode switched off by default; it is an opt-in mode for people who specifically want a closed browsing environment, not the default experience.

Is it Chromium-based, and is it open source? and where does my data go? — these and other common questions are answered directly on the official FAQ at bangla.it.com.

Related reading

Sources

Read more…