Engineering utility

Sequence Diagram Generator

Write authentication, provisioning, and PKI flow diagrams in WebSequenceDiagrams syntax; get clean SVG or PNG output. Seven security-engineering templates included — FIDO2 / WebAuthn, SCP03 personalisation, eSIM SGP.32 download, V2X PKI enrolment + Butterfly batch, UPI collect, banking MFA, and device-identity lifecycle. All rendering happens in your browser.

Client-sideNo uploadSVG & PNG exportUpdated 2026-05

How to use this tool

What it does

Renders a sequence (ladder) diagram from a plain-text description of messages between participants — host, card, server.

When to use it

Use it to sketch or document a protocol flow — an APDU exchange, a WebAuthn ceremony, an SCP03 handshake — without a heavyweight diagramming tool.

Worked example

Describe host -> card: SELECT and card -> host: 9000 to render a two-actor ladder you can export.

Source

Template:

No syntax errors.

Import .txt

Preview

Shortcuts: Cmd/Ctrl + Enter render now · Tab indent · autosaved to localStorage.

All parsing, layout, and rendering happens in your browser. No source bytes are sent to a server. The current source is autosaved locally; clear the editor to remove it.

Supported syntax

A WebSequenceDiagrams-style subset. Lines are evaluated in order; participants referenced by messages or notes are auto-declared if not declared explicitly. Comment lines start with # or //.

title <text> — diagram title (one per file)
participant Alice · participant "Long Name" as A
actor User — stick-figure participant
A -> B: label — synchronous message
A ->> B: label — asynchronous (open arrow)
A --> B: label — dashed reply
A -->> B: label — dashed async reply
A -> A: label — self-loop
note over A: text · note over A,B: text
note left of A: text · note right of A: text
alt <cond> / else <cond> / end
loop <cond> / end
opt <cond> / end
autonumber — auto-number subsequent messages
\n inside labels — line break

Templates

FIDO2 / WebAuthn authentication

Full assertion ceremony — PublicKeyCredentialRequestOptions → authenticator user verification → signature → relying-party verify with counter / origin / RP-ID-hash checks. See also how FIDO authentication works.

Secure-element provisioning (SCP03)

HSM-backed personalisation line: INITIALIZE UPDATE → EXTERNAL AUTHENTICATE → per-applet PUT KEY with hash-chained audit log. See also device identity at manufacturing scale.

eSIM SGP.32 profile download

IoT eSIM RSP: SM-DS discovery, mutual auth with SM-DP+, bound-profile-package delivery, optional enable. See also the SGP.32 reference.

V2X PKI enrolment + AA batch

EA enrolment under manufacturer attestation, then Butterfly Key Expansion for an Authorisation Authority batch of pseudonymous certificates. See also how V2X PKI works.

UPI payment — collect + verify

NPCI switch flow with encrypted PIN block, payer-bank authorise, credit settlement. The kind of diagram every UPI integration spec needs.

Banking login — phishing-resistant MFA

Password + WebAuthn step-up + risk engine. Alt-branch on risk score for out-of-band confirmation.

Device identity lifecycle

Factory mint → field enrolment → operational refresh → re-enrolment → revocation across always-on / intermittent / offline tiers.

FAQ

Why a sequence diagram tool on an embedded-security site?

Authentication ceremonies, V2X PKI flows, eSIM RSP exchanges, and SCP03 personalisation steps are sequence diagrams in disguise. Every architecture review of these systems ends up sketching one. Owning the tool that draws them — with templates that match the actual standards — cuts review cycles for our engineering team and is useful to external readers working in the same space.

Why not just use WebSequenceDiagrams.com or Mermaid?

WebSequenceDiagrams.com is a paid hosted service that uploads your source to render. For an under-NDA architecture diagram (which authentication and provisioning flows often are), that’s the wrong privacy posture. Mermaid is excellent but uses a different syntax convention; this tool stays close to the WebSequenceDiagrams grammar engineers in the security space already know.

What is the current syntax-feature gap?

Not yet supported: par / end (concurrent branches), activate / deactivate (lifeline activations), participant grouping, and Mermaid- or PlantUML-style syntax. The architecture is designed to accept these in a follow-up phase without rewriting the layout engine.

How does dark mode work?

The SVG honours prefers-color-scheme: dark in your browser or operating system. Switch your OS appearance to dark and reload to see the dark theme. No toggle ships with the tool because the rest of the AmbiSecure site does not currently expose one.

Frequently asked questions

What syntax does this tool accept?

A subset of the WebSequenceDiagrams syntax: title, participant / actor (with optional 'as' alias), note left of / right of / over, synchronous messages (->), asynchronous messages (->>), dashed replies (--> and -->>), alt / else / end, loop / end, opt / end, and autonumber. Self-loops, multi-line note labels via \\n, and quoted multi-word participant names are supported.

Does anything I type leave my browser?

No. Parsing, layout, and rendering all run client-side in JavaScript. The diagram source is autosaved to your browser's localStorage so it survives reloads. No analytics, no server, no telemetry. Export of SVG or PNG happens locally via a download blob.

How is this different from Mermaid or PlantUML?

The syntax is closer to WebSequenceDiagrams (and to ETSI / IEEE conventions used in security specs) than to Mermaid's mermaid-specific grammar. The renderer is hand-rolled SVG matching the AmbiSecure design language. Mermaid and PlantUML support could be layered on top in a follow-up; this tool ships with the WebSequenceDiagrams subset only.

Why are there security-engineering templates baked in?

The tool is positioned for the engineers who actually need to communicate authentication, provisioning, and PKI flows under review. FIDO2 / WebAuthn, SCP03 personalisation, eSIM SGP.32 profile download, V2X PKI EA/AA + Butterfly batch, UPI collect request, banking MFA, and device-identity lifecycle are the seven flows that recur in security architecture documents. Each template is editable; pick one, then refactor it for your deployment.

Can I export to PDF?

Not in this version. SVG and PNG export are supported. SVG is vector-clean and converts losslessly to PDF in any modern viewer (Preview, browser print-to-PDF, Illustrator, Inkscape). PDF export inside the tool would require a heavy in-browser PDF library, which conflicts with the client-side, no-build-step architecture this tool follows.